Privacy Policy

Last updated: February 10, 2026

Introduction

Kwaza ICT B.V. ("we", "us", "our"), operator of Flow, respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, and protect your information when you use our invoicing service.

What data do we collect?

We collect the following personal data:

  • Account information: name, email address, and password (or Google account details)
  • Company information: company name, address, KVK number, VAT number, bank details
  • Client data: names, addresses, and contact details of your clients
  • Invoice data: invoice content, amounts, and payment status
  • Payment information: payment method details are processed and stored by Stripe; we do not store your card numbers

Why do we collect your data?

We process your personal data for the following purposes:

  • To provide and maintain our invoicing service
  • To process payments and manage your subscription
  • To send invoices on your behalf to your clients
  • To communicate with you about your account and our service

Legal basis

We process your data based on: (a) the performance of our contract with you (providing the invoicing service), (b) your consent (e.g. for email communications), and (c) our legitimate interests (e.g. improving our service and preventing fraud).

Sharing of data

We do not sell your personal data. We share data only with:

  • Stripe — for payment processing
  • Amazon Web Services (SES) — for sending emails on your behalf
  • Google — if you choose to sign in with Google

Data retention

We retain your personal data for as long as your account is active. After account deletion, we may retain certain data for up to 7 years to comply with Dutch tax and accounting obligations.

Security

We take appropriate technical and organizational measures to protect your personal data, including encryption of data in transit (HTTPS) and secure storage of passwords (hashing).

Cookies

We use essential cookies to keep you logged in and remember your language preference. With your consent, we also use Google Analytics to understand how our service is used, and Google Ads to measure the effectiveness of our advertising campaigns. These analytics and advertising cookies are only loaded after you accept via the cookie banner.

Your rights

Under the GDPR, you have the following rights:

  • Right of access — request a copy of your personal data
  • Right to rectification — correct inaccurate data
  • Right to erasure — request deletion of your data
  • Right to restriction — limit how we process your data
  • Right to data portability — receive your data in a portable format
  • Right to object — object to processing based on legitimate interests

Contact

For questions about this privacy policy or to exercise your rights, contact us at info@kwaza.co. You also have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Changes to this policy

We may update this privacy policy from time to time. We will notify you of significant changes via email or through a notice on our service.