This Privacy Policy explains how OSBN Flow ("we") collects, uses, and shares information when you use our developer dashboard and API.
1. Information we collect
- Account data: email address, hashed password, display name, role.
- Bank data: through third-party aggregators (Plaid, GoCardless, TrueLayer) we receive account metadata (name, type, mask, currency, balances) and transactions.
- Access tokens: stored encrypted at rest (AES-256-GCM).
- Usage data: API request logs, rate-limit counters, timestamps, IPs.
2. Legal basis (GDPR)
We process bank data under your contract with us and the end-user's explicit consent collected through the aggregator's consent screen. Account data is processed under contract.
3. Sub-processors
- Plaid Inc. — US/Canada bank data aggregator.
- GoCardless Ltd. — EU/UK PSD2 bank data aggregator.
- TrueLayer Ltd. — EU/UK/LATAM open banking aggregator.
- Lovable Cloud (Supabase) — managed database, authentication, and hosting (EU region).
4. Retention
Account data is retained while your account is active. Transactions are retained up to 24 months by default, configurable per workspace. Access tokens are deleted within 30 days of revocation.
5. Your rights
Under GDPR/CCPA you may request access, correction, deletion, or export of your data. Email privacy@os3n.com and we will respond within 30 days.
6. Security
- TLS in transit, AES-256-GCM at rest for tokens.
- Row-level security on every user-scoped table.
- Rate limiting and API key revocation.
7. Cookies
We use strictly necessary cookies to maintain your authenticated session. No advertising cookies.
8. Contact
Privacy questions or data requests: privacy@os3n.com.
See also our Terms of Service.