Your data, and how we protect it
Uploading a bank statement is a real act of trust, and we do not take it lightly. Here is exactly what happens to your file, in plain words. No legalese, no buried clauses. The formal version is in our Privacy Policy.
Who you are trusting
FLOW and VESTELON are operated by Harbor Equity a.s., a company registered in the Czech commercial register under IČO 21989249, with its registered seat at Dlouhá 730/35, 110 00 Prague, Czech Republic, in the European Union. Harbor Equity a.s. is the data controller for your information and operates under EU and Czech law and the GDPR. For any data or privacy question, write to hello@vestelonflow.com, where a human answers within 24 hours on business days.
We are early, and we say so plainly. You will not find invented reviews or user counts here, only the things that actually protect you.
What we actually need (it is less than you think)
To find your money leaks, FLOW only needs the transaction lines from your statement: the date, the amount and the description. That is it. We do not need your online-banking login, your card PIN or your full identity, and we never ask for them.
Stay anonymous: black out anything personal
Before you upload, you can redact, black out, anything you do not want to share: your name, your account number, your address. FLOW still works on a redacted statement, because it reads the transaction lines, not your identity. Using an anonymised statement is not only allowed, it is encouraged.
Coming: automatic masking of names and account numbers, so you do not have to redact by hand, and an option to have your statement analysed without it ever being stored. These are on our roadmap and not live yet; until they are, you stay in control by redacting yourself.
Encrypted, and inside the EU
Your file is encrypted in transit and at rest, with primary storage in the European Union. Structured formats are processed locally in your browser. Only the optional PDF or unrecognized-content fallback may transfer statement text or a statement photo to Anthropic in the USA with your explicit consent and contractual safeguards. Data is never used to train public AI models or sold for marketing.
You stay in control, including before you pay
We keep your uploaded statement and your report only until you delete them, and you can delete them at any time, including before you pay anything. Your first leak reveal is free: you see what FLOW found, decide if it is worth it, and only then choose whether to pay. Nothing is locked in.
No bank login, on purpose
Uploading exported files needs no password at all: FLOW reads your statement without any online-banking login. Compatibility depends on the file format and is verified bank by bank; an export guide is not a guarantee that every layout will parse correctly.
Optional: a secure direct bank connection is available through our regulated open-banking (PSD2) provider Salt Edge. You authenticate directly with your bank in its own interface; FLOW never sees or stores your banking login. An option you can turn on, never a requirement.
Your rights under the GDPR
You have the right to access, correct and erase your data, to restrict or object to processing, to data portability, and to complain to your supervisory authority (in the Czech Republic: ÚOOÚ, uoou.gov.cz). To exercise any right, email hello@vestelonflow.com.