Privacy policy

Last updated: Oct. 12, 2026

1. Data controller

The controller of your account data is the service publisher. For the financial data you import (bank statements, invoices), you are the controller and we act as processor within the meaning of article 28 of the GDPR; the terms of this processing are set out in our Data Processing Agreement.

2. Data we process

• Account data: email address, name and profile photo provided by Google at sign-in, chosen language.
• Imported data: the rows of the CSV files you submit (dates, amounts, bank descriptions, counterparty or supplier names, references, invoice numbers).
• Messages sent through the contact form: name, email address and message content, kept for as long as needed to handle your request.
• Usage and technical data: reconciliations created, credits used, technical logs and IP address for security purposes.
• Billing data: handled by Stripe; we only keep the customer ID, the plan and the subscription status, never your card number.

3. Purposes and legal bases

• Provide the service and manage your account and subscription (performance of the contract).
• Ensure security, prevent abuse and fix defects (legitimate interest).
• Comply with our legal, accounting and tax obligations (legal obligation).

Your files are not used to train artificial intelligence models and are never sent to a third-party AI service.

4. Recipients and processors

• Render Services, Inc. — hosting of the application and the database (Frankfurt data center, European Union).
• Stripe — subscription payments.
• Google — authentication (sign-in with Google).
• Cloudflare, Inc. — private storage of database backups (Cloudflare R2).

These providers only access the data to deliver their service. Where a transfer outside the European Union takes place, it is covered by appropriate safeguards (standard contractual clauses or the EU–US data protection framework).

5. Retention period

Account data is kept as long as your account is active. Imported data is kept until you delete the reconciliation concerned, which you can do at any time in one click; deletion erases the reconciliation, its files, its results and its reports. You can also request the deletion of your account. Billing data is kept for the applicable legal periods.

Deleted data may remain in our daily backups for up to 30 days at most, after which it is permanently erased.

6. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability of your data. To exercise them, use the Contact page. You may also lodge a complaint with the supervisory authority of your country (in France: the CNIL, www.cnil.fr).

7. Cookies

We only use cookies strictly necessary for the service to work: sign-in session, protection against fraudulent requests (CSRF) and remembering your language. No advertising or tracking cookie is set; no consent is therefore required. The light/dark theme is stored locally in your browser.

8. Security

Exchanges are encrypted (HTTPS), data access is partitioned by account and passwords are never processed: authentication is delegated to Google. Despite these measures, no system is infallible; in the event of a data breach likely to create a risk to your rights, we will inform you within the legal deadlines.

9. Changes

This policy may change. The current version is the one published on this page, with its update date.