Privacy Policy
1. Who we are
VESTELON and VESTELON FLOW are operated by Harbor Equity a.s. (“we”), a company registered in the Czech commercial register under IČO 21989249, with its registered seat at Dlouhá 730/35, 110 00 Prague, Czech Republic. Harbor Equity a.s. is the data controller. For any privacy matter, contact us at hello@vestelon.com (or hello@vestelonflow.com for FLOW).
2. What data we collect
When you submit the contact form we process the data you provide: name, email address, company (optional), the audience category you select and the content of your message. We do not use advertising trackers and we do not resell data.
3. Purpose and legal basis
We process this data solely to respond to your inquiry and to follow up on it. The legal basis is your consent (Art. 6(1)(a) GDPR), given by ticking the consent box before sending the form. You may withdraw consent at any time.
4. Retention
Messages are kept for a maximum of 12 months after the conversation ends, then deleted, unless a longer period is required by law.
5. Recipients and transfers
Form submissions are delivered through our email processor (Resend, acting as a data processor). The AI assistant uses Anthropic as a processor (see section 6). Web fonts are self-hosted from our own servers, so loading them sends no data to Google or any other third party. The only exception is the Chinese and Arabic language pages, whose script-specific fonts are loaded from Google Fonts; on those pages your browser contacts Google servers and your IP address is transmitted to them when those fonts load, and no cookies are set for this. Only if you accept analytics in the cookie banner do we use Google Analytics (Google acting as a processor) to measure aggregate traffic; it sets analytics cookies and we enable IP anonymisation. You can decline, and withdraw consent at any time by clearing this site’s storage in your browser. We use no advertising trackers. Data is stored within the European Union where possible. We never sell or share your data for marketing purposes.
6. AI assistant
The optional chat assistant sends the messages you submit to Anthropic in the USA to answer your questions. Please do not enter sensitive personal or financial information. Our interest log retains only the date, language and topic category, not your message content or IP address. If you want follow-up, enter your email and tick the explicit follow-up consent checkbox. Only the consented email address is sent to the team through Resend, not the chat history. A successful submission is confirmed separately. The legal basis for improving the service is legitimate interest (Art. 6(1)(f) GDPR), and for requested follow-up your consent (Art. 6(1)(a)), which you may withdraw.
7. FLOW: bank statements and your report
A bank statement contains sensitive information. Before uploading, understand which processing method you are choosing. In this process, you upload an export from your bank. You do not need to connect your bank or provide banking credentials. You may cover your name and account number. Keep dates, amounts and merchants visible for analysis. CSV, OFX/QFX, MT940 and CAMT.053 are read in your browser. Parsed data may be stored temporarily in that browser so you can continue after signing in. Saving financial data to your account is a separate step. Compatibility depends on the file structure. Optional AI reading of PDFs or photos, and chat, use Anthropic in the USA. You confirm use in the application. Data is then processed outside your device, not exclusively in the EU. See the privacy policy for scope and terms. In settings, you can clear imported financial data or delete your account after password verification. Clearing data preserves settings and learned categories. Some audit and anonymized records are retained under the privacy policy. This does not mean every record is deleted immediately. If you create a FLOW account, we process the name and email you provide to operate your account and deliver your reports; the legal basis is the performance of our contract (Art. 6(1)(b) GDPR) and, for optional lifecycle emails, your consent (Art. 6(1)(a)), which you can withdraw at any time. For FLOW privacy matters contact hello@vestelonflow.com.
8. Your rights
Under the GDPR you have the right to access, rectify and erase your data, the right to restrict or object to processing, the right to data portability and the right to lodge a complaint with your supervisory authority (in the Czech Republic: ÚOOÚ, uoou.gov.cz).
9. Contact
To exercise any right, email hello@vestelon.com.