Privacy Policy

Last updated: July 2026.

This policy describes how RumFlow handles your personal data when you use the web application and associated services (the "Service"). If you have any questions, write to us at [email protected].

Who we are

RumFlow is a service operated by Sergio García Calero, 47690977-V, Málaga, Spain. We act as the data controller for the data you provide us.

What data we process

• Account: email and password (stored with Bcrypt hashing, never in plain text).
• Financial data you enter: income, expenses, loans, subscriptions, utility bills and investments that you voluntarily record in the app.
• Session data: an httpOnly session cookie to keep you signed in between visits.
• Imported bank statements: if you upload a CSV/XLSX/PDF from your bank to import transactions, it's processed to extract the data and the original file is not kept beyond the import process.

Where your data is stored

All data is stored on our own server (a PostgreSQL database) under our direct control — it is not stored on your device or with generic third-party storage services. The connection between your browser and our server is encrypted (HTTPS/TLS).

Third parties that process data on our behalf

• Resend — sends transactional emails (invitations, password resets). Receives your email address and the message content, not your financial data.
• [PENDING — payment processor: Paddle] — if you subscribe to a paid plan, the processor handles the charge and your card details; RumFlow does not access or store your payment data.
• [PENDING — if AI-based policy extraction is enabled] — the text of any insurance policy you upload is sent to an AI provider to extract structured data.

Your rights (GDPR)

If you reside in the EU/EEA, you have the right to access, rectify, port and delete your data, as well as to object to its processing. You can delete your account and all your data at any time from Settings, or by writing to us at [email protected]. When you delete your account, your data is permanently erased within a reasonable timeframe, except where retention is legally required (e.g. invoicing).

Minors

The Service is not directed at minors under 16 years of age. We do not knowingly collect data from minors of that age.

This is not financial advice

RumFlow may show you informational alerts about your financial situation (cash flow, debt ratio, etc.) and, in the investment module, a summary of what you record. This is general information, not an investment recommendation or personalized financial advice. Financial decisions are the sole responsibility of the user.

Changes to this policy

If we make material updates to this policy, we will notify you by email or via a notice within the app itself.