Privacy Policy
Last updated:
1. Who we are
AgileVision Sp. z o.o. (“Agile Cashflow”, “we”, “us”, “our”) is a company registered in Poland under KRS number 0000605639, with its registered office at Dolnych Mlynow 3/1, 31-124 Krakow, Poland. Agile Cashflow is the cashflow planning product operated by AgileVision.
We are the Controller of the personal data described in this Privacy Policy, within the meaning of the General Data Protection Regulation (EU) 2016/679 (“GDPR”). For questions about this Privacy Policy or your personal data, contact us at support@agilecashflow.com.
2. Scope
This Privacy Policy explains how we collect, use, and protect personal data when you:
- Visit our website at agilecashflow.com
- Sign in and use the Agile Cashflow platform
- Communicate with us (email, contact forms, sales conversations)
- Receive product or operational communications from us
This Privacy Policy does not cover the processing of data that flows through the Agile Cashflow platform on behalf of our customers (organizations, plans, invoices, bills, bank statements, transactions, cash accounts, and team members in a customer’s workspace). That processing is governed by our Data Processing Agreement.
3. What we collect and why
3.1 Website visitors
We use a self-hosted instance of Plausible Analytics, running on our own infrastructure, to understand how visitors use our website. Plausible does not use cookies, does not collect personal data, and does not track individual visitors across sessions or sites. All analytics data is aggregated and anonymous. We do not use any other tracking technologies, advertising pixels, or third-party cookies on our website.
Legal basis: Legitimate interest (understanding website usage to improve our service).
3.2 Account holders and platform users
When you create an account, sign in to Agile Cashflow, or are added to a workspace by your team, we collect:
- Name
- Email address
- Password, stored only as a salted hash
- Profile picture, if provided by Google when you use Google sign-in
- Workspace name, your role, and your permissions
- Notification preferences
- Authentication data and session cookies
Purpose: To provide access to the platform, manage your account, authenticate your identity, and communicate with you about the Service. Legal basis: Performance of a contract (your service agreement with us).
3.3 Sales and operational contacts
When you contact us through email, sales enquiries, or a discovery call, we may collect:
- Name
- Email address
- Company name and role
- Communication history and notes
Purpose: To respond to your enquiry and manage the relationship. Legal basis: Legitimate interest (responding to enquiries, managing business relationships).
3.4 Billing and payment
Our order process is conducted by our online reseller Paddle.com. Paddle is the Merchant of Record for all our orders: Paddle sells the subscription to you, collects payment, calculates and remits sales tax and VAT, issues invoices, and handles refunds and billing enquiries. Paddle processes your payment details and billing information as an independent controller under the Paddle Privacy Policy; we never see or store your full card number.
We receive from Paddle the information we need to manage your subscription:
- Name and email address of the buyer
- Company name, country, and VAT number, where provided
- Plan, billing cycle, and subscription status
- Transaction and invoice references
Purpose: To link your subscription to your workspace, apply your plan limits, and keep records of your purchases. Legal basis: Performance of a contract and legal obligation (tax and accounting requirements).
3.5 Communications
When you email us or we email you, we process the contents of those communications, including any personal data you include.
Purpose: To provide support, discuss your account, and manage our business relationship. Legal basis: Performance of a contract and legitimate interest.
When you choose Google sign-in, Google also processes authentication information under its own privacy policy. When you connect an integration such as an accounting system, CRM, mailbox, file store, or messaging tool, that provider receives and returns the information you authorize through the connection’s permissions, under its own terms.
4. Who we share your data with
We share your personal data only with the following categories of recipients, and only to the extent necessary:
| Recipient | Purpose | Location |
|---|---|---|
| Amazon Web Services, Inc. | Application hosting, document storage, OCR (Amazon Textract), AI document processing (Amazon Bedrock), and transactional email (Amazon SES) | EU region, eu-central-1 (Frankfurt) (US entity) |
| Google LLC | Authentication (Google sign-in / OAuth) | United States (US entity) |
| Paddle.com Market Limited | Merchant of Record: checkout, payment, tax, and invoicing | United Kingdom (with processing by its service providers) |
| Cloudflare, Inc. | Website hosting, CDN, and DDoS protection | Global edge network (US entity) |
We do not sell your personal data. We do not share your personal data with advertisers. Content you submit through the Service is not used by our providers to train AI models.
5. International transfers
Agile Cashflow is hosted in the European Economic Area, in the Amazon Web Services eu-central-1 region (Frankfurt, Germany). Your account data, documents, and workspace data are stored and processed there.
Some of our service providers are incorporated in the United States (see Section 4), and Google sign-in and Cloudflare’s global network may process limited data outside the EEA. Where personal data is transferred outside the EEA, or a provider’s corporate jurisdiction may give rise to obligations under foreign law, we protect it in accordance with Chapter V of the GDPR. Where a recipient is certified under the EU-US Data Privacy Framework, we rely on that certification; in all other cases, and as an additional safeguard, we rely on the Standard Contractual Clauses approved by the European Commission. Transfers to the United Kingdom rely on the European Commission’s adequacy decision. You can request a copy of the relevant safeguards by contacting us at support@agilecashflow.com.
6. How long we keep your data
| Data category | Retention period |
|---|---|
| Account data | Duration of account + 30 days after deletion |
| Billing and invoices | 5 years after the end of the financial year (legal obligation) |
| Sales and operational contacts | Until you ask for deletion, reviewed annually |
| Communications | 2 years after last interaction, unless related to an active account |
| Website analytics | Aggregated and anonymous, no personal data retained |
7. Your rights
Under the GDPR, you have the following rights regarding your personal data:
- Access: request a copy of the personal data we hold about you
- Rectification: request correction of inaccurate or incomplete data
- Erasure: request deletion of your personal data, subject to legal retention requirements
- Restriction: request that we limit processing in certain circumstances
- Portability: receive your data in a structured, machine-readable format
- Objection: object to processing based on legitimate interest, including direct marketing
- Withdraw consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing
To exercise any of these rights, contact us at support@agilecashflow.com. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland, or with the supervisory authority in your country of residence.
8. Security
We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access controls, and regular security reviews. For details of our security measures in relation to platform data, see our Data Processing Agreement.
9. Cookies
We do not use cookies for website analytics. Our self-hosted Plausible Analytics operates without cookies and does not collect or store any personal data. The only cookies set by Agile Cashflow are session cookies required for sign-in and your authenticated session in the application. Agile Cashflow supports email and password sign-in and Google sign-in. Paddle may set cookies required to run its checkout when you make a purchase.
10. Operational communications
We may send you transactional emails about your account (billing, security, service announcements, notifications you have enabled, support replies). These are required for the operation of the Service and are not subject to unsubscribe, although you can change optional notifications in your workspace settings. Any optional product newsletters include an unsubscribe link, and you can opt out at any time by contacting us at support@agilecashflow.com.
11. Children
Our Service is not directed at individuals under 18 years of age. We do not knowingly collect personal data from children.
12. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of material changes by publishing the updated policy on our website with a revised “Last updated” date. For significant changes affecting your rights, we will make reasonable efforts to notify you directly (for example, by email).
13. Contact
AgileVision Sp. z o.o.
Dolnych Mlynow 3/1, 31-124 Krakow, Poland
KRS 0000605639 · NIP 6793124041 · REGON 363905719
VAT ID: PL6793124041
Email: support@agilecashflow.com