Privacy policy

Who controls your data

For the account you hold with us we are the data controller. For the records you create inside the product — your clients, staff and invoices — you are the controller and we act as your processor, under a data processing agreement that forms part of these terms.

What we collect

The account details you give us, the records you create in the product, and technical logs needed to run and secure it: IP address, browser, and the time of each request.

Why, and on what legal basis

To perform the contract you entered into with us (providing and billing the service), to meet legal obligations such as retaining invoices, and on the basis of our legitimate interest in keeping the service secure and free of abuse. We do not sell data and we do not use your records for advertising.

Who else can see it

Our hosting provider and, once contracted, our email delivery provider. Each is bound by a processing agreement and may only act on our instructions. We publish the current list on request.

Where it lives

On servers inside the European Union. We do not transfer personal data outside the EEA. If that ever changes we will say so here before it happens, and rely on an adequacy decision or standard contractual clauses.

How long we keep it

For as long as your account is open, and after closure only where the law requires it — invoicing records for the statutory retention period. Technical logs are kept for 90 days. Everything else is deleted within 30 days of closure.

Your rights

You may access, correct, export, restrict or erase your data, and object to processing based on legitimate interest. Export and account closure are both self-service in the product, so you never have to ask us for them.

Cookies

We set two cookies: one to keep you signed in and one to protect forms against cross-site request forgery. Both are strictly necessary, neither tracks you, and there is no analytics or advertising cookie to consent to.

Automated decisions

We do not make decisions about you by automated means that produce legal effects or similarly significant effects.

Changes to this policy

If we change how we handle personal data we will update this page and tell account owners by email before the change takes effect.

If you think we have got it wrong

Tell us first and we will look into it. You also have the right to lodge a complaint with a supervisory authority — ours is Gegevensbeschermingsautoriteit (Belgian DPA).

Contact

Questions about this document, your account or your data go to the address above. We answer within five working days.