Privacy Policy

This Privacy Policy describes how GAASFlow (“we,” “us”) collects, uses, and shares information when you visit gaasflow.com or use the GAASFlow application (the “Service”).

Contact: Support@GAASFlow.com

• Account data: name, work email, password (stored hashed), firm name, optional firm profile fields, role within a firm.
• Customer content: engagement files, workpapers, notes, documents, trial balances, and other materials you enter (“Customer Data”).
• Usage & technical data: IP address, device/browser type, approximate location from IP, log data, cookies or similar technologies for authentication and security.
• Billing data: plan, seat limits, and subscription status. Payment card details are processed by our payment processor and are not stored on GAASFlow servers.
• Support requests: information you submit via support chat or email.

• Provide, maintain, and secure the Service
• Authenticate users and enforce firm tenancy and roles
• Process subscriptions and send transactional notices
• Respond to support requests
• Improve reliability, prevent abuse, and develop features
• Comply with law and enforce our Terms

We do not sell personal information.

We share information only with:

• Service providers (hosting, email delivery, payment processing, error monitoring) under contractual confidentiality and limited-use obligations
• Your firm administrators who manage seats and access within your tenant
• Legal / safety when required by law or to protect rights, security, and integrity of the Service
• Business transfers in connection with a merger, acquisition, or asset sale, subject to continued protection

See also our Data Processing Addendum for firm-customer processing relationships.

Customer Data is stored in a multi-tenant architecture scoped by firm. Application queries are designed so one firm cannot access another firm’s users, engagements, or documents.

Optional AI features may process prompts and limited engagement context to generate draft text. Use is governed by our AI & Data Terms. Do not submit data you are not authorized to process.

We retain account and Customer Data while your firm subscription or trial is active and for a commercially reasonable period afterward to permit export, resolve disputes, and meet legal obligations. You may request deletion subject to legal retention requirements.

We use HTTPS/TLS in production, hashed passwords, role-based access, rate limiting on sensitive routes, and security headers. More detail is available on our Security page.

• Update profile and firm settings in-product
• Export engagement materials via print package and available export features
• Request access, correction, or deletion by contacting Support@GAASFlow.com
• Opt out of non-essential marketing emails via unsubscribe links

The Service may be hosted in the United States or other regions where our providers operate. Where required, we use appropriate transfer mechanisms for cross-border data.

The Service is directed to business users and is not intended for children under 16.

We may update this Policy and will post the revised effective date. Material changes may also be communicated in-product or by email.

Privacy inquiries: Support@GAASFlow.com