Privacy Policy

This Privacy Policy explains how Flowstart Kft., company registration number 01 09 429426, registered office at 1141 Budapest, Szugló utca 161. 1/2., Hungary (Flowstart, we, us, or our), processes personal data in connection with PapersIn (the Service).

The Service is designed for accounting and bookkeeping practices. In most cases, a customer organisation determines why and how personal data in its client documents is used, and Flowstart processes that data on the customer’s behalf. In that role, the customer is the controller and Flowstart is the processor. For account administration, billing, security, customer support, and our own business operations, Flowstart is the controller.

1. Scope

This Policy applies to personal data processed when you visit PapersIn, create or administer an account, use the Service, contact us, receive our communications, or appear in Customer Data submitted to the Service.

It does not apply to third-party services that have their own privacy notices, including payment processors and other subprocessors. We encourage you to review their terms and privacy information.

2. Personal data we process

Depending on how you interact with the Service, we may process:

• Account and organisation data: name, work email address, password hash, organisation name, role, account settings, and authentication records.
• Client and contact data: names, email addresses, and other contact information entered by a customer to request or manage documents.
• Document and workflow data: files, attachments, document metadata, upload history, classification results, reminder status, and related records submitted by or for a customer.
• Technical and security data: IP address, browser and device information, event logs, timestamps, session data, error reports, recordings of a sample of browsing sessions made by our error-monitoring subprocessor, and records needed to prevent fraud, investigate incidents, and maintain the Service.
• Support communications: messages, attachments, and other information you provide when contacting us. PapersIn also shows a feedback form on its pages, including public ones. What you submit through that form — the message, any name and email address you enter, and a screenshot of the page if you choose to attach one — is delivered to our error-monitoring subprocessor rather than to our own systems, and we read it there.
• Billing and transaction data: subscription status, invoices, payment identifiers, and tax-related records. Payment-card data is processed by our payment processor and is not stored by PapersIn.

Customer documents may contain financial, contact, or other personal information. Customers are responsible for ensuring that they have an appropriate lawful basis and have provided any required privacy notices before submitting that information to the Service.

3. Why we process personal data

When Flowstart acts as controller, we process personal data as necessary to:

• provide, operate, secure, support, and improve the Service;
• authenticate users and maintain account security;
• administer subscriptions, invoices, payments, and customer relationships;
• communicate about the Service, security, support, and material changes;
• comply with legal obligations, enforce our Terms, and protect our rights, users, and systems.

Our legal bases under the GDPR are, as applicable: performance of a contract; our legitimate interests in operating, securing, and improving the Service; compliance with legal obligations; and consent where we request it. Consent is the basis for session replay recordings described in our Cookie Policy: a recording is only made after you allow it on the consent bar, and you may withdraw that consent at any time, without affecting the lawfulness of processing before withdrawal.

We do not currently send marketing or newsletter communications. The emails the Service sends are operational: registration, password management, invitations, reminders, billing, and security notices. If we introduce marketing communications, we will ask for your consent where consent is required by law, every such message will carry an unsubscribe link, and you may withdraw consent at any time free of charge without affecting the lawfulness of processing before withdrawal.

When Flowstart acts as processor, we process Customer Data only on the documented instructions of the relevant customer, as required to provide the Service, or as required by applicable law.

4. Automated classification and AI-assisted processing

PapersIn may use automated rules and, where enabled, third-party AI services to classify documents and assist with workflow. These processes generate operational suggestions and metadata; they do not make decisions producing legal or similarly significant effects about individuals.

Flowstart does not use Customer Data to train its own general-purpose AI models. Where a customer enables or uses an AI-assisted feature, the relevant document content may be transmitted to the applicable subprocessor solely to provide that feature, subject to the safeguards and contractual terms applicable to that subprocessor.

5. How we share personal data

We do not sell personal data. We disclose personal data only where necessary for the purposes above, including to:

• authorised users within the relevant customer organisation;
• the subprocessors named below, each acting on our behalf and under a written processing agreement;
• professional advisers, auditors, insurers, and authorities where required or permitted by law;
• a successor organisation in connection with a merger, financing, acquisition, restructuring, or sale of assets, subject to appropriate confidentiality protections; and
• other parties with your direction or consent.

The subprocessors are:

We require subprocessors to protect personal data appropriately and to process it only for authorised purposes.

6. International transfers

Flowstart is established in Hungary. The Service is hosted by Vercel Inc. (USA). Our subprocessors may process personal data in the European Economic Area, the United States, and other countries where they operate. Where personal data is transferred outside the EEA, we use an appropriate transfer mechanism required by applicable law, such as an adequacy decision, the European Commission’s Standard Contractual Clauses, or another valid safeguard.

7. Retention

We retain personal data only for as long as necessary for the purposes described in this Policy, including legal, accounting, tax, security, and dispute-resolution requirements.

• Account and organisation data: for the duration of the customer relationship. After the account closes, the same schedule as Customer Data applies — deleted or anonymised within a further 30 days after the 30-day export window — except for records that form part of our billing and accounting books, which are kept for the 8 years described below.
• Customer Data: available during the active subscription and, following account closure, available for export for a further 30 days. We then delete or anonymise it within a further 30 days, unless we are legally required to retain it or retention is necessary to establish, exercise, or defend legal claims.
• Backups: deleted or overwritten on a rolling schedule, so data may persist in them for a limited period after deletion from active systems.
• Billing and accounting records: Hungarian accounting law requires the documents supporting the accounting records to be kept for 8 years. We keep them for that period even if the subscription ended earlier.
• Support correspondence: for as long as needed to retrieve the matter and to handle any legal claims arising from it.
• Technical and security logs: for as long as needed to operate the Service securely, detect abuse, and investigate incidents.

8. Security

We apply technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include access controls, organisation-level data separation, encrypted transmission, private storage, and operational monitoring appropriate to the Service.

No method of transmission or storage is completely secure. You are responsible for protecting your account credentials, managing authorised users, and using document-drop links appropriately.

9. Your rights

Subject to applicable law, you may have the right to request access to, correction of, deletion of, restriction of, or portability of personal data that Flowstart controls, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

If you are an individual whose information is contained in Customer Data, please contact the customer organisation that submitted the data first. We will assist our customers with valid requests in accordance with our contractual and legal obligations.

You may submit a request to hello@papersin.com. We may need to verify your identity before responding. You also have the right to lodge a complaint with the Hungarian supervisory authority, the National Authority for Data Protection and Freedom of Information (NAIH), or your local data-protection authority.

10. Cookies and similar technologies

The cookies PapersIn sets are essential ones, necessary to operate the Service, maintain sessions, prevent abuse, and remember security-related preferences. We set no advertising, cross-site tracking, or analytics cookies.

Not everything we store in your browser is essential in that sense. Our error-monitoring subprocessor records a sample of browsing sessions only after you allow it on the consent bar and, while a recording runs, keeps an identifier for it in your browser's session storage. You can change that choice at any time on our Cookie Policy page, which lists every item we set, including that one, says what it is for, and explains how to remove it. Where we use a non-essential cookie or similar technology, we provide the notice and choices required by applicable law before it is set.

11. Children

PapersIn is a business service and is not directed to children. We do not knowingly collect personal data directly from children. If you believe a child has provided personal data to us without appropriate authorisation, contact us and we will take appropriate steps.

12. Changes to this Policy

We may update this Policy from time to time. We will publish the updated version on this page and change the “Last updated” date. If a change is material, we will provide additional notice where required by law.

13. Contact and data-controller details

Flowstart Kft.

• Company registration number: 01 09 429426
• Registered office: 1141 Budapest, Szugló utca 161. 1/2., Hungary
• Privacy and legal enquiries: hello@papersin.com

This Policy is published in English and in Hungarian. Each version is binding in its own right: as between us and a customer, the Hungarian version governs where the customer contracted with us in Hungarian, and the English version governs otherwise.

If you are not the contracting customer — for example, your data appears in Customer Data submitted by a customer, or you are a visitor to our website — the version you were given governs.