Privacy Policy

01Who we are

Flowsight AI is made by FD Labs (“we”, “us”). We decide how the personal data described here is used, which makes us its controller under Indonesia’s Personal Data Protection Law (Law No. 27 of 2022). You can reach us about anything in this policy at support@flowsightai.tech.

02What we collect

When you create an account

• Your name and email address.
• Your password, stored only in a one-way scrambled form (a hash), so no one — including us — can read it.
• When you created your account, and when you agreed to our Terms and this policy.
• Your storage choice: device only, or saved to Flowsight.

When you sign in

• A record of each sign-in attempt: the email address entered, whether it worked, and when. We keep the most recent 1,000 attempts across all users to spot misuse. We don’t store your internet address or device details with them.
• Your internet address is held briefly in memory to limit repeated sign-in attempts. It is never written to our records.

If you join the waitlist

• Your email address and when you joined, used only to tell you when Flowsight AI opens.

What we never collect

• Your statement PDFs.
• Your internet-banking login or any other bank credentials.
• The passwords that unlock your PDF statements.

03How your statements are handled

When you import a statement, it is opened and read inside your browser. The PDF file itself is never uploaded, whichever storage option you choose. Only two kinds of statement information ever reach our servers:

• Merchant names, for automatic categorisation. Before a name leaves your browser, we remove digits, account numbers and your own name. Amounts, dates and account numbers are never sent this way. The categories we work out are kept in a shared list of merchant names so the same shop isn’t looked up twice; that list isn’t linked to you.
• An anonymised summary, for AI takeaways. Category totals, income and spending figures, and ratios — no merchant names, account numbers or descriptions. We don’t keep it once your takeaways are generated.

Where your transactions live

After import, you choose where your transactions — the dates, descriptions, amounts and categories read from your statement — are kept:

• Stays on this device. Transactions are saved in your browser only and nothing more is sent to us. Clearing your browser data deletes them, and they won’t appear on your other devices.
• Saved to Flowsight. Your transactions (never the PDF) are stored on our servers, encrypted with AES-256 under a key unique to your account, so you can reach them from any device you sign in on. This is not end-to-end encryption: our systems can decrypt your data, which is what lets you reset a forgotten password without losing it. We don’t look at your saved transactions unless you ask us to help with a problem or the law requires it.

You can switch from “Saved to Flowsight” back to “Stays on this device” at any time. When you do, the copy on our servers is permanently deleted.

04Who else handles data

We use a small number of service providers to run Flowsight AI. They handle data only on our behalf, to provide their service:

• Anthropic provides the Claude AI models behind categorisation and takeaways. It receives only the anonymised merchant names and summaries described above.
• Our hosting provider runs our servers and stores the account and saved-transaction data described here.
• Google Fonts and Cloudflare (cdnjs) deliver the typefaces and the PDF-reading software our pages load. Like any website your browser contacts, they receive your internet address and basic browser details — nothing from your statements.

Some of these providers operate outside Indonesia, so data may be processed abroad. By using Flowsight AI you consent to that transfer, and we choose providers that protect data to standards comparable to Indonesian law.

We don’t sell or rent personal data, we don’t show ads, and we don’t use analytics or advertising trackers. We disclose information to authorities only when Indonesian law requires it.

05Storage in your browser

Flowsight AI doesn’t use cookies. It uses your browser’s own storage for:

• Keeping you signed in — a sign-in token that expires after 30 days, or when you close the tab if you untick “Keep me signed in”.
• Your transactions, categories and settings, if you chose “Stays on this device”.
• PDF passwords that worked before, so locked statements open automatically next time. These never leave your browser.

Signing out removes the sign-in token. Clearing your browser’s data for our site removes everything else.

06How long we keep it

07Your rights

Under Indonesian law, you can ask us to:

• show you the personal data we hold about you, and give you a copy;
• correct anything that’s inaccurate;
• delete your account and your data;
• stop or limit how we use your data, or withdraw your consent — which may mean closing your account.

Email support@flowsightai.tech from the address on your account. We’ll respond promptly and within the time limits the law sets. Closing your account deletes your account details and any transactions saved to Flowsight; transactions kept on your device stay there until you clear them.

08Security

Passwords are stored as one-way hashes, saved transactions are encrypted where they’re stored, and connections to our site are encrypted with HTTPS. We limit repeated sign-in attempts, and our servers never receive your PDFs in the first place.

No system is perfectly secure. If a breach affects your personal data, we’ll notify you and the authorities as Indonesian law requires.

09Age limit

Flowsight AI is for people aged 18 and over. We don’t knowingly collect data from anyone younger. If you believe someone under 18 has created an account, tell us and we’ll delete it.

10Changes to this policy

If we change this policy in a way that matters, we’ll update the date at the top and tell you by email or in the app before the change takes effect.