Privacy policy
Which personal data FinSuite processes, why and on what legal basis, who receives it, how long it is kept and your rights under the GDPR.
1. Controller and contact
The controller of personal data under Regulation (EU) 2016/679 (GDPR) and Slovak Act No. 18/2018 Coll. is:
- Company name: INTERFASE s. r. o.
- Registered office: Doležalova 3424/15C, 821 04 Bratislava
- Company ID (IČO): 57075891
- Tax ID (DIČ): 2122563806
- VAT ID (IČ DPH): SK2122563806
- Registration: Commercial Register of the Bratislava III Municipal Court, section Sro, insert No. 189754/B
- E-mail (general and legal matters, data protection): [email protected]
- Customer support: [email protected]
For data protection matters, write to [email protected] or by post to the registered office.
2. When we are controller and when processor
We are the controller of data about users and their accounts, subscription payers and website visitors.
For the documents, statements and other data a company (customer) uploads, the customer is the controller and we process them on its behalf as a processor under the annex to the Terms of service. If you are a supplier or business partner of one of our customers, please address requests primarily to that customer.
3. What we process
- Account: name, e-mail, chosen language and notification settings; when signing in with Google or Microsoft, also the account identifier and verified e-mail from that provider. We neither use nor store passwords.
- Company and team: the company’s name, company ID, tax and VAT IDs and address (completed from public registers — the Slovak Register of Financial Statements and Register of Legal Entities, ARES in Czechia), roles, invitations and access requests.
- Documents and statements you upload and their contents — they may contain personal data of your business partners (for example a sole trader’s name, an account number, a payment message).
- Credentials for your connected software (API keys, tokens, sign-in details) — stored encrypted.
- Subscription (once introduced for a company): payer details (name, company ID, tax and VAT IDs, address, invoice e-mail), the result of the VIES VAT ID check, identifiers at the payment provider, invoices. We do not process card details — you enter them directly with the payment provider.
- Activity log: who did what in a company and when; for sign-ins, the method, time and IP address.
- Technical data: IP address, time and type of request in server logs; strictly necessary cookies (see the Cookie policy).
- Communication: e-mails you send us, for example to support.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Account, sign-in and providing the service (reading documents, saving to software, matching payments, team) | contract — Art. 6(1)(b) |
| Service e-mails (sign-in codes, invitations, notices and digests per your settings, notices of changes) | contract — Art. 6(1)(b) |
| Subscription and payments, issuing invoices | contract — Art. 6(1)(b); accounting and tax obligations — Art. 6(1)(c) |
| Security, abuse prevention, activity log, limiting sign-in attempts | legitimate interest — Art. 6(1)(f) |
| One trial per company (we keep a hash of country and company ID, for companies without one a hash of the e-mail) | legitimate interest — Art. 6(1)(f) |
| Establishing and defending legal claims | legitimate interest — Art. 6(1)(f) |
| Documents and statements uploaded by the customer | processed on the customer’s behalf as processor (Art. 28) |
We do not sell data or use it for advertising or profiling. AI reading of documents is not automated decision-making with legal effects — you decide on every save.
5. Recipients and processors
- Hosting provider — the servers the service and its backups run on.
- OpenRouter, Inc. (USA) — routes AI reading of documents to Google’s Gemini model. We send the document’s content (for PDF statements only their text), never the credentials of your software.
- Websupport s. r. o. (Slovakia) — e-mail service provider; sends service e-mails, and documents to your KROS Digitálna kancelária address if you entered one when connecting.
- Stripe — processes subscription payments once a subscription is introduced for the company.
- Google and Microsoft — if you sign in with them; they receive only what sign-in requires.
- The vendor of your connected software — on your instruction we hand over the expenses, attachments and payments to be saved there.
- Public registers (Slovak Register of Financial Statements, Register of Legal Entities, ARES) and the European Commission’s VIES system — queried by company ID, company name or VAT ID.
- Public authorities — only where the law requires it.
Authorised staff of the operator also have access, only as needed for operation and support, and bound by confidentiality.
6. Transfers outside the European Union
AI reading of documents involves a transfer to the USA (OpenRouter, Google). Such a transfer takes place only on the basis of appropriate safeguards under Art. 46 GDPR.
Every document-reading request asks the provider neither to store the data nor to use it for training models (the “data_collection: deny” setting on every request).
7. How long we keep data
- Account, company, documents, statements and connection: while the account or company exists. Once deleted, they are removed from the app at once and from backups within 30 days.
- Activity log: while the company exists; when an account or company is deleted, its personal content is removed and only the fact that an event happened remains.
- Server logs: at most 90 days.
- Failed queue jobs (for example an unsent e-mail, content encrypted): 7 days.
- Payment provider events (containing the payer’s name, e-mail and address): 90 days.
- Subscription invoices and accounting records: for as long as accounting and tax law requires.
- Hash of country and company ID (or e-mail) used to limit trials: also after the company is deleted, so the trial is not granted again.
- A company in read-only mode: deleted after 12 months (with warnings 30 and 7 days before).
8. Security
All traffic is encrypted (HTTPS). Software credentials and the content of e-mails waiting to be sent are stored encrypted. Sign-in codes are valid for 10 minutes and are stored only in a form from which the code cannot be recovered. Each company’s data is kept separate and access follows team roles. Data is backed up regularly and restores are tested.
9. Your rights
You have the right to access your data, to rectification and erasure, to restriction of processing, to data portability and to object to processing based on legitimate interest. Most of this you can do directly in the app — view, correct and export your data and close your account.
Send other requests to [email protected]. We handle them without undue delay and within one month at the latest; where justified, we may extend this period as the GDPR allows.
10. Complaints
If you believe our processing infringes the law, you can lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk.
11. Changes to this policy
We update this policy when the processing or the processors change. We announce material changes to users by e-mail in advance.