Privacy Policy

1. Data controller

OÜ OPSKAP SYSTEMS, registry code 17084604, Estonia, is the controller. Privacy contact: [email protected].

2. What we process

• Account data: name, email, country, account type.
• Business data you enter: companies, clients, people, invoices, documents, expenses — which may include your contacts’ personal data, for which you are the controller and we are processor.
• Files you upload to document storage.
• Technical data: authentication cookies and logs needed to run and secure the Service.
• Verification data, only if you use KYC/KYB, processed by our verification provider.

3. How we obtain data

We collect data directly from you, and we process data you upload about your own clients and team. For such third-party data we act as your processor (see DPA); the individuals should refer to your privacy notice (Art. 14 GDPR).

4. Purposes & legal bases

• Provide the Service and your account — contract (Art. 6(1)(b)).
• Security, fraud prevention, product improvement — legitimate interests (Art. 6(1)(f)).
• Billing and statutory accounting/tax records — legal obligation (Art. 6(1)(c)).
• Identity verification (KYC/KYB), where applicable — legal obligation / legitimate interest.
• Product or marketing emails — your consent (Art. 6(1)(a)) or legitimate interest for existing customers; opt out anytime.

5. Sub-processors & international transfers

We use providers acting on our behalf under data processing agreements:

• Supabase — Database, authentication, file storage (EU region).
• Resend (USA) — Transactional & invoice email delivery.
• Stripe (USA/Ireland) — Subscription billing (if enabled).
• Sumsub (UK/EU) — KYC/KYB identity verification (if enabled).
• DigitalOcean (USA/EU) — Application hosting.
• Crisp (France/EU) — Live-chat support widget & shared inbox.
• Microsoft Clarity (USA) — Session replay & heatmap analytics — only with cookie consent.
• PostHog (EU) — Product usage analytics — only with cookie consent.
• Sentry (USA) — Error monitoring & crash reporting (no advertising tracking).

Transfers outside the EEA are safeguarded by an EU adequacy decision, the EU Standard Contractual Clauses, or the UK IDTA, as applicable. A copy of safeguards is available on request.

6. Cookies

We use only strictly necessary cookies for authentication and security — no advertising or tracking cookies. See the Cookie Policy.

7. Retention

We keep data while your account is active. After deletion we delete or anonymise personal data within 30 days, except:

• invoicing and accounting source documents, kept 7 years as required by the Estonian Accounting Act (Raamatupidamise seadus);
• limited records needed to meet legal obligations or to establish, exercise or defend legal claims.

8. Automated decision-making

We do not make decisions producing legal or similarly significant effects based solely on automated processing. KYC/KYB checks, where used, involve human review before any adverse decision.

9. Your rights

You have the right to access, rectify, erase, restrict and object to processing, to data portability, and to withdraw consent at any time. You can export your data and delete your account in Settings → Privacy & data, or contact [email protected]. We respond within one month. You may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, www.aki.ee.

10. Security

We apply appropriate technical and organisational measures: row-level security, encryption in transit, access controls, private file storage. We notify you and the authority of a breach where legally required.

11. Children

The Service is for business use by adults and not directed at children. We do not knowingly process data of children under 16 (under 13 in Estonia for information-society services).

12. Data Protection Officer

We have not appointed a statutory DPO as we are not required to. For privacy matters, contact [email protected].

13. Changes

We may update this policy; the latest version is always on our website with an updated date.