Security
This page is the concrete, technical version of how we protect your data. The plain-language version is on our Trust page, and the formal legal version is in our Privacy Policy. We are early and we say so plainly: where something is on our roadmap rather than live, it is marked Coming.
Who operates the Service
VESTELON FLOW is operated by Harbor Equity a.s. (IČO 21989249), Dlouhá 730/35, 110 00 Prague, Czech Republic, EU. Harbor Equity a.s. is the GDPR data controller. Security questions: hello@vestelonflow.com.
The smallest possible data
To find your money leaks, FLOW needs only the transaction lines from your statement: the date, the amount and the description. It does not need your online-banking login, your card PIN or your full identity, and never asks for them. You can black out your name, account number and address before uploading; FLOW still works on a redacted statement.
Encryption and data residency
- Your file is encrypted in transit (TLS) and at rest.
- Primary storage is inside the European Union; the optional, consented AI fallback transfers text to Anthropic in the USA.
- It is used only to build your report.
- It is never used to train third-party AI models.
- We never sell or share your financial data, for marketing or anything else.
Who can see your data
Access to uploaded statements is restricted to the minimum needed to run and support the Service, on a need-to-know basis, and is logged. We do not browse your transactions for any purpose other than generating and supporting your report.
How long we keep it, and deletion
We keep your uploaded statement and your report only until you delete them, and you can delete them at any time, including before you pay. Coming: an automatic deletion default, so files are removed after a set period even if you do nothing, and an option to have a statement analysed without it being stored at all.
Sub-processors
We use a small number of trusted providers. Each acts under a data-processing agreement and EU-adequate safeguards.
- Hosting and infrastructure: serves the site and processes data within the EU.
- Stripe: payment processing. We do not store your full card number.
- Salt Edge (open banking, PSD2): powers the optional direct bank connection. You authenticate directly with your bank; we never receive your banking credentials, only the account and transaction data you authorise.
- Resend: transactional and contact email.
- Anthropic (USA): our contracted AI processor for the optional PDF or unrecognized-content fallback and for AI assistant questions. CSV, OFX/QFX, MT940 and CAMT.053 are parsed locally in your browser. Text is sent to Anthropic only when the fallback is needed and you explicitly consent; it is not used to train public models.
We update this list when it changes. For the current legal detail, see the Privacy Policy.
No bank login, on purpose
You share a file, never your passwords. FLOW deterministically supports CSV, OFX/QFX, MT940 and CAMT.053; PDF support depends on the export and may use AI only with your consent. Optional: a secure direct bank connection through our regulated open-banking (PSD2) provider Salt Edge, where you authenticate directly with your bank, never a requirement.
Your rights
You can access, correct, erase, restrict or object to processing, request portability of your data, and complain to your supervisory authority (in the Czech Republic: ÚOOÚ, uoou.gov.cz). To exercise any right, email hello@vestelonflow.com.