Skip to content
profflow

Legal document

Privacy policy

What Profflow processes about a company and the people in it, why, where it is kept and who else handles it.

Last updated
25 October 2026
Issued by
Profflow Analytics OÜ
Registry code
17552133
VAT
EE103006985

1Who we are

Profflow is a financial overview for Estonian companies, run by Profflow Analytics OÜ in Tallinn. For your account and for messages you send us, we are the controller. For the financial and payroll data your company brings into Profflow, your company is the controller and we process it on its behalf.

Company
Profflow Analytics OÜ
Registry code
17552133
VAT
EE103006985
Registered address
Paekaare tn 10, Tallinn, Estonia

2What we process

  • Account: your name, email address, the company you belong to and your role in it.
  • Company: registry code, name, address and the other details from the e-Business Register or that you enter.
  • Financial data you connect or import: bank statements and transactions, sales invoices and supplier bills, customers and suppliers, tax figures.
  • Payroll: employees’ names, salaries and the taxes on them, when you add them. This is your employees’ personal data; your company decides to add it and needs a basis to do so.
  • Messages: what you send through the contact form or the access request — company, name, email address and the message.
  • Website use: page views, counted by Vercel Web Analytics without cookies and without identifying you.

3Why

  • To provide the service: to work out cash, taxes, reports and forecasts from your data (contract).
  • To answer requests and to open access (contract, or steps before one).
  • To send the invoice and keep our accounts (legal obligation).
  • To keep the service secure and to find faults (legitimate interest).

4What Profflow does not do

Profflow never moves money, never files returns with the Tax and Customs Board and never sends invoices in your name. We do not sell data and use no advertising trackers.

5Where it is kept and who processes it

  • Supabase — database and sign-in, in the EU (Frankfurt).
  • Vercel — hosting the site and the dashboard, and counting page views.
  • Resend — sending email: replies to requests and sign-in links.
  • Google (Gemini) — when you use Ask AI in the dashboard, your question and the figures it needs are sent to write the answer; when you ask the help assistant on the website, your question and the help articles it draws on.

In the preview without an account, the data stays in your browser and is not sent to us. Some of these providers are based outside the EU; where data leaves the European Economic Area, it does so under the safeguards the GDPR requires.

6How long

For as long as the account is open. When it is closed, the data is deleted, except what the law requires us to keep — for example the invoices we issue, which the Estonian Accounting Act requires us to keep for seven years.

7Your rights

You can ask to see, correct, export or delete your personal data, to restrict its use or to object to it. Write to hello@profflow.ee. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee).

8Changes

When this policy changes, this page and its date change with it.