Privacy

What we hold, and whose it is

We hold extracts of your accounting: the chart of accounts, your customers and suppliers, the entries and their lines, and the documents you attach. Those contain personal data — names of contacts, sole traders, sometimes employees. You are the controller and we are the processor. We do not decide what is in your ledger and we never write anything back into your system.

We also hold the name and e-mail address of the people who sign in. We do not store IP addresses — only a hash of them with a secret salt, used to limit abuse.

Where it lives

In the EU. That is not a preference: the regulation this service exists for requires the backup to be on a server in an EU or EEA country, and the region is shown on the Backups screen so you can state it rather than take our word for it.

Who else sees it

• Cloudflare (US/EU) — runs the application.
• Supabase (EU) — database and file storage.
• Sendinblue SAS, 9-17 rue Salneuve, 75017 Paris (Brevo) — sends the e-mail.
• PostHog EU (Germany) — usage statistics, with nothing from your accounting in them.

Transfers outside the EEA rely on the European Commission's standard contractual clauses. This list is part of the data processing agreement and changes to it are dated.

What we do not do

We do not send your accounting to a language model — there is no language model in this product at all. We do not attach a document to an invoice unless you marked it to be shared. We do not file anything with a Danish authority on your behalf.

How long

Accounting material is kept for five years from the end of the financial year it relates to, because that is what the Bookkeeping Act requires of you and this copy exists to satisfy it. When you leave, your data is deleted within 30 days unless you ask in writing for an archive to be kept, and the deletion is recorded.

If something goes wrong

We tell you within 24 hours of discovering a breach — before the 72 hours the GDPR gives you to notify Datatilsynet, because the clock is yours and you cannot start it until we speak.

Complaints

The supervisory authority is Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby.