Privacy statement

1.Who is responsible

FundFlow (Chamber of Commerce 42079131, Menno van Coehoornsingel 21, 2967EC Langerak, the Netherlands) is the controller for the personal data of our own users: the people who sign in to FundFlow. For the participant data you enter about your investors, you are the controller and we are the processor: we handle it on your instructions, to run the service for you. Reach us at support@fund-flow.nl.

2.What we process about our users

The name, email address and password credential you provide at signup; your organisation and fund names; and technical records generated by using the service, such as sign-in events and application logs. We use this to give you an account, to keep it secure, and to answer you when you contact us.

3.What you process about your participants

You enter participant names, contact details, addresses, tax identifiers, bank account details and the financial positions those people hold in your fund. We store and process this for you so the service can do its job. We do not use it for anything else, we do not sell it, and we do not use it to train models.

4.Why we are allowed to

For our users: performance of the contract with you, and our legitimate interest in operating and securing the service. For participant data: we act on your instructions as processor, and your own legal basis governs the underlying processing. Where we send you email about the service itself, that is contract performance rather than marketing.

5.Who else is involved

Three services process data to make FundFlow work. Supabase holds the database and the authentication behind sign-in. Cloudflare serves the application. Resend delivers the emails and statements you send. Each acts on our instructions. We will name any new processor here before it starts.

A fourth applies only to the public pages and only with your consent: Google Analytics, loaded through Cloudflare Zaraz, measures how those pages are used. Nothing is loaded before you accept it in the consent banner, advertising features are switched off, IP addresses are shortened by Google before storage, and no data about the funds you administer is ever sent to it. See the cookie statement for what is and is not measured.

6.Where data is held

The hosting region for the database is set per deployment, and application delivery is via Cloudflare’s network. If your fund needs a specific storage region committed in writing, ask us before you sign up and we will confirm what applies to your account rather than making a general claim on this page.

7.How long we keep it

Account and fund data for as long as your account is open, and then for as long as we must to meet legal retention duties: including the seven-year retention Dutch tax law imposes on administrative records. You can ask us to delete data sooner and we will, unless a legal duty requires us to keep it.

8.Your rights

You may ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing or ask for it in a portable form. Write to support@fund-flow.nl and we will answer within one month. If we cannot resolve something, you can complain to the Autoriteit Persoonsgegevens, the Dutch data protection authority.

9.Security

Access to fund data is enforced by row-level security in the database, scoped to your organisation’s membership. Roles are enforced below the interface. Financial periods you lock are immutable, and every business table carries an audit trigger. The security page describes this in more detail, including what we do not claim.

10.Changes

If we change this statement materially we will tell you by email or in the application before the change takes effect.