Privacy policy – CraFlow

Last updated: 16 October 2026 · Version française (the French version prevails)

CraFlow lets consultants, freelancers and their companies (IT consultancies, umbrella companies, consulting firms) enter timesheets (CRA), absences and expense reports, approve them and invoice from them. The service is available on Android, iPhone and the web. This page explains which data is processed, why, and who sees it.

Data collected

• Account: email address and name, through Firebase Authentication (Google). You can sign in with an email and a password, with Google or with Apple; with « Sign in with Apple », Apple may give us a relay address instead of yours.
• Business data entered by you or your company: your company name, SIRET, address, clients and assignments (name, address, daily rate, overtime and on-call rates), days worked, overtime and on-call duty, place of work where relevant.
• Absences: leave and absence requests, their reason and the decision; approved absences are added to your timesheet.
• Expense reports: amount, date, category and receipt (photo or PDF) you upload. When you scan a receipt with the camera, the text is read on your phone (built-in text recognition: Google Play services on Android, Apple Vision on iPhone) to suggest the amount, date and category; the reading sends nothing to a server, only the photo of the receipt is saved with the report.
• Invoices and documents: invoices issued from timesheets, signed timesheets and documents you or your company upload.
• E-invoicing: to know whether a client receives e-invoices, its SIREN is looked up in the public French e-invoicing directory. If you connect your account at the certified platform SUPER PDP, the invoices you choose to send are transmitted to it, as well as their « paid » status; the credentials of that account are stored encrypted. The « Check » button sends the invoice to the SUPER PDP validator to check its compliance.
• Results & accountant: if your company turns this option on, it saves its accountant's email address, to whom the management results (figures, invoice detail, expense reports and payouts, accounting entries) are sent through a personal link valid for 30 days.
• Signature: the signature of the PDF exported from the app stays on your phone. When you have a timesheet signed by your client, your signature and the client's (strokes, name, date and the signer's IP address) are saved on the server and appear on the signed PDF.
• Payslips: if your company turns this feature on, it uploads your payslips (PDF) to your space. Only you, your company's account owners and its managers with access to the whole company can open them; they are never sent by email and are deleted if you leave the company or delete your account.
• Portage account: if your umbrella company uses it, CraFlow keeps your account: payments from your clients, management fees, salaries and amounts paid out, reimbursed expenses, paid leave, your payout requests and the payment method used. Only you, your company's account owners and its managers with access to the whole company see it. These lines are accounting records for your company: they stay with it if you leave.
• Freelance subscription: the purchase identifier (Google Play token, or transaction signed by Apple on iPhone) and its end date, to check your subscription. No bank data is received: payment is handled by Google Play or the App Store.
• Notifications: if you allow them, a technical identifier of your phone (Firebase Cloud Messaging token, which goes through Apple's notification service on iPhone) is saved to notify you (timesheet reminder, timesheet approved or rejected, request to approve). It is deleted when you sign out; you can turn notifications off in your phone settings.
• Diagnostics: if the app crashes, a technical report (device model, system version, installation identifier, error trace) is sent to Firebase Crashlytics to fix the problem. It does not contain the content of your timesheets.
• Security: open sessions (device, date) and, if you turn it on, two-factor authentication; an activity log keeps who approved, changed or deleted what in a company's space.

Who sees your data

Your company (its owners and managers, according to their rights) sees what concerns it: your timesheets, absences, expense reports, invoices, documents and, for portage, your account. The end client only sees the timesheet you have it sign and the invoices addressed to it. A freelancer without a company is the only one to see their data.

Use

This data is only used to provide the service (backup and sync, approval, generation of PDFs and invoices, access management). It is never sold nor used for advertising; the app contains no ads and no tracking. The craflow.fr website counts page views anonymously (page, day and referring site, LinkedIn for example), without cookies, without storing IP addresses or any identifier.

Services used

Google Firebase (sign-in, notifications, crash reports), Apple (« Sign in with Apple », purchases on iPhone), Google Play (purchases on Android), SUPER PDP (certified e-invoicing platform, when you connect it; public directory and validator). The help videos of the website are hosted on YouTube (no-cookie mode) and only load when you click them. To fill in a company's details or public holidays, CraFlow queries French public services (company register, public holiday calendar): only the search typed is sent to them.

Hosting and retention

The server and the data are hosted in France by OVHcloud. Data is kept as long as your account exists and deleted when the account is deleted, except the records the law requires your company to keep (invoices, portage accounts), which stay with it.

Your rights (GDPR)

You can access, correct or delete your data at any time. You can download a full copy from the app (Settings → Download my data) or your online space (Clients and profile → My data). Account deletion is available in the app (Settings → Delete my account) or on request at mouhamedhadi.hassine@gmail.com. You can also complain to the French data protection authority, the CNIL (www.cnil.fr).

Contact

mouhamedhadi.hassine@gmail.com