Privacy policy

Last updated: October 21, 2026

This policy explains which personal data we process when you visit our websites at saasflow.com (the "Websites") or use the SaaSFlow application at app.saasflow.com (the "Services"), why we process it, who receives it, and which rights you have. We have tried to write it so you can actually read it.

Who is responsible

The controller for the processing described here is:

Walletguide GmbH
Rüggeberger Str. 94
58256 Ennepetal
Germany

Represented by Alexander Peiniger (CEO and Managing Director)
support@saasflow.com

When we act as a processor instead

SaaSFlow analyzes the financial data of your company: transactions, customers, subscriptions, bank accounts and the people appearing in that data. For this data, your company is the controller and we are the processor under Art. 28 GDPR. That processing is governed by our Data Processing Agreement, including its annexes on security measures and sub-processors. The rest of this policy describes the processing for which we ourselves are the controller.

What we process, why, and on which legal basis

Account and profile data

When you sign up or are invited to a company workspace, we process your name, email address, role and sign-in data to create and secure your account and provide the Services. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Payment data

For paid plans, you provide payment information to us and our payment provider Stripe (see our sub-processor list), which lets us charge recurring fees. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Support and communication

When you contact us by email or through the support form in the Services, we process the content of the conversation and your contact details to resolve your request. Legal basis: performance of a contract and our legitimate interest in good support (Art. 6(1)(b) and (f) GDPR).

Website visits

When you visit the Websites, our servers process technical connection data (IP address, requested pages, browser type) to deliver the pages and keep them secure. Our web analytics are cookie-less and aggregate page views without identifying you. Legal basis: our legitimate interest in operating and securing the Websites (Art. 6(1)(f) GDPR).

Ad measurement

We advertise on platforms such as Google Ads. If you arrive through one of our ads, we store the ad click identifier in a first-party cookie and, if you later sign up, report the conversion back to the advertising platform from our servers. We do not embed advertising pixels or third-party tracking scripts, and we do not build remarketing audiences from your browsing behavior. Details are in our cookie policy. Legal basis: our legitimate interest in measuring whether our advertising works (Art. 6(1)(f) GDPR).

If you subscribe to our newsletter, we use your email address to send it until you unsubscribe. Every newsletter contains an unsubscribe link. Legal basis: consent (Art. 6(1)(a) GDPR).

Error monitoring

When something in the Services fails in your browser, the app sends us the error: the message, the stack trace, the page you were on, your browser version and, if you are signed in, your user id. It goes to our own servers. No third party receives it, and it sets no cookie. We keep these reports for 90 days and use them only to find and fix the bug. Legal basis: our legitimate interest in an application that works (Art. 6(1)(f) GDPR).

AI processing

Some features of the Services use large language models. The monthly performance report, the report chat and categorization suggestions analyze your company data. When you upload a document such as an invoice, receipt or contract, a model reads amount, date and document type from it, and for Finway and Pleo imports a model suggests how to map values that are not mapped yet. These features never run on their own: they only run when someone in your company starts them, for example by requesting a report, asking a question or uploading a file.

All of these models run on Google Cloud's Vertex AI service in data centers in the EU: Anthropic's Claude models for reports, chat and categorization, and Google's Gemini models for documents and mapping suggestions. Google Cloud, which also hosts the Services, operates the models itself as our processor. The data a feature works with (for example transactions, customers, subscriptions and account balances) is processed there and is not passed on to Anthropic or any other AI provider. Details are in our sub-processor list.

AI assistants you connect

You can connect SaaSFlow to ChatGPT, Claude, Cursor or another app that supports the Model Context Protocol (MCP). This section covers everything that happens with your data when you do: what the assistant receives, what we receive and keep, who else is involved, and how you end it.

You set up the connection yourself. You add SaaSFlow in the assistant, sign in to SaaSFlow and approve the access on our consent screen, which lists what the assistant may do:

View company data. Always included.
Make changes to company data (create, update and delete). Only if you tick it.
Manage company settings and integrations. Only if the app asks for it and you tick it. Adding or removing members, creating API keys and deleting a company still need your approval in SaaSFlow for each change.
Create companies for you. Only if the app asks for it and you tick it.

Whatever you approve, the assistant only reaches the companies you have access to, and only within your own role there.

When you approve the connection, the assistant receives your name and email address from your SaaSFlow account, so it can show which account is connected. After that it receives what it asks for through our tools, when you ask it something. Depending on your question, that can be:

company details and settings, members and invitations, including their names, email addresses and roles
bank accounts and balances, and transactions with amount, date, booking text and counterparty
customers and vendors, including the names and contact details stored for them in SaaSFlow
subscriptions, products, plans and forecasts
figures we calculate, such as MRR, churn, cash flow, profit and loss or runway
reports, dashboards, comments, notifications and uploaded files such as invoices
the status of your integrations

Every tool, its parameters and what it returns are listed in our MCP tools reference.

We do not receive your conversation with the assistant, only the requests it sends to SaaSFlow: the tool it calls and the parameters, such as a company, a date range, a search term or, with write access, the values to save. Parameters can contain text from your conversation. We use a request only to answer it or, with write access, to make the change in your company data, where it is stored like a change made in the app. The assistant may add technical details to a request, such as your language or approximate location. We do not use or store them.

For each request we log which app made it, under which account, which tool it called, when, whether it succeeded, any error message and how long it took. We do not log the request or the answer itself, although an error message can quote part of the request. Our servers also record technical connection data for each request (IP address, time, requested address). We use both only to investigate errors, security incidents and misuse. We do not use any of this data for advertising or to train AI models, and we do not sell it.

The provider of the assistant (for example OpenAI for ChatGPT or Anthropic for Claude) receives the data on your instruction. It does not act on our behalf and is not one of our sub-processors. You choose the assistant, and its provider processes the data under your agreement with it and its privacy terms, possibly outside the EU. Those terms and its settings tell you how long it keeps your conversations and whether it uses them for training. On our side, the requests are handled by the same infrastructure as the rest of the Services, hosted in the EU (see our sub-processor list).

How long we keep it:

the log of requests: 90 days, then we delete it
the technical connection data: 30 days
your approval and the access tokens: until you disconnect the app. An access token is valid for one hour; the assistant renews it with a refresh token that expires after 30 days without use.
changes the assistant made: they are part of your company data and kept like any other change, as described in our Data Processing Agreement

You can see and disconnect every connected app under User settings → Connected apps in the Services. Disconnecting takes effect immediately, deletes your approval and all tokens of that app, and stops further access. It does not undo changes the assistant already made or remove data it already received; for that, use the assistant's own settings or contact its provider. To access or delete the log entries about you, email support@saasflow.com.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) for the connection and for answering the requests, and our legitimate interest in secure Services (Art. 6(1)(f) GDPR) for the logs.

Who receives your data

We use service providers for hosting, payments, email delivery, support and the features described above. Every provider that processes personal data for us is bound by a data processing agreement. Those that take part in running the Websites and Services are published with purpose, location and transfer safeguards in our sub-processor list. Providers of tools we only use internally, such as our own email and collaboration environment, are not part of that list. We do not sell personal data.

Bank connections work differently. Connecting a bank account is optional; you can also import transactions from CSV files. If you do connect one, you authorize the bank connectivity provider yourself, in its own window and under its own terms and privacy policy: finAPI (Germany) for banks in Europe, Plaid (US) for banks in the United States and Canada. The provider retrieves the data from your bank and passes it to us on your instruction. It does so as an independent controller, not on our behalf. We only send it a pseudonymous technical ID so it can assign the connection to your account. Both providers are listed in a separate section of the sub-processor list. AI assistants you connect yourself also receive data on your instruction: the data you request through them, as described under "AI assistants you connect" above.

Beyond that, we only share personal data if a merger, acquisition or financing of the SaaSFlow business requires it (we would notify you), or if we are legally obliged to, for example by a court order or a lawful request from an authority.

International transfers

Our application data is hosted in the EU. Some of our providers are US companies; for them we rely on their certification under the EU-US Data Privacy Framework where it exists, and additionally on the EU Commission's Standard Contractual Clauses, so that a valid transfer mechanism remains in place either way. The safeguard per provider is stated in the sub-processor list.

How we secure your data

We protect your data with technical and organizational measures appropriate to the risk: encrypted transmission, encryption at rest, strict access controls, tenant separation and regular reviews. The full set is published as Annex 2 of our Data Processing Agreement.

How long we keep your data

We keep personal data only as long as we need it for the purpose it was collected for; the retention period therefore differs by use case. Where possible, we apply a general rule: personal data is deleted or anonymized if you have not used our Websites and Services for more than 9 months. Exceptions apply where technical limitations prevent this or where laws require longer storage, for example tax rules for retaining documents. Deletion after the end of a company contract follows § 9 of the Data Processing Agreement.

Your rights

You have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict its processing, and to receive it in a machine-readable format. If processing is based on your consent, you can withdraw the consent at any time with effect for the future.

Where processing is based on our legitimate interest, you can object at any time for reasons arising from your particular situation (Art. 21 GDPR).

Much of this you can do yourself in the account settings of the Services. For everything else, email support@saasflow.com; we answer as soon as possible after verifying your identity. In some cases we may be limited in what we can disclose, for example where a request would reveal information about another person.

You also have the right to complain to a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen; you can also contact the authority of your own EU member state.

Minors

The Websites and Services are not directed at individuals under 16, and we do not knowingly collect their data. If you become aware that someone under 16 has provided us with personal data, please contact us and we will delete it.

Changes to this policy

If we materially change this policy, we will announce it on our website at least 30 days before the change takes effect.

Contact