Privacy Policy

1. Overview

Lysflow is a business management platform (quotes, invoices, customers, catalogue) for entrepreneurs and SMEs. This policy describes the data collected when using the service at app.lysflow.com, the purposes of processing, and your rights.

Note: certain legal details (legal entity, data controller contact, definitive retention periods) are being finalised. This policy will be updated once those details are established. The practices described below accurately reflect the current technical architecture of the service.

2. Data Controller

The Lysflow service is operated by its founding team. Full data controller contact details will be published here once the legal entity is formally constituted. For any data-related enquiry, contact us at: privacy@lysflow.com.

3. Data Collected

Lysflow collects the following data:

• Identity and access data: email address, display name, account identifier.
• Business data: company name, country, currency, billing settings.
• Commercial data: quotes, invoices, customers, product and service catalogue that you create in the application.
• Connection data: access logs, IP address, browser type, login timestamps.
• Billing data: history of credits consumed for issuing official documents.

Lysflow does not directly collect credit card payment data.

4. Google Authentication (Google Sign-In)

Lysflow offers Google Sign-In as an authentication method. Here is precisely what this means:

• Google is used as a federated identity provider. Google authentication is integrated through Amazon Cognito, the AWS identity management service used by Lysflow.
• Scope of data requested: Lysflow requests only the information necessary for authentication and account identification — specifically your email address and basic profile information (display name).
• Lysflow does not access Gmail. No permission to read or send emails via Gmail is requested.
• Lysflow does not access Google Drive. No permission to access Google Drive files is requested.
• Lysflow does not access Google Contacts. No permission to access your Google address book is requested.
• Lysflow does not access Google Calendar. No permission to access Google Calendar is requested.
• Use of Google Sign-In is subject to Google's Privacy Policy.

5. Purposes of Processing

The data collected is used to:

• provide the business management service (document creation and archiving);
• authenticate users and secure account access;
• generate official PDF documents (quotes, invoices);
• send documents by email to recipients designated by the user;
• ensure traceability and authenticity verification of issued documents;
• improve the reliability and security of the service.

6. Infrastructure and Hosting

Lysflow is hosted on Amazon Web Services (AWS), Europe region (Ireland, eu-west-1). Data is stored in AWS DynamoDB databases and AWS S3 storage, all located in that region. Authentication is managed by AWS Cognito. Transactional emails are sent via Brevo (formerly Sendinblue).

7. Data Sharing

Lysflow does not sell your personal data. Data may be shared with:

• Amazon Web Services (AWS): hosting infrastructure, authentication, storage.
• Brevo: sending transactional emails (commercial documents).
• Google: solely in the context of Google Sign-In authentication, if you choose that sign-in method.

No sharing for advertising or commercial profiling purposes is carried out.

8. Data Retention

Data is retained for the duration of account activity and for the period required to comply with applicable legal obligations. Precise retention periods by data category will be specified in a future version of this policy.

9. Security

Lysflow implements technical security measures proportionate to the nature of the service: encryption of data in transit (HTTPS/TLS), encryption at rest (AES-256), role-based access control, environment isolation, multi-factor authentication for platform administrators. No system is infallible; we commit to notifying affected users in the event of a significant security incident.

10. Your Rights

Under applicable regulations, you have the right to access, rectify, erase and port your data, as well as the right to object to processing. To exercise these rights, contact us at privacy@lysflow.com.

11. Changes

This policy may be updated. The date of last modification is shown at the top of this page. Continued use of the service after a modification constitutes acceptance of the updated policy.