Privacy Policy

1. Introduction

Welcome to 2DECFlows, an AI-powered invoice management platform for UK-based businesses and freelancers. We help you create, send, and track invoices, manage client payment reminders, and get paid faster.

This Privacy Policy explains how 2DECFlows ("we", "us", "our") collects, uses, stores, and protects your personal information when you use our platform. By using 2DECFlows, you agree to the practices described in this policy. We are committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

We collect information necessary to provide the 2DECFlows service:

Account Information

• Full name and email address (used for login and communications)
• Profile information you choose to provide
• Account role (admin or user)

Business Information

• Business name, registered address, and contact phone number
• Bank details including account name, bank name, sort code, account number, and IBAN
• Payment links (e.g. PayPal, Stripe, GoCardless URLs)
• Company logo and branding preferences

Invoice Data

• Invoice numbers, issue dates, due dates, amounts, VAT details
• Line item descriptions, quantities, and unit prices
• Invoice status, payment links, and PDF copies
• Recurring invoice configurations

Client Data

• Client names and email addresses you add to the Clients section
• Client phone numbers, company names, and billing addresses
• Notes and payment risk assessments you record

Payment Records

• Payment amounts, dates, and methods (bank transfer, card, cash, etc.)
• Payment references and notes
• Stripe payment transaction identifiers (we do not store full card numbers)

Usage Data

• Pages visited, features used, and actions taken within the app
• Browser type, device information, and IP address
• Error logs and performance data to help us improve the service

3. How We Use Your Information

We use your information for the following purposes:

• Provide the service: Create and manage invoices, clients, and payments on your behalf
• Process payments: Facilitate Stripe-powered payments via the Client Portal
• Send reminders: Automatically email payment reminders to your clients on your behalf
• Generate reports: Produce cash flow forecasts, overdue summaries, and financial reports
• AI invoice scanning: Process uploaded invoice images to extract data automatically
• Customer support: Respond to your enquiries and resolve issues
• Product improvements: Analyse usage patterns to improve features and user experience
• Legal compliance: Meet our obligations under UK law including HMRC tax record-keeping requirements
• Security: Detect and prevent fraud, abuse, or unauthorised access

4. Data Storage and Security

We take the security of your data seriously:

• Encryption in transit: All data is transmitted over HTTPS/TLS
• Encryption at rest: Sensitive data including bank account details (sort code, account number, IBAN) are stored encrypted at rest in our database
• Secure authentication: Access is protected by secure session tokens and authenticated login
• Tenant isolation: Each business account is fully isolated — no business can access another business's data
• Access controls: Data access is role-restricted; only authorised users within your business can view your records
• Regular audits: We periodically review our security practices and infrastructure

While we implement industry-standard security measures, no system is 100% immune to risk. We will notify you promptly in the event of a data breach affecting your personal data.

5. Third-Party Services

We use carefully selected third-party providers to deliver parts of the 2DECFlows service:

Stripe — Payment Processing

When your clients pay invoices online, payments are processed by Stripe. Stripe may receive client name, email, and payment amount. We do not store full card numbers. See stripe.com/privacy for details.

AI Scanning — Invoice Processing

Our invoice scanning feature uses AI services to extract data from uploaded invoice images (PDFs, JPGs, PNGs). Uploaded files are processed to extract invoice fields only and are not retained by AI providers beyond the processing request.

Resend — Email Delivery

Invoices and payment reminders are delivered to your clients via Resend, an email delivery platform. Resend processes recipient email addresses and email content on our behalf as a data processor.

6. Infrastructure Providers

2DECFlows is built on the Base44 platform, which provides our underlying cloud infrastructure, database, authentication, and file storage. Your data is stored and processed on Base44's infrastructure. See base44.com/privacy for their data practices.

We ensure that all infrastructure providers we use are bound by appropriate data processing agreements and handle your data in accordance with UK GDPR.

7. Client Portal

2DECFlows includes a Client Portal — a public-facing page where your clients can view and pay their invoices. When a client accesses the portal:

• They look up invoices using their email address
• They can only see invoices that are addressed to that email address
• Limited invoice data is shared (invoice number, amount, due date, and payment information)
• They can download invoice PDFs and initiate Stripe payments

You, as the account holder, are responsible for ensuring your clients are aware that their contact data (name, email, address) is stored in 2DECFlows when you add them as clients.

8. Your Rights Under UK GDPR

As a UK data subject, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Correct inaccurate or incomplete data — you can update most of this directly in Settings
• Right to erasure: Request deletion of your account and personal data (see Account Deletion section below)
• Right to data portability: Export your invoices and client data using the CSV export features in the app
• Right to restrict processing: Request that we limit how we use your data in certain circumstances
• Right to object: Object to processing of your personal data for certain purposes
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

9. Account Deletion

You can delete your account and all associated data at any time:

In-App Deletion

1. Go to Settings in the sidebar
2. Scroll to the Danger Zone section
3. Click Delete Account
4. Type DELETE in the confirmation box to confirm
5. Your account and all data will be permanently removed

By Email

You can also request deletion by emailing [email protected] from your registered account email.

10. Data Retention

We retain your data for as long as necessary to provide the service and meet our legal obligations:

• Invoice and payment records: Retained for 6 years from the date of the invoice to comply with HMRC requirements under UK tax law (Finance Act 1998 and related legislation)
• Account and business data: Deleted upon account deletion
• Client data: Deleted upon account deletion, unless linked to invoices subject to the 6-year retention rule
• Usage and analytics data: Aggregated and anonymised after 12 months
• Support communications: Retained for 2 years

11. Cookies

2DECFlows uses essential cookies and session tokens to keep you logged in and maintain your session securely. We do not use advertising cookies or third-party tracking cookies.

• Session cookies: Required for authentication and to keep you logged in
• Preference cookies: Remember your app settings and preferences

These cookies are strictly necessary for the service to function. You can clear cookies via your browser settings, though this will log you out of the platform.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify you via email or an in-app notification for significant changes

Continued use of 2DECFlows after changes are posted constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: