Security
This page is the concrete, technical version of how we protect your data. The plain-language version is on our Trust page, and the formal legal version is in our Privacy Policy. We are early and we say so plainly: where something is on our roadmap rather than live, it is marked Coming.
Who operates the Service
VESTELON FLOW is operated by Harbor Equity a.s. (IČO 21989249), Dlouhá 730/35, 110 00 Prague, Czech Republic, EU. Harbor Equity a.s. is the GDPR data controller. Security questions: hello@vestelonflow.com.
The smallest possible data
To find your money leaks, FLOW needs only the transaction lines from your statement: the date, the amount and the description. It does not need your online-banking login, your card PIN or your full identity, and never asks for them. You can black out your name, account number and address before uploading; FLOW still works on a redacted statement.
Encryption and data residency
- Your file is encrypted in transit (TLS) and at rest.
- It is processed and stored inside the European Union.
- It is used only to build your report.
- It is never used to train third-party AI models.
- We never sell or share your financial data, for marketing or anything else.
Who can see your data
Access to uploaded statements is restricted to the minimum needed to run and support the Service, on a need-to-know basis, and is logged. We do not browse your transactions for any purpose other than generating and supporting your report.
How long we keep it, and deletion
We keep your uploaded statement and your report only until you delete them, and you can delete them at any time, including before you pay. Coming: an automatic deletion default, so files are removed after a set period even if you do nothing, and an option to have a statement analysed without it being stored at all.
Sub-processors
We use a small number of trusted providers. Each acts under a data-processing agreement and EU-adequate safeguards.
- Hosting / infrastructure — serves the site and processes data within the EU.
- Stripe — payment processing. We do not store your full card number.
- Resend — transactional and contact email.
- Anthropic — powers the on-site AI assistant. Your bank statement is not sent to it; the assistant answers questions about FLOW.
We update this list when it changes. For the current legal detail, see the Privacy Policy.
No bank login, on purpose
You share a file, never your passwords, so FLOW works with any bank today without a credential you have to trust us with. Coming: an optional, secure direct bank connection through regulated partners, never a requirement.
Your rights
You can access, correct, erase, restrict or object to processing, and request portability of your data, and complain to your supervisory authority (in the Czech Republic: ÚOOÚ, uoou.gov.cz). To exercise any right, email hello@vestelonflow.com.