Privacy Policy

ReimburseFlow ("we", "us") is operated by Liveupx. We act as a data processor for the personal data that customer organizations ("controllers") put into the platform. For our marketing site and account signups, we are the controller.

1. Data we collect

• Account data: name, work email, organization, role, password hash, 2FA secret.
• Tenant business data: reimbursement applications, receipts, budgets, comments, audit log entries — all scoped to your organization.
• Usage data: device, IP, browser, session timestamps, and product events for security and reliability.
• Marketing data: information you submit via contact and demo forms.

2. Legal basis

We process personal data on the basis of contract (delivering the service), legitimate interests (security, fraud prevention, product analytics), and consent (non-essential cookies, marketing).

3. How we use data

• To provide the ReimburseFlow service to your organization.
• To secure the platform, detect abuse, and maintain audit logs.
• To send transactional emails (invites, approvals, payments, alerts).
• To improve the product through aggregated analytics.

4. Sharing and subprocessors

We use a limited set of vetted subprocessors — see Subprocessors. We do not sell personal data. We share it only to deliver the service or to comply with the law.

5. International transfers

Where data leaves the EU, we rely on Standard Contractual Clauses. Enterprise customers can pin storage to EU, US, or India.

6. Retention

Account data is retained while the account is active and for up to 90 days after deletion, except where statutory financial-record retention applies. Audit log retention follows your plan (30 days to custom).

7. Your rights

You may request access, rectification, deletion, portability, restriction, or objection. See GDPR & DPDP for the process. We respond within 30 days.

8. Security

See our Security page for the controls in place.

9. Contact

Email privacy@reimburseflow.com for any privacy request.