1. Who We Are
Flow is operated by SJ Finance Services Ltd, registered in England and Wales. We provide a service that syncs your Xero accounting data to Microsoft Excel via a secure cloud database.
Contact: support@sjfinance.co.uk
2. Data We Collect
When you use Flow, we collect and process the following data:
- Account information: Your email address and name (provided via Xero SSO or registration).
- Xero financial data: Trial balance snapshots, invoices, chart of accounts, and contacts from your connected Xero organisations. This data is read-only — Flow never writes to your Xero account.
- OAuth tokens: Encrypted Xero access and refresh tokens used to maintain your connection.
- Payment information: Billing is handled by Stripe. We store your Stripe customer ID but never store credit card details.
- Usage data: Sync logs, API usage metrics, and login timestamps for service operation and support.
3. How We Use Your Data
We use your data to:
- Provide and maintain the Flow service (syncing Xero data to your Excel template).
- Authenticate your identity via Xero single sign-on.
- Process payments and manage your subscription via Stripe.
- Send transactional emails (password resets, account notifications) via SendGrid.
- Monitor service health and troubleshoot issues.
We do not sell, rent, or share your personal data with third parties for marketing purposes.
4. Legal Basis for Processing (UK GDPR)
We process your data under the following legal bases:
- Contract: Processing necessary to provide the Flow service you have signed up for.
- Legitimate interest: Service monitoring, security, and fraud prevention.
- Consent: Where required, such as for optional communications.
5. Third-Party Services
We use the following third-party services to operate Flow:
- Xero: OAuth authentication and accounting data API. Governed by Xero's Terms of Use.
- Microsoft Azure: Cloud hosting (UK regions), database storage, and encryption key management.
- Stripe: Payment processing. Governed by Stripe's Privacy Policy.
- SendGrid: Transactional email delivery.
- Google Ads: Advertising conversion measurement, only with your consent (see Cookies below). Governed by Google's Privacy Policy.
6. Data Storage and Security
- Your data is stored in Azure SQL Database hosted in UK data centres.
- All Xero OAuth tokens are encrypted at rest using authenticated encryption (Fernet — AES-128-CBC with HMAC-SHA256), with keys stored separately in Azure Key Vault.
- All data in transit is encrypted via TLS 1.2 or higher.
- Access to production systems is restricted and monitored.
- Database credentials for Excel access are unique per customer and scoped to your data only.
7. Data Retention
- Active accounts: Data is retained for the duration of your subscription.
- After account deletion: All your data (organisations, financial data, credentials) is permanently deleted immediately upon account deletion.
- Audit logs: Retained for up to 1 year for security and compliance purposes.
- Disconnected organisations: When you remove an organisation, all associated financial data is deleted immediately.
8. Your Rights
Under the UK GDPR, you have the right to:
- Access: Request a copy of the personal data we hold about you.
- Rectification: Request correction of inaccurate data.
- Erasure: Delete your account and all associated data at any time from the Dashboard.
- Portability: Your Xero data remains available in your Xero account at all times.
- Object: Object to processing based on legitimate interest.
- Withdraw consent: Disconnect your Xero organisation or delete your account at any time.
To exercise these rights, contact us at support@sjfinance.co.uk.
9. Cookies and Local Storage
Flow uses browser local storage to maintain your authentication session (JWT tokens). Third-party services (Xero OAuth, Stripe checkout) may set their own cookies during authentication and payment flows — these are governed by their respective privacy policies.
Advertising cookies (with your consent only). We use Google Ads conversion tracking to measure how many visitors who arrive from our advertising go on to start a free trial. These cookies are set only if you click "Accept" on our cookie banner. If you decline (or make no choice), no advertising cookies are set and no advertising identifiers are stored — Google may receive only aggregated, cookieless signals that cannot identify you (Google "Consent Mode"). We do not use these cookies to build profiles, and we do not share your account or financial data with Google. You can change your mind at any time by clearing this site's data in your browser, which will show the banner again.
10. Changes to This Policy
We may update this privacy policy from time to time. We will notify you of significant changes by email or through the Flow dashboard. Continued use of the service after changes constitutes acceptance of the updated policy.
11. Contact
If you have questions about this privacy policy or how we handle your data, contact us at support@sjfinance.co.uk.