Privacy notice
This notice explains how CDFlow AI handles account, organisation, accounting and filing data, including when you connect an AI assistant through MCP.
Data we process
Account and contact details; organisation identifiers such as legal name, address, telephone number, RCS number, company matricule and VAT number; accounting documents and their contents; filing values, evidence links, revisions, approvals and export or submission results; billing-provider references; and redacted security and operational logs.
Why we process it
We use this data to authenticate users, isolate organisations, store and analyse accounting evidence, prepare and check filing drafts, maintain an audit trail, generate exports, enforce subscription limits and provide support and security. We also use first-party aggregate page, product-action and lifecycle totals to operate, secure and improve the service and understand acquisition and conversion. These analytics contain no customer content or individual visitor profile.
AI assistants, built-in chat and MCP
CDFlow AI’s built-in chat sends the conversation context, requested document content and filing tool results to the selected managed model provider and records provider-reported token usage for billing. When you use MCP, the connected AI provider receives the data required by the tools you invoke. In Expert mode, the same data is sent to the endpoint you configure; you are responsible for that provider’s charges, retention, security and terms. CDFlow AI authorises every operation and keeps it inside the selected organisation.
Storage and retention
Subscription workspaces retain documents and filing records while the service is active, subject to configured retention and legal requirements. Temporary filing-pass data is deleted under its stated lifecycle. Security logs are designed to exclude access tokens, credentials and document contents.
Cookies and browser storage
CDFlow AI uses necessary cookies and browser storage for authentication, security, language and recording privacy choices. Separately, first-party audience and service measurement is written directly to bounded aggregate buckets without analytics cookies, persistent identifiers, fingerprinting, raw events, IP addresses, full user agents, query strings or raw referrer URLs. Aggregate traffic and lifecycle totals are retained for up to 395 days; short-lived presence estimates are retained for no more than 24 hours. Optional YouTube media remains consent-based and disabled by default. Full technical details and controls are in the Cookie policy.
Your choices and contact
You can review and correct organisation data in the portal and disconnect MCP access from your AI provider. For access, correction, deletion or privacy questions, contact [email protected], Phone: +352 20 338170 or Phone & WhatsApp: +352 691 399 853.