Privacy policy

The controller of the personal data of the service's users and of visitors to its public pages is the operator named above. Data users enter about their business partners is processed by the operator as a processor under the data processing agreement; its controller is the account that entered it.

• Sign-up and sign-in data: name, e-mail and the identifier at the sign-in provider.
• Memberships of accounts and roles, the application's language and theme, two-step sign-in settings (the secret encrypted, recovery codes only as hashes).
• The audit log: who issued, changed or sent what in an account, and when.
• Technical records: IP address, browser and errors, for security and operation.
• The country of seat or residence you give when you create an account, and the country of the IP address you create it from.
• When you buy a plan: the payer's details (name or company, address, tax numbers, billing e-mail), orders, payments and withdrawals, and your consents and declarations (the terms, electronic tax documents, the buyer's declaration, the request to start now) with their time, version, language and IP address.
• Our correspondence with you, messages of the Write to us form included.
• When you report content: what you give in the form (your name and e-mail, if you fill them in), the notice and our decision.
• On the public pages, visit statistics, and in the application, the steps of the getting-started guide, both only if you agree to measuring, and the record of your choice about measuring.

We tell the country of an IP address by the IP to Country Lite database, licensed under Creative Commons Attribution 4.0 International (CC BY 4.0) by DB-IP.

• Providing the service under the terms, selling plans and their payment included: performance of a contract, Article 6(1)(b) GDPR.
• Security, the audit log and preventing misuse: legitimate interest, Article 6(1)(f) GDPR.
• Legal obligations such as keeping documents or complying with the European Union's financial sanctions: Article 6(1)(c) GDPR.
• Proving the order's consents and declarations and your choice about measuring, and handling notices of content under the Digital Services Act: legal obligation, Article 6(1)(c) GDPR.
• Screening business accounts against the US Consolidated Screening List, so that we offer AI functions only where the AI provider's terms allow them: legitimate interest, Article 6(1)(f) GDPR. A hit closes only AI extraction of documents; the rest of the service keeps working.
• Measuring visits: consent, Article 6(1)(a) GDPR, which you may withdraw at any time.

• The account's data, the audit log, orders, withdrawals, the order's consents and declarations and the messages of the Write to us form included: until the account is erased, 30 days after it is closed or, for an archived account, after the end of the tenth calendar year following its latest issued document or recorded expense.
• E-mails in the account's sending queue: while the account is open; they are deleted when it closes.
• Data about a person (name, e-mail, the identifier at the sign-in provider, language, theme and two-step sign-in): while the person exists in the service.
• The tax documents we issue to you for the service: ten years from the end of their year of issue (section 35 of the Czech VAT act, 235/2004 Coll.).
• The record of your choice about measuring: three years from the choice.
• Notices of content and the decisions on them: three years from the decision, or from the lifting of the restriction it placed; while a restriction stands, its notice is kept whole; an undecided notice three years from receipt.
• Technical records: 30 days. Database backups: 7 days. Previous versions of files: 30 days from when that version was written, deleted files 7 days.

The country of seat or residence and the country of the IP address are kept with the account and erased with it: 30 days after it is closed or, for an archived account, after the end of the tenth calendar year following its latest issued document or recorded expense. The results of the sanctions screening (when the account was screened, against which version of the list and with what result) are our own records, kept ten years from each screening, also after the account is erased. The same holds for the record of a business account's hit on the US list: it is kept ten years, also after the account is erased.

Documents you have read by AI are sent to Anthropic, which processes them only to read them and, under its commercial terms, does not use them to train its models. It keeps them only for the time its commercial terms allow. Anthropic may keep them for its safety reviews.

We never sell data. The service runs on these processors:

We check companies and taxpayers in public registers: ARES (Czech Ministry of Finance), the Register of Legal Entities (Statistical Office of the Slovak Republic), VIES (European Commission) and the register of unreliable VAT payers (Czech Financial Administration). Exchange rates come from the Czech National Bank and the European Central Bank. These institutions are not our processors; we send them only the identification numbers we ask about.

Payments for plans are processed, as independent controllers, by Stripe Payments Europe, Limited (Ireland) and, for consumers outside the European Union, by Sold through Link, LLC (USA), which sells them the service as the merchant of record under Stripe Managed Payments. You give your card details to them directly; we never see them. Their own privacy policies describe how they handle the data.

The service's data and its backups are stored in Microsoft Azure, region West Europe (the Netherlands); geo-redundant backups in North Europe (Ireland). Should a processor transfer data outside the EU, it does so under an adequacy decision of the European Commission or standard contractual clauses.

Documents for AI extraction are processed by Anthropic Ireland, Limited, which passes them to its parent company Anthropic, PBC in the USA. Anthropic, PBC is not certified under the EU-US Data Privacy Framework; the transfer rests on the safeguards agreed between the two companies.

Microsoft and Stripe transfer data to the USA under the EU-US Data Privacy Framework, under which they are certified. Google Analytics transfers data to the USA only if you agree to measuring.

You have the right to access your data, to have it corrected or erased, to restrict its processing and to take it elsewhere, to object to processing based on legitimate interest and to withdraw consent at any time.

• Export: the owner and the accountant download all of the account's data as one file on the Data and security page.
• Correction: your name and e-mail come from the account you sign in with; change them there. The account's data is corrected by its owner or a member who may write.
• Erasure: the owner closes the account; the owner also removes a member from it.
• You withdraw your consent to measuring with the Measuring settings link in the footer.
• Send any other request through the contact page or from the application (Help, then Write to us). We answer within one month and verify who you are by the account you write from or the e-mail we hold for you.

If a request concerns data one of our users entered about you, for instance as their customer, that user is the controller; turn to them, and we help them handle it.

The contacts are on the page Contact.

You may complain to the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7.

The application sets only the cookies it needs to work: one that keeps you signed in (at most 14 days from your last visit), and two short-lived ones while you sign in that protect the round trip to the sign-in provider. Your browser's local storage remembers the theme, the language, whether the side menu is open, the view of the documents list and the hints you closed, your choice about measuring and a random identifier of that choice. None of this needs consent.

We measure with Google Analytics only while measuring is switched on; only then does the consent banner appear, on the public pages and in the application, one choice for both. It offers Accept all, Reject all and Settings with equal weight, and nothing in it is ticked in advance. Google Analytics and its cookies load only after you agree.

In the application, after your consent, we measure only how far people get in the getting-started guide: one event per step, naming the step and whether it was done or skipped. The application sends Google a fixed address and page title, never its own addresses, page titles or where you came from, never your account's or documents' names or identifiers, and nothing you enter. Page views in the application are not measured. On the public pages we measure each page shown with its address and title; an address of the application you came from is replaced by the site's address. Nothing is measured from the pages a document, quote, client portal or withdrawal link opens.

We record each choice: a random identifier kept in your browser, the banner's version, your choice, the language, the time and the IP address cut to its network (/24, for IPv6 /48). We keep the record three years.

You change your choice or withdraw your consent at any time with the Measuring settings link in the footer of every public page, or in the application under Learn more in the profile menu; withdrawing stops the measuring and deletes its cookies.

We make no automated decisions about you and do not profile you. A person assesses notices of content.

The service is only for people aged 18 or older, who confirm it when creating an account and accepting an invitation. We do not knowingly process children's data; should we find that a person under 18 uses an account, we end their access.

How we protect the data is set out in the Security policy.

We may amend this policy; users are told of a material change by e-mail.