Privacy policy

2. Roles of Fluxe and the Client

For data relating to representatives, accounts, subscriptions, payments, support, security and requested marketing, Fluxe determines the purposes and is the controller. For personal data that the Customer enters in invoices, documents, files, contacts or integrations, the Customer is the controller or, where applicable, an authorised processor for another controller. Fluxe acts as processor or subprocessor solely to provide the features and on the Customer's lawful instructions.

The processing clauses under Article 28 GDPR are included in the Data Processing Agreement (DPA), which supplements the Terms. In accordance with its role, the Customer ensures that a legal basis, necessary notices and authorisation exist for processing data about employees, customers, suppliers and other persons uploaded to the platform.

Legal basis and responsibilities of the parties: a Customer acting as controller ensures a valid basis under Article 6 GDPR and the information required by Articles 13 and 14; a Customer acting as processor follows the controller's instructions and ensures authorisation of Fluxe as subprocessor. The Customer is responsible for infringements caused by its unlawful instructions or content. Fluxe is separately responsible for its obligations as controller or processor and for processing outside or contrary to lawful instructions.

3. Data categories and sources

• identification and contact: name, email address, telephone number, role, company, CUI, address and representation details;
• account and security: authentication, roles, preferences, IP, browser, device, sessions, logs and audit events;
• contract and payment: subscription, period, legal acceptances, invoices, status and Stripe identifiers; Fluxe does not routinely store full card data;
• professional content: invoices, documents, contacts, files, signatures, messages, IBANs, transactions, bank, tax and metadata data; they may include data of people who do not have a direct relationship with Fluxe;
• data that may appear in administrative documents: CNP or document series and number, payroll, time, delegations, routes and vehicles, function, signature and other information legally entered by the Client; special categories should not be loaded unless necessary and there is a proper basis;
• support and communication: requests, attachments, responses, notification preferences and feedback;
• data from the Client, its users, public systems, ANAF/SPV, payment providers, email services and integrations authorized by the Client.

4. Purposes and legal bases

5. Mandatory nature and consequences

Data marked mandatory is required for account, Customer identification, security, billing or legal obligations. Without them we cannot conclude or execute the contract. The client can use the other modules without uploading a document to the OCR stream; however, after loading or scanning into a stream configured for analysis, the configured OCR, classification, and AI provider may be required for the requested processing. Optional integrations can be avoided without affecting features that do not depend on them.

6. Recipients and subprocessors

Data is accessible to authorised personnel and service providers that need it to provide the service, subject to confidentiality and data-protection obligations. Authorities, courts, advisers and auditors receive data only where there is a legal basis or where necessary to defend legal rights.

Own infrastructure is operated by the same Fluxe legal entity and is not a separate subprocessor:

• Găzduire, baze de date și copii de siguranță — CITYVIBES S.R.L.; Europa. Operarea siteului, a serverelor, bazelor de date și copiilor de siguranță de către Fluxe.
• Emailurile platformei și suport — CITYVIBES S.R.L.; Europa. Administrarea și livrarea emailurilor platformei de către Fluxe.

The data processing agreement (DPA) — version 2026-10-15-r2. The register details the purpose, data, data subjects, locations and safeguards for each external service. Subprocessor list

The list reflects the providers configured for this installation. Material changes affecting data processed on behalf of the Client will be communicated through the platform or by email so that the Client may raise a justified objection.

ANAF, SPV, RO e-Invoice and e-Transport systems, banks, public registries and applications in which the Client exports data can only receive information through integration or authorized action. These recipients may act as independent operators according to their own legal obligations; their official receipt, statement and record prevails over the local copy.

7. AI analysis and human verification

Document analysis and AI Assistant may use different providers, identified separately in the subprocessor register. Only the selected file or text, instruction and context necessary for processing are transmitted for the activated feature. The conversation may be transmitted to the AI Assistant provider only when that service is active. Local extraction, classification and checks do not transmit content to an external AI provider. Fluxe checks the company and access permissions, while issuing, modifying or transmitting a document remains subject to the authorisation and confirmations of the relevant feature.

General logic uses document content, document patterns, extracted fields, and confidence scores. For reconciliation, indicators such as exact amount, date, reference and counterparty are compared. The result classifies or suggests fields and matches, can signal the need for revision, and can be corrected or rejected by the user.

OCR and AI results are propositional in nature. Fluxe does not make decisions with legal or similar effect exclusively automatically and does not transmit the result to the authorities without an action or automation explicitly configured by the Customer. The user must compare the result with the source before approving, issuing, registering, reconciling, exporting or reporting.

The Features are not intended for personal evaluation, recruitment, credit, entitlement or other high-risk uses. The customer must not reuse the results for such a purpose without a separate legal and technical analysis. Fluxe and the Client ensure, for persons operating the Functions on their behalf, an appropriate level of AI literacy, instructions and human supervision commensurate with role and risk.

Conditions for the AI provider: use for training, retention and erasure depend on the contracted API service and Fluxe account options. Terms for business services must not be confused with those for consumer chat applications. Fluxe does not claim zero retention or exclusively European processing by an external provider without confirmation of these options for the service used. The register includes links to the provider's DPA, privacy policy and subprocessor list where available.

The AI impact assessment and literacy program should be documented and reviewed before commercial release and after any material change.

8. International transfers

Some providers may process data outside the European Economic Area. In such cases, as appropriate, we use an adequacy decision, the European Commission's standard contractual clauses, supplementary measures and a transfer assessment.

The specific transfer mechanism and the providers' regions must be documented in the internal register and processing agreements before launch.

9. Retention periods

• account data and professional content that do not constitute records subject to legal retention: for the duration of the account, then they are deleted at the Customer's instruction, subject to technical copies and a legal hold;
• mandatory accounting ledgers, supporting documents, and reconciliation links necessary for traceability: general retention period of 5 years, calculated from July 1 of the year following the financial year in which they were prepared, unless a special term imposes more;
• documents for which a special regulation imposes a longer period, including documents attesting the origin of goods with a lifespan greater than 5 years: for the specially applicable term;
• after the request to delete an account, the records that are still pending are isolated under an anonymized account; at the expiration of the last period and in the absence of a legal hold, the reconciliation links and the residual technical account are eliminated; The customer must previously export the documents that he has his own obligation to keep;
• accounts created solely for an abandoned checkout, without payment or activation: up to 30 days after abandonment, after which they are removed unless another retention basis applies;
• acceptance of the legal documents and evidence of an abandoned checkout order, without an activated contract: up to 90 days after abandonment, for security, dispute resolution and proof of the request;
• technical backups: for up to 7 days after deletion from the active system, unless overwritten sooner;
• acceptances, contract confirmations, payments and evidence required to defend rights: for the contract term and up to 5 years after termination, or the longer applicable statutory period; a legal hold suspends deletion for the duration of litigation or an investigation;
• invoices issued by the Provider to the Client and the Provider's own records required by law: for the applicable fiscal and accounting retention period;
• security and operational audit logs: typically up to 365 days, with longer retention for active incidents;
• GDPR requests and complaints: for as long as necessary to resolve them and evidence the response, in accordance with applicable limitation periods.

When the retention period expires, data is deleted, anonymised or irreversibly aggregated. A deletion request cannot remove records that we are legally required to retain or that are strictly necessary to defend a legal right.

10. Security and incidents

We use role- and company-based access controls, authentication, logging, protection of secrets and certificates, file validation, backups, and encryption for sensitive data where appropriate. Access is limited to authorised persons, and the measures are reviewed based on risk.

No solution eliminates all risk. We investigate incidents, limit their effects, and notify the Client and/or the competent authority when required by the GDPR. The Client must immediately report any compromise of its account or devices.

11. Data-subject rights

Subject to the GDPR, a data subject may request access, rectification, erasure, restriction and portability, and may object to processing based on legitimate interests. Consent may be withdrawn for the future. A request may require identity verification and is normally answered within one month; the period may be extended by up to two months for complex or numerous requests, with notice and reasons in the first month. Requests are free of charge, subject to the limited GDPR exceptions for manifestly unfounded or excessive requests.

For data entered by a Customer in its documents, the request may be addressed to the Customer as controller or sent to the Fluxe contact. Fluxe forwards it to the Customer and assists it, without making decisions on its behalf about data processed solely on its instructions. A person may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing through www.dataprotection.ro or with the competent authority in their country.

13. Third-party data — Article 14 GDPR notice

Fluxe may indirectly receive data about the Client's customers, suppliers, employees or representatives from documents and integrations. The categories, purposes, recipients and retention periods are described above. When Fluxe acts as processor, the Client is responsible for providing the notice; when Fluxe becomes controller for its own purpose, it will provide the information required by Article 14, except where the law permits an exemption.

The Customer is responsible for the legal basis, informing, and minimization of third-party data entered at its instruction. Fluxe is responsible for the security, confidentiality, and other obligations inherent to a data processor; the liability of each party is determined according to its contribution to the event and according to the applicable mandatory regulations.

14. Minors, changes and contact

The B2B service is not intended for minors, and we do not intentionally solicit accounts from them. Material changes to the policy receive a new version and date and are communicated through the platform or by email when they materially affect the processing.

For questions, exercising your rights or reporting a security incident: contact@fluxe.ro.

15. Legal framework for processing and normative acts

The privacy policy is based on the imperative provisions of national and European legislation in force, as follows:

• Regulation (EU) 2016/679 (GDPR): Art. 5 (Principles of processing), Art. 6 (Legal bases: contract, legal obligation, legitimate interest, consent), Art. 13 and 14 (Informing data subjects), Art. 28 (Obligations and protection of the Controller and the Processor) and Art. 32 (Security of processing);
• Law no. 190/2018: regarding measures for the implementation of Regulation (EU) 2016/679 (including provisions regarding processing in the context of employment relationships and B2B professional contacts);
• Law no. 506/2004: Art. 4 para. (5) regarding privacy protection in the electronic communications sector (the consent exception regime for strictly necessary cookies and technical storage in the browser);
• Regulation (EU) 2024/1689 (AI Act): Art. 4 regarding AI literacy and other obligations applicable to artificial intelligence systems used in the platform; Fluxe's policy regarding data usage by AI providers is based on the contracts, configuration, and technical guarantees described above, not on a general prohibition attributed to this article;
• Law no. 214/2024 and Regulation (EU) no. 910/2014 (eIDAS): regarding the processing of personal data in the context of electronic signatures, digital certificates, and timestamps;
• Accounting Law no. 82/1991, MFP Order no. 2.634/2015 and Fiscal Code (Law no. 227/2015): regarding the general retention period of 5 years and the special periods applicable to certain supporting documents.

The official text of normative acts and the special legal obligation in force prevail over any interpretation or synthesis.