Privacy policy
Your bookkeeping is about the most personal thing you hand to a piece of software. Below is which data EasyFinance processes, why, who we bring in to help and what you can demand of us. No legal fog where a plain sentence will do.
1. Who processes your data
Easy Finance B.V. is the controller for the personal data processed through EasyFinance.
- Easy Finance B.V., Librijesteeg 121, 3011 HN Rotterdam
- KvK (Dutch Chamber of Commerce) number: 98400924
- Privacy questions: privacy@easyfinance.nl
Note the difference in roles. For your own account data we are the controller. For the data of your clients and suppliers that you put into EasyFinance, you are: we process it solely on your instructions.
2. What data we process
| Kind of data | What that is | What for |
|---|---|---|
| Account data | Name, email address, telephone number, language, password in encrypted form | To create your account and let you log in |
| Company data | Company name, KvK number, VAT number, address, logo | To make your invoices and your VAT return add up |
| Financial records | Invoices, expenses, receipts, clients, products, hours, journal entries, VAT positions | This is the service itself: keeping your books |
| Bank data | Account number, balance and transactions of the accounts you connect | To read in transactions and categorise them |
| Receipts and documents | The photo or the file you upload, and what has been read from it | To book an expense automatically |
| Usage data | Which screens you open, error reports, device and browser type | To track down faults and improve the app |
| Communication | Your messages to our support team and to the assistant | To be able to answer your question |
| Subscription and payment | Your plan. For direct debit: IBAN, account holder and mandate. For a subscription bought in the App Store: Apple's transaction number, the product, dates and price. Apple handles that payment itself; we never see your card or Apple Account details | To give you the plan you pay for, and to stop it when it ends |
Some of the data above goes to an AI service: your receipts, your question to the assistant, the description of your bank transactions and the files you ask us to analyse. What exactly goes there and to whom is set out in AI in EasyFinance.
We do not ask for data we need for none of these purposes, and we do not buy data about you from third parties.
3. On what legal basis
We process your data on the basis of article 6 GDPR, namely:
- Performance of the contract. Your account, your records, your receipts, your bank connection and your invoices. Without this processing there is no service.
- Legal obligation. Our own administration and the tax retention periods that come with it.
- Legitimate interest. Security, fraud prevention, fault tracing and improving the service. We weigh that interest against your privacy and keep the data to what is needed.
- Consent. For connecting a bank account, for the AI features in clause 5 and for any commercial email. You can withdraw consent at any time; that takes effect from the moment you withdraw it.
4. Your bank account
The bank connection runs through GoCardless (Bank Account Data), a party holding a PSD2 licence for reading account information. You give the consent at your own bank, not with us: we never see your bank login details.
The connection is read-only. EasyFinance can retrieve your balance and your transactions and can make no payments, move no money and change nothing in your banking environment. A connection expires after the term your bank applies and you can withdraw it in the app at any time.
5. AI in EasyFinance
Four parts of EasyFinance use an AI service run by another party. When they do, your data leaves our own environment. Below is which parts those are, what goes there and to whom.
| Part | What goes there | To whom |
|---|---|---|
| Scanning a receipt or invoice | The photo or the file you upload, in full. The supplier, the date, the amounts, the VAT and the line items of the document are read from it | OpenAI, through their API, using the models gpt-4o and gpt-4o-mini, on servers in the United States |
| The assistant | Your question, and the records from your books needed to answer it | AWS Bedrock, using the model Claude Sonnet 4.5 from Anthropic, in the Frankfurt region and therefore within the EU |
| Categorising bank transactions | The description and the amount of a single transaction. Not your account number and not your balance | OpenAI, through their API, using the model gpt-4o-mini, on servers in the United States |
| Analysing files you upload yourself | The files you pick in the app for analysis, so that an older set of books can be read in | AWS Bedrock, using a model from Anthropic (Claude), in the Frankfurt region and therefore within the EU |
Nothing else goes to an AI service. Connecting your bank, sending email and storing your files all happen without one. And we never send your password, your bank login details or your payment details along.
For scanning we switch off OpenAI's retention option, so the request does not stay behind in our OpenAI environment. Neither party uses what we send to their API to train their models; that is stated in their own terms for API use.
For all four we ask your permission first, the first time you use one of them. You can withdraw that permission later in the app's settings. Without it, scanning, the assistant and the analysis stay off, and we categorise your transactions with fixed rules instead of AI, which sends nothing to anyone else. The rest keeps working: entering expenses and invoices by hand is always available.
6. How long we keep it
- Your records: for as long as your account exists, and after that for as long as the tax retention obligation runs. For most bookkeeping data that is seven years, counted from the end of the financial year.
- Your account data: until you cancel your account, plus the period needed to settle the cancellation.
- Receipts and uploaded documents: the same regime as your records, because they are part of them.
- Error reports and usage data: ninety days at most.
- Support conversations: two years at most after the last message.
Once a period has run out we erase the data or make it irreversibly anonymous.
7. Your rights
Under the GDPR you have the right to:
- see your data;
- have incorrect data corrected;
- have your data erased, in so far as no retention obligation stands in the way;
- have the processing restricted;
- object to processing based on legitimate interest;
- take your data with you in a common file format;
- withdraw consent you have given.
You send a request to privacy@easyfinance.nl. We respond within a month. You can also export your records yourself from the app at any time.
You can also delete your account yourself, in the app under Settings, Delete account. That erases your account, your records, your uploaded files and your bank link straight away. It cannot be undone, so export anything you need to keep first.
If you disagree with how we handle your data, you can lodge a complaint with the Autoriteit Persoonsgegevens, the Dutch data protection authority. We would appreciate it if you came to us first.
8. Cookies
This website places no tracking or advertising cookies and uses no third-party analytics. That is why it does not ask you to click anything away either.
In the app itself we use only the storage needed to keep you logged in and to remember your preferences, such as your language.
9. Changes
If something material changes about what we do with your data, we amend this policy and let you know through the app or by email before the change takes effect. The top of this page states when the text was last changed.