Privacy Policy

CFOProof — Ali Najafzadeh

Bockkellerstraße 6/1, 1190 Vienna, Austria

Email: [email protected]

A Data Protection Officer has not been appointed pursuant to Art. 37 GDPR, as the legal requirements for mandatory appointment are not met.

When you visit our website, our hosting provider (e.g. Cloudflare/Vercel) automatically collects server log files (IP address, browser, timestamp), which are necessary to ensure the operation and security of the website (Art. 6(1)(f) GDPR). This data is deleted after a few days.

We do not use any marketing or tracking cookies (such as Google Analytics or Meta Pixel).

We use your browser's local storage (Local Storage / IndexedDB) for the following purposes:

• Storing the selected privacy mode (Local Private / Server Private)
• Caching UI state during the session
• In Local Private Mode: storing financial data in IndexedDB

In Server Private Mode, session cookies are used for authentication (Supabase Auth).

When you choose Server Private Mode, your financial data is encrypted and stored in our EU-hosted PostgreSQL database (Supabase, Frankfurt region).

Access control is provided by:

• Row-Level Security (RLS) — every query is restricted to your organisation
• Role-Based Access Control (RBAC: Viewer, Analyst, Admin, Owner)
• Audit log of all actions (permanently in PostgreSQL)

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest in secure data processing).

For payment processing we use Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

When you purchase a report, your payment data is transmitted directly to Stripe. We do not store complete credit card data. Processing is based on Art. 6(1)(b) GDPR (contract performance).

Local Private Mode: Since no data is stored on our servers, we cannot provide information about or delete such data. You retain full control of your data through your browser.

Server Private Mode: You have the right to access, rectification, erasure, or restriction of processing under GDPR. Contact us at [email protected].

For complaints, you may contact the Austrian Data Protection Authority (DSB), Barichgasse 40-42, 1030 Vienna.

In Local Private Mode, no financial data is transmitted to sub-processors. In Server Private Mode, all data is processed exclusively within the EU.

• Dual-Mode:Users explicitly choose between Local Private (no server upload) and Server Private (EU PostgreSQL with RLS).
• RLS:In Server Mode, Row-Level Security restricts every database query to the user's own organisation.
• Audit Log:Every action is logged — in Local Mode in localStorage, in Server Mode permanently in PostgreSQL.
• Encryption:Session exports encrypted with AES-256-GCM. Server database uses TLS in transit and at-rest encryption.
• No Public AI:Raw financial data is never sent to public LLM APIs.

Local Private Mode:

CSV Upload → Browser RAM → Web Worker → Analysis → IndexedDB / localStorage
                                                                  ↓
                                                    PDF Generation (client-side)
╔════════════════════════════════════════════════════════════════╗
║  No data leaves the browser.                                  ║
╚════════════════════════════════════════════════════════════════╝

Server Private Mode:

CSV Upload → API Route → PostgreSQL (Frankfurt)
                               ↓
                    Server-Side Analysis → Opportunities → PostgreSQL
                               ↓
                    PDF Generation (server-side)
╔════════════════════════════════════════════════════════════════╗
║  All data within the EU. RLS per organisation.                ║
║  Audit log for every action.                                  ║
╚════════════════════════════════════════════════════════════════╝