Privacy Policy

This Privacy Policy explains how Flowstart Kft., company registration number 01 09 429426, registered office at 1141 Budapest, Szugló utca 161. 1/2., Hungary (Flowstart, we, us, or our), processes personal data in connection with KeptAds (the Service).

The Service is designed for accounting and bookkeeping practices. In most cases, a customer organisation determines why and how personal data in its client documents is used, and Flowstart processes that data on the customer’s behalf. In that role, the customer is the controller and Flowstart is the processor. For account administration, billing, security, marketing communications, and our own business operations, Flowstart is the controller.

1. Scope

This Policy applies to personal data processed when you visit KeptAds, create or administer an account, use the Service, contact us, receive our communications, or appear in Customer Data submitted to the Service.

It does not apply to third-party services that have their own privacy notices, including payment processors and other subprocessors. We encourage you to review their terms and privacy information.

2. Personal data we process

Depending on how you interact with the Service, we may process:

• Account and organisation data: name, work email address, password hash, organisation name, role, account settings, and authentication records.
• Client and contact data: names, email addresses, and other contact information entered by a customer to request or manage documents.
• Document and workflow data: files, attachments, document metadata, upload history, classification results, reminder status, and related records submitted by or for a customer.
• Technical and security data: IP address, browser and device information, event logs, timestamps, session data, and records needed to prevent fraud, investigate incidents, and maintain the Service.
• Support communications: messages, attachments, and other information you provide when contacting us.
• Billing and transaction data: subscription status, invoices, payment identifiers, and tax-related records. Payment-card data is processed by our payment processor and is not stored by KeptAds.

Customer documents may contain financial, contact, or other personal information. Customers are responsible for ensuring that they have an appropriate lawful basis and have provided any required privacy notices before submitting that information to the Service.

3. Why we process personal data

When Flowstart acts as controller, we process personal data as necessary to:

• provide, operate, secure, support, and improve the Service;
• authenticate users and maintain account security;
• administer subscriptions, invoices, payments, and customer relationships;
• communicate about the Service, security, support, and material changes;
• comply with legal obligations, enforce our Terms, and protect our rights, users, and systems; and
• send business communications where permitted by applicable law and subject to your opt-out rights.

Our legal bases under the GDPR are, as applicable: performance of a contract; our legitimate interests in operating, securing, and improving the Service; compliance with legal obligations; and consent where we request it.

When Flowstart acts as processor, we process Customer Data only on the documented instructions of the relevant customer, as required to provide the Service, or as required by applicable law.

4. Automated classification and AI-assisted processing

KeptAds may use automated rules and, where enabled, third-party AI services to classify and summarize publicly available competitor ads and assist with workflow. These processes generate operational suggestions and metadata; they do not make decisions producing legal or similarly significant effects about individuals.

Flowstart does not use Customer Data to train its own general-purpose AI models. Where a customer enables or uses an AI-assisted feature, the relevant document content may be transmitted to the applicable subprocessor solely to provide that feature, subject to the safeguards and contractual terms applicable to that subprocessor.

5. How we share personal data

We do not sell personal data. We disclose personal data only where necessary for the purposes above, including to:

• authorised users within the relevant customer organisation;
• infrastructure, hosting, storage, database, email-delivery, workflow, payment, support, and AI service providers acting on our behalf;
• professional advisers, auditors, insurers, and authorities where required or permitted by law;
• a successor organisation in connection with a merger, financing, acquisition, restructuring, or sale of assets, subject to appropriate confidentiality protections; and
• other parties with your direction or consent.

We require subprocessors to protect personal data appropriately and to process it only for authorised purposes.

6. International transfers

Flowstart is established in Hungary. Our service providers may process personal data in the European Economic Area, the United States, and other countries where they operate. Where personal data is transferred outside the EEA, we use an appropriate transfer mechanism required by applicable law, such as an adequacy decision, the European Commission’s Standard Contractual Clauses, or another valid safeguard.

7. Retention

We retain personal data only for as long as necessary for the purposes described in this Policy, including legal, accounting, tax, security, and dispute-resolution requirements.

Customer Data remains available during the active customer relationship and, following account closure, is ordinarily available for export for 30 days. We then delete or anonymise Customer Data within a further 30 days, unless we are legally required to retain it or retention is necessary to establish, exercise, or defend legal claims. Backups are deleted or overwritten on a rolling schedule and may persist for a limited period after deletion from active systems.

8. Security

We apply technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include access controls, organisation-level data separation, encrypted transmission, private storage, and operational monitoring appropriate to the Service.

No method of transmission or storage is completely secure. You are responsible for protecting your account credentials, managing authorised users, and using document-drop links appropriately.

9. Your rights

Subject to applicable law, you may have the right to request access to, correction of, deletion of, restriction of, or portability of personal data that Flowstart controls, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

If you are an individual whose information is contained in Customer Data, please contact the customer organisation that submitted the data first. We will assist our customers with valid requests in accordance with our contractual and legal obligations.

You may submit a request to hello@keptads.com. We may need to verify your identity before responding. You also have the right to lodge a complaint with the Hungarian supervisory authority, the National Authority for Data Protection and Freedom of Information (NAIH), or your local data-protection authority.

10. Cookies and similar technologies

We use essential cookies and similar technologies necessary to operate the Service, maintain sessions, prevent abuse, and remember security-related preferences. Where we use non-essential cookies or similar technologies, we will provide the notice and choices required by applicable law. See our Cookie Policy for further information.

11. Children

KeptAds is a business service and is not directed to children. We do not knowingly collect personal data directly from children. If you believe a child has provided personal data to us without appropriate authorisation, contact us and we will take appropriate steps.

12. Changes to this Policy

We may update this Policy from time to time. We will publish the updated version on this page and change the “Last updated” date. If a change is material, we will provide additional notice where required by law.

13. Contact and data-controller details

Flowstart Kft.

• Company registration number: 01 09 429426
• Registered office: 1141 Budapest, Szugló utca 161. 1/2., Hungary
• Privacy and legal enquiries: hello@keptads.com

This Policy is provided in English. Where a translated version is made available, the English version governs to the extent permitted by law.