Privacy Policy

1. Scope and roles

This policy covers personal data about the people who use the Service on behalf of a business: account owners, their representatives and staff. For this data we act as the controller.

When you upload documents and information so that we can perform accounting work (for example bank statements, invoices or payroll data), those materials may contain personal data about your own staff and customers. For that data we act as a processor on your instructions, and our handling of it is governed by our Data Processing Agreement and applicable law.

2. Personal data we collect

We collect:

• Account and profile data: your name, email address, an encrypted password, and business details such as company name, registry code, VAT number, address, job title and phone number;
• Billing data: your plan and subscription status. Payments are handled by Stripe; we do not receive or store your full card number;
• Data you provide for accounting work: the documents and information you upload so we can keep your books and make filings (see roles above);
• Verification data: the identity and business details you submit so that we can verify you and your company, information about beneficial owners, and the record of our review, including its outcome, the time of the decision, who made it and the notes they entered;
• Technical data: IP address, device and browser information, and log and usage data generated when you use the Service. This includes automatic diagnostic reports when something goes wrong - the error, the page it happened on and the technical state around it - which we use to find and fix faults;
• Product analytics data: a masked record of how you use the Service, such as clicks, scrolling, page views and the layout of the pages you see, used to produce heatmaps and session replays. Text is masked in your browser before anything is sent, so the names, amounts, bank details and documents you work with are never uploaded to the analytics provider; and
• Consent records: which legal documents you accepted, their version, and the date and IP address of acceptance.

3. How we use your data and our legal bases

We use personal data to:

• provide, operate and support the Service and perform the accounting work you subscribe to (legal basis: performance of a contract);
• meet our own legal obligations, for example under accounting law and, where applicable, anti-money-laundering law (legal basis: compliance with a legal obligation);
• secure the Service, prevent fraud and abuse, and improve and develop our product, including through the masked usage analytics described above (legal basis: our legitimate interests, balanced against your rights); and
• handle anything for which we ask for your consent (legal basis: consent, which you may withdraw at any time).

4. Records of consent

When you create an account, submitting the registration form confirms that you accept our Terms of Service, this Privacy Policy, our Data Processing Agreement and our Engagement Terms. We keep a record of that acceptance for each of the four documents, including which version you accepted, when, and the IP address the acceptance came from, as evidence that consent was given. When a document changes, its version label changes so that each record stays tied to the exact text accepted.

5. Sharing your data and our processors

We do not sell your personal data. We share it only with:

• service providers who process data on our behalf under written agreements: Stripe (payment processing), Supabase (database, authentication and file storage, including the documents you upload), Vercel (hosting, content delivery and file storage - Vercel Blob stores profile pictures and the documents the Service generates for you), Upstash (rate limiting and abuse prevention), Resend (transactional email such as verification messages) Microsoft (Clarity product analytics: masked heatmaps and session replays) and Sentry (error monitoring: the automatic diagnostic reports described above, processed in Sentry's EU region);
• public authorities, such as the Estonian Tax and Customs Board or the Business Register, where a filing or disclosure is required to provide the Service or to comply with the law; and
• professional advisers, or a successor entity, in connection with a reorganisation, in each case under confidentiality obligations.

6. International transfers

We host and process personal data within the European Union or European Economic Area where reasonably possible. Where a provider processes data outside the EEA, we rely on an adequacy decision or on appropriate safeguards such as the European Commission's standard contractual clauses.

7. How long we keep data

We keep account and profile data for as long as your account is active and for a reasonable period afterwards. Records the Service treats as accounting records - issued invoices, documents attached to them, and bank-statement transactions that have been reconciled or approved - cannot be deleted from the Service and are retained for the period required by Estonian law, which is generally seven years. A document you uploaded that is not attached to an issued invoice, and a bank statement whose imported transactions no one has reconciled or approved, can be deleted by you in the app; deletion permanently removes the file and, for a bank statement, the unverified transactions read from it. Verification data collected to meet know-your-customer and anti-money-laundering obligations is retained for the period those rules require, which is generally five years after the end of the business relationship. Consent records are kept as long as needed to evidence the consent. We delete or anonymise personal data when it is no longer needed for these purposes.

8. Your rights

Subject to the conditions in the GDPR, you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected and incomplete data completed;
• have your data erased, and to restrict or object to certain processing;
• receive your data in a portable format and, where technically feasible, have it transmitted to another controller; and
• withdraw any consent you have given, without affecting processing carried out before the withdrawal.

To exercise these rights, contact us at privacy@techaccounting.ee. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee).

9. Cookies and local storage

The Service uses cookies and similar browser storage that are necessary to sign you in, keep your session secure, and remember basic preferences. We do not use these to track you across other websites.

Our product analytics provider, Microsoft Clarity, runs in consent mode and is configured not to store analytics cookies. We do not ask you to accept analytics cookies because none are set: the masked usage data described in section 2 is collected without them, and you can object to that processing at any time using the contact details in section 12.

10. Security

We use technical and organisational measures to protect personal data, including encryption in transit, access controls, and rate limiting against abuse. No system is completely secure, but we work to protect your data and to respond promptly if a problem arises.

11. Changes to this policy

We may update this policy from time to time. When we do, we will publish the updated version with a new effective date and version label, and where the change is material we will take reasonable steps to notify you.

12. Contact

For any question about this policy or your personal data, contact privacy@techaccounting.ee, or write to Fintech Accounting OÜ, Maakri tn 19/1, 10145 Tallinn, Estonia. See also our Terms of Service.