Privacy Policy
Effective October 24, 2026
This Privacy Policy explains how FinFlow AI ("FinFlow AI," "we," "us") collects, uses, and protects information when you use the FinFlow website at finflowai.co, the FinFlow application at app.finflowai.co, and the emails we send (together, the "Services").
FinFlow is used by organizations — businesses, nonprofits, churches, and community groups — to manage their finances. When an organization uses FinFlow, the financial information it puts into the app belongs to that organization. We process it on the organization's behalf and according to its instructions.
1. Information we collect
Information you give us on the website
When you ask for a walkthrough, we collect your name, your organization's name, your email address, and what you currently use to manage your finances.
The live demo at finflowai.co/demo uses made-up sample data. It runs entirely in your browser and does not collect or send anything you enter.
Account information
When you are invited to FinFlow, we store your name, email address, the organization(s) you belong to, and your role. You sign in with Google or with a one-time link sent to your email. If you sign in with Google, we receive your name, email address, and profile picture from Google and use them only to sign you in and identify you within your organization.
Financial information your organization puts into FinFlow
This can include expense and purchase requests, receipts and invoices, approvals, budgets, vendor and payee details, bank and card transactions, donation and donor records, payroll records, journal entries, reports, and attached documents.
Information from connected services
If your organization chooses to connect other services, we receive information from them:
- Bank accounts (through Plaid): account names, balances, and transactions. You sign in to your bank through Plaid; we never receive or store your bank username or password.
- Stripe: payment, payout, and fee information for your organization's Stripe account.
- Accounting and church-management software (such as QuickBooks or Breeze): the records needed for the sync or export you set up.
- Gmail: if an administrator connects an organization mailbox, we read the payment notification emails described in section 5.
Information collected automatically
Like most online services, our hosting provider records technical information such as IP address, browser type, and the pages requested, which we use to keep the Services running and secure. The app uses browser storage that is needed to keep you signed in. We do not use advertising cookies or third-party advertising trackers.
2. How we use information
- To provide the Services: routing requests for approval, tracking budgets, matching transactions, keeping books, and producing reports.
- To run FinFlow's AI features, such as reading receipts and suggesting categories (see section 3).
- To send emails you need, such as approval requests, reminders, and account notices.
- To respond to walkthrough requests and support questions.
- To keep the Services secure, prevent fraud and misuse, and fix problems.
- To comply with the law.
We do not sell personal information, and we do not share it for advertising.
3. AI features
Some FinFlow features use artificial intelligence. To provide them, relevant content — for example, the text and images of a receipt — is sent to our AI provider, Anthropic, which processes it on our behalf. Under its commercial terms, Anthropic does not use this content to train its models. AI suggestions can be wrong, so FinFlow keeps a person in charge of approving and posting financial entries.
4. How we share information
We share information only as described here:
- Within your organization, according to the roles and permissions your organization's administrators set.
- With service providers who help us run FinFlow and may only use the information to provide their services to us. These include Google Cloud and Firebase (hosting, sign-in, database, and file storage), Anthropic (AI processing), Plaid (bank connections), Stripe, and our email provider.
- With services your organization connects, such as QuickBooks, when you ask us to send data to them.
- For legal reasons, when we believe in good faith it is required by law, or needed to protect the rights, property, or safety of our users, the public, or FinFlow AI.
- In a business transfer, such as a merger or acquisition, in which case this Policy will continue to apply to the information transferred.
5. Google user data and Gmail
Connecting Gmail is optional. It happens only when an organization's administrator connects a mailbox and approves access on Google's own consent screen. A connected mailbox can be used in two ways:
- Importing payments: FinFlow searches the mailbox only for payment notification emails, such as Zelle and Cash App receipts, reads the payment details in them (payer, amount, date, and memo), and records those payments in your organization's books. It marks those emails as processed with a label so they are not imported twice. FinFlow does not read, store, or change other emails.
- Sending email: FinFlow sends messages your organization asks it to send, such as donor acknowledgements and receipts, from the connected address. A mailbox connected only for sending is never read.
We store the access tokens Google issues so these features keep working; we never receive your Google password. Gmail data is used only to provide these features to your organization. It is not used for advertising, it is not sold, it is not used to train AI models, and people at FinFlow AI do not read it except with your permission, for security purposes, or as required by law. An administrator can disconnect the mailbox in FinFlow at any time, and anyone can remove FinFlow's access from their Google Account settings.
FinFlow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
6. How long we keep information
We keep organization data for as long as the organization has a FinFlow account. When an account is closed, the organization has 30 days to export its data, after which we delete it, unless the law requires us to keep it longer. Deleted data may remain in encrypted backups for a short time until those backups expire. Financial records are often subject to retention requirements, so organizations should export what they need before closing an account. Walkthrough requests are kept until we no longer need them to follow up.
7. Security
We protect information with industry-standard safeguards, including encryption in transit and at rest, role-based access within each organization, and passwordless sign-in. No system is perfectly secure, but we work to protect your information and will notify affected users of a breach as required by law.
8. Your choices and rights
You can ask to see, correct, export, or delete your personal information by emailing hello@finflowai.co. If your information is part of an organization's FinFlow account, we may refer your request to that organization's administrator, who controls that data. Depending on where you live, you may have additional rights under the law, and we will honor them. We will not treat you differently for exercising your rights.
9. Children
FinFlow is a business tool and is not intended for children under 13. We do not knowingly collect personal information from children under 13.
10. Changes to this Policy
We may update this Policy from time to time. We will post the new version here with a new effective date, and notify account holders of significant changes.
11. Contact us
Questions about this Policy or your information? Email us at hello@finflowai.co.