Privacy Policy

Last updated: June 2026

At CoreFlow Solution, we value your privacy and are committed to protecting your personal and business financial data. This Privacy Policy explains how we collect, use, store, and secure your information when you use our SaaS applications (NexusCore and AuditCore) and our professional advisory services.

1. Data We Collect and Process

We collect and process the following categories of data in order to provide our services:

  • Account Information: Name, professional email address, phone number, and password created during registration.
  • Business Identity: Legal business name, physical address, registration number, and tax/VAT registration details.
  • Financial and Transactional Records: Ledger entries, invoices, bills, chart of accounts, bank statements, and transactions uploaded to the platform.
  • Payroll and Talent Records: Employee details, salaries, allowances, attendance logs, and payroll structures managed under our TalentCore module.
  • Billing Document Uploads: Digital uploads of receipts, vendor bills, and financial documents processed using our automated Orion AI OCR.

2. Data Collection and Security of Financial Records

We implement industry-standard security protocols to guarantee the absolute confidentiality of your financial and payroll records:

  • Data Isolation: Strict tenant-level data isolation keeps every company's records completely separated from other users, preventing any cross-tenant data leaks.
  • Access Control: We support granular Role-Based Access Control (RBAC). You control exactly which team members, managers, or external auditors have read, write, or approval access to specific modules.
  • Encryption: All data is encrypted in transit using Transport Layer Security (TLS 1.3) and at rest using Advanced Encryption Standard (AES-256). Backups are also securely encrypted and stored in redundant, high-security data centers.

3. Orion AI OCR Uploads and Third-Party Disclosures

Our platform includes the **Orion AI** assistant and automated document scanning feature to extract billing details from invoices and receipts. Please note the following regarding AI document processing:

  • Processing Mechanism: When you upload a document for OCR extraction or ask a question to the Orion AI assistant, the document or query content is securely transmitted to and processed by industry-leading third-party AI model providers (such as OpenAI, Anthropic, or Google Gemini).
  • Model Terms: These third-party model providers process the data strictly in accordance with their respective API data privacy policies. This means your data is processed through secure, private API channels and is not used to train public machine learning models. Their specific data retention and terms of service apply to these transient processing requests.
  • Temporary Storage: Uploaded documents are stored securely in your private cloud storage bucket. Temporary files used during extraction are automatically and securely deleted immediately after processing.

4. Sharing of Information

We do not sell, rent, or trade your data to third parties. We only share information with third-party service providers (such as hosting providers, email delivery systems, and the AI model providers mentioned above) who are contractually obligated to protect your data and use it solely to perform services on our behalf.

5. Compliance and Governing Law

We operate in compliance with the data protection regulations of Pakistan and relevant international standards for SaaS application hosting. Any dispute or claim arising under this Privacy Policy will be governed by the laws of Pakistan.

6. Your Rights

You retain full ownership of all data uploaded to CoreFlow. You have the right to export your entire ledger, transaction history, and payroll logs at any time. Upon account termination, you may request the permanent deletion of all your company data, which we will execute within 30 days of the request.

7. Contact Us

For any questions or concerns about our privacy practices, please visit our Contact Us page.