Privacy notice · effective 20 September 2026. This notice covers the Claim Flow AI website and workspace.
Responsibility for your data
The legal operator identified below is responsible for account administration, personal workspace services and platform security. Your company determines the purposes of its employee-claim records and who may review them; Claim Flow AI hosts those records to provide the company workspace. Contact your company about its employment or accounting retention obligations, or contact us for help routing a request.
What we use and why
- Account and workspace: sign-in identifiers, email, profile details, preferences, receipts, extracted expense details, mileage and reports provide the service you request (performance of our contract).
- Company claims: membership, submissions, evidence and review decisions provide the requested company service. Your company is responsible for the legal basis for its employee processing.
- Optional AI and location: receipt images or PDFs, visible information and an attached scan location are sent for reading only after you allow the reading attempt. You can decline and enter details manually. Optional location and public analytics use consent.
- Security and delivery: request metadata, usage counters, delivery records and deletion markers help prevent abuse, enforce allowances and complete requested actions (legitimate interests in a secure, reliable service).
- Support and legal obligations: correspondence helps us respond to requests and meet applicable obligations. We use contract, legitimate interests or legal obligation as appropriate to the request.
Where records are stored
Working records are saved on your device first. Connecting a verified account syncs report and receipt details and supported original receipt files to that account. Original files are stored privately by Cloudflare and are available when you authenticate to the same Claim Flow AI account on another device. Supported formats are JPG, PNG, WebP, HEIC, HEIF and PDF, up to 2 MB per file. A file is available elsewhere only after its upload finishes; older or unsynced originals may still need to be restored from the capture device. Company submission creates a separate report and receipt copy for authorised company reviewers. Signing out can leave a separate local account cache; use account deletion or clear device storage when appropriate.
Providers and sharing
Google Firebase provides authentication and account storage. Cloudflare hosts the website, APIs, company database and receipt files. OpenAI reads permitted receipt inputs; Google Gemini may provide fallback reading. Resend processes messages and selected attachments when you choose direct email delivery. It also delivers company invitations, review updates and support notifications where those delivery features are enabled. Where branded account email is enabled, Resend also delivers requested verification and password-reset messages with secure Firebase action links; otherwise Firebase sends those messages. Opening the mileage map requests map tiles from OpenStreetMap, which receives request metadata including your IP address and the map area. Searching an address or calculating a driving route sends the selected address or coordinates through our server to HeiGIT openrouteservice. This feature does not continuously track your location; you choose the points and review the suggested route. See HeiGIT privacy information and OpenStreetMap privacy information. Where company billing is enabled, Stripe processes checkout, payment methods and invoices. Claim Flow AI sends the company account reference, billing email and billable member count; we store Stripe customer and subscription identifiers, subscription status and billing-change records. Card details are entered on Stripe-hosted pages, not stored by Claim Flow AI. Sandbox billing uses test data and does not charge real payments. See Stripe privacy information. Apple or Google process sign-in when you use their sign-in options. Support email is forwarded through Cloudflare to the operator’s Apple mailbox. Recipients you select and authorised company reviewers receive the records you send them.
OpenAI API requests use storage disabled; default abuse-monitoring logs may retain inputs and outputs for up to 30 days, or longer where legally required. API data is not used for training by default. See OpenAI data controls. Google’s EEA data-use terms do not use Gemini prompts and responses to improve products, but permit limited security logging and international processing; see Gemini terms. Claim Flow AI does not promise zero retention by providers.
Optional Google Analytics and Microsoft Clarity measure public-page visits and interactions after permission. They are not loaded on personal, company or admin workspace pages. Browser and usage identifiers can be personal data; these tools are not described as anonymous. See cookie and analytics choices.
Optional mobile notifications
Where device alerts are enabled for your release, you can choose to receive them in the mobile app. Google Firebase Cloud Messaging and, on iOS, Apple Push Notification service process a device messaging token to deliver alerts. We associate that token with your signed-in account. Lock-screen alerts contain a general update message, not receipt details, company questions or support correspondence. You can disable device alerts in the app or revoke notification permission in device settings. Signing out or deleting your account removes its device registration; registrations not refreshed for 30 days are pruned. In-app notifications and service email work separately from device alerts.
International processing
Service providers may process data outside Latvia and the EEA, including in the United States and other locations where they operate. Applicable provider data-processing terms include transfer safeguards such as Standard Contractual Clauses: Firebase, Cloudflare, OpenAI, Google and Resend. Contact us for information about applicable safeguards.
Retention and deletion
Personal claim records are kept until you remove them or delete your account. Company-submitted reports and receipt copies remain until the company profile is deleted, including when the claimant deletes their personal profile. Independent personal accounts survive company closure. A company must keep any independently required accounting records before closing its workspace.
Minimal identifiers and deletion timestamps remain while needed to prevent deleted accounts or companies being restored by stale clients and to authorise cleanup retries. They do not contain report content or receipt bytes. Security, service-provider logs and support correspondence have separate operational or legal purposes and are not all erased by a profile action. We assess retention by the need to investigate incidents, complete requests and meet applicable legal obligations; you may request review of retained personal information. Downloaded or externally delivered copies remain under their recipients’ control.
Your rights and choices
Contact developer@claim-flow.app to request access, correction, deletion, restriction, portability or to object where those rights apply. You can withdraw optional consent without affecting prior lawful processing: decline later AI attempts, revoke location permission in your device, and change analytics choices. You can delete your account through the website. We may need to verify identity and normally respond to rights requests within one month, with any lawful extension explained.
You may complain to Latvia’s Data State Inspectorate or your local supervisory authority. AI suggestions support review; Claim Flow AI does not itself make a solely automated reimbursement decision with legal effect. Your company makes the claim decision.