1. Introduction
Payflow ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our expense management platform and related services (collectively, the "Service").
By using the Service, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.
2. Information We Collect
2.1 Information you provide directly
When you create an account or use the Service, we collect:
Account information — your name, email address, company name, and password. Profile information — job title, team size, and other details you choose to provide. Payment information — billing details processed securely through our payment provider. Stripe handles all payment processing; Payflow does not store full credit card numbers. Expense data — receipts, transaction amounts, vendor names, dates, categories, and any other financial information you submit through the Service. Communications — messages you send to our support team or through in-app chat.
2.2 Information collected automatically
When you use the Service, we automatically collect:
Usage data — pages visited, features used, actions taken, and time spent in the Service. Device information — browser type, operating system, IP address, and device identifiers. Cookies and tracking technologies — we use cookies, web beacons, and similar technologies to maintain sessions, remember preferences, and understand how the Service is used. Log data — server logs including your IP address, browser type, referring URLs, and the date and time of requests.
2.3 Information from third-party integrations
If you connect third-party services — such as QuickBooks, Xero, Stripe, Plaid, Gmail, or Slack — we may receive information from those services as authorized by you. The information we receive depends on the permissions you grant and the policies of those third parties.
3. How We Use Your Information
We use the information we collect to:
Provide and operate the Service — process expenses, generate reports, manage approvals, and sync data with connected tools. Process payments — handle subscription billing and send payment confirmations. Communicate with you — send account notifications, product updates, security alerts, and support responses. Improve the Service — analyze usage patterns to fix bugs, improve features, and develop new functionality. Personalize your experience — remember preferences and tailor the Service to your usage patterns. Ensure security — detect and prevent fraud, unauthorized access, and other harmful activity. Comply with legal obligations — respond to lawful requests from authorities and meet regulatory requirements.
We do not sell your personal information or expense data to third parties for advertising or marketing purposes.
4. How We Share Your Information
4.1 Service providers We share information with trusted third-party vendors who help us operate the Service, including cloud infrastructure providers, payment processors, analytics tools, and customer support platforms. These providers are contractually obligated to use your information only as directed by Payflow.
4.2 Third-party integrations When you connect a third-party tool such as QuickBooks or Xero, we share the data necessary to enable that integration. You control which integrations are active and can disconnect them at any time.
4.3 Within your organization Expense data, approval statuses, and reports are shared with other members of your Payflow account as determined by the roles and permissions set by your account administrator.
4.4 Legal requirements We may disclose your information if required to do so by law or in response to valid legal process, such as a subpoena, court order, or government request. We will notify you of such requests where legally permitted to do so.
4.5 Business transfers If Payflow is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information is transferred and becomes subject to a different privacy policy.
5. Data Retention
We retain your information for as long as your account is active or as needed to provide the Service. If you cancel your account, we retain your data for a period of 90 days to allow for account recovery. After this period, we will delete or anonymize your data unless we are required to retain it for legal or regulatory purposes.
You may request deletion of your data at any time by contacting privacy@payflow.io. We will process deletion requests within 30 days, subject to any legal retention requirements.
6. Data Security
Payflow implements enterprise-grade security measures to protect your information, including:
256-bit AES encryption for data at rest. TLS 1.3 encryption for data in transit. SOC 2 Type II certification, independently audited annually. Role-based access controls to limit internal access to user data. Regular penetration testing and vulnerability assessments. Multi-factor authentication options for all accounts.
While we take extensive measures to protect your data, no security system is completely impenetrable. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.
7. Cookies and Tracking Technologies
Payflow uses cookies and similar technologies for the following purposes:
Essential cookies — required for the Service to function, including session management and security. Preference cookies — remember your settings and preferences across sessions. Analytics cookies — help us understand how the Service is used so we can improve it. We use privacy-focused analytics tools and do not share analytics data with advertising networks. Marketing cookies — used only on our public marketing website, not within the application, to measure the effectiveness of our campaigns.
You can control cookie settings through your browser. Disabling essential cookies may affect the functionality of the Service.
8. Your Rights and Choices
Depending on your location, you may have the following rights regarding your personal information:
Access — request a copy of the personal information we hold about you. Correction — request that we correct inaccurate or incomplete information. Deletion — request that we delete your personal information, subject to legal retention requirements. Portability — request an export of your data in a machine-readable format. Objection — object to certain types of processing, including direct marketing. Restriction — request that we limit the processing of your data in certain circumstances.
To exercise any of these rights, contact us at privacy@payflow.io. We will respond to all requests within 30 days.
9. GDPR — European Users
If you are located in the European Economic Area, United Kingdom, or Switzerland, the following additional provisions apply.
Legal basis for processing We process your personal data on the following legal bases: performance of a contract (to provide the Service), legitimate interests (to improve the Service and prevent fraud), consent (for optional communications and marketing), and legal obligation (to comply with applicable laws).
Data transfers If we transfer your personal data outside the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.
Data Protection Officer For GDPR-related inquiries, contact our Data Protection Officer at dpo@payflow.io.
10. California Privacy Rights — CCPA
If you are a California resident, you have the right to know what personal information we collect and how it is used, request deletion of your personal information, opt out of the sale of your personal information (Payflow does not sell personal information), and not be discriminated against for exercising your privacy rights.
To submit a California privacy request, contact privacy@payflow.io or write to us at the address below.
11. Children's Privacy
The Service is not directed at children under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child under 16, we will delete it promptly. If you believe we may have collected information from a child, contact us at privacy@payflow.io.
12. Third-Party Links and Services
The Service may contain links to third-party websites or integrate with third-party tools. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you connect to or visit.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or by displaying a notice in the Service at least 14 days before the changes take effect. The "Last updated" date at the top of this page will always reflect the most recent revision.
14. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy, please contact us at: