# Privacy policy Last updated: 12.11.2026 This policy explains what personal data we process when you visit the public website of Oscar, joined its waitlist before the launch, or use the Oscar accounting service, on the website or in our iPhone app Oscar. It also explains what we do with the personal data in the books that we keep for our clients. On the public website and in the onboarding we use analytics, session recordings and advertising measurement only if you accept them in our cookie banner (section 3, "Analytics, only with your consent", "Session recordings, only with your consent" and "Advertising measurement with Google, only with your consent"). We use advertising measurement only to learn which of our ads on Google led to a sign-up. We use no remarketing and no personalised advertising, and we do not follow you to other websites. The rest of the accounting service and its iPhone app use no analytics and no session recordings in your browser or on your phone. Our servers record the steps of the sign-up and the onboarding as events with a random ID, with no name, no e-mail address and no content of your books (section 4, "The events of the sign-up and the onboarding"). ## 1. Who we are OscarAI OÜ is the controller of your personal data, except for the data in the books of our clients (section 2). We are an Estonian private limited company. - Registry code: 17608438 - Address: Narva mnt 7b, 10117 Tallinn, Estonia - E-mail: support@oscaraccountant.com "Oscar" is our brand name. In this policy, "we" and "us" mean OscarAI OÜ. A "client" is a company that uses the accounting service under a client agreement with us. ## 2. What this policy covers, and our role This policy covers: - a visitor of the public website, and a person on the waitlist (section 3) - a person who writes to our team, in the service, by e-mail or in the chat of the website, or who books a call with us (sections 3 and 4) - a user of the accounting service: a person who signs up, logs in, or works in the books of a client, including a person that a client invites, on the website or in the iPhone app (section 4) - a board member, a representative and a beneficial owner of a client or of a company that wants to become a client, whose identity we check (section 4) - a person whose data is in the books of a client, for example an employee, a supplier, a customer or another counterparty (section 5) We have two roles: - **We are the controller** of the data of the website and the waitlist, of the accounts of the service, and of our own relationship with each client. This includes the onboarding, the identity checks and the other checks that the Money Laundering and Terrorist Financing Prevention Act (rahapesu ja terrorismi rahastamise tõkestamise seadus, RahaPTS) requires, the client agreement, our invoices to the client, and the records that we keep to prove what we did for a client. - **We are the processor** of the personal data in the books of a client: the employees and the payroll, the counterparties, the invoices, the bank transactions and the other accounting records. The client is the controller of this data. We process it only on the client's instructions, under the data processing terms of the client agreement (GDPR Article 28). If your data is in the books of one of our clients, the privacy notice of that client applies to you, and you can contact the client first. ## 3. The public website and the waitlist The public website is the home page at `/`, the page to book a call at `/call`, the pages of this policy and of the terms of use, and, while we publish them, the developer docs at `/docs` and the file `/llms.txt`. ### Server logs When your browser requests a page, of the website or of the service, our servers receive technical data. This is true for every website. The data is: - your IP address - the date and time of the request - the requested URL - the user agent (the name and version of your browser and operating system) - the response status and size We use this data to deliver the pages, to keep the website and the service secure, to find errors and to stop abuse. ### Error reports When a page fails in your browser or on our servers, we send an error report to our error tracking provider. The report holds the error, the address of the page without its query string, and the name and version of your browser and operating system. We set it up so that a report holds no cookie, no form content, no request header and no name or e-mail address. We use the reports only to find and fix errors. When we switch on the crash reports of the iOS app, a report of the app holds the error, the version of the app, the model of the iPhone and its iOS version, and the steps in the app just before the error. It holds no name, no e-mail address, no screenshot and no content of your documents. ### Analytics, only with your consent We measure how visitors use the public pages and the onboarding, so that we can improve them. For this we use PostHog, in its EU region, and Google Analytics, of Google Ireland Limited (section 8). They run in your browser only if you accept "Analytics" in the cookie banner or in "Cookie settings". If you reject it, close the banner or make no choice, neither of them loads, and your browser sends them nothing. We show the banner only on the public pages and in the onboarding. Session recordings are a separate choice (below). PostHog runs only on the public pages (the home page, the content pages such as the guides and the tools, the developer docs, the page to book a call, and the pages to sign up and to log in) and in the onboarding. It never runs on the rest of the service, on the pages of an invitation, a password reset or an identity check, on the pages to move or cancel a call, or on the consent pages of a connected app. With your consent, PostHog records: - the pages that you open, as the pattern of the address with no query string and no identifier (for example `/:locale/guides/:topic/:question`), and the language of the page - the domain of the website that sent you to us, and the campaign tags of the link (`utm_source`, `utm_medium`, `utm_campaign`, `utm_content` and `utm_term`) when they are short codes - your clicks on a few marked buttons and links: the buttons to sign up, the main navigation and the language switch, by their name only - that you sent the sign-up form, with the language of the page, and which step of the onboarding you see - that you opened the booking of a call and that you booked a call, with the place (the page to book a call or the chat), and nothing about the call: no time, no name, no e-mail address and no topic - the type and version of your browser and operating system, the type and size of your screen, and random IDs that PostHog keeps in your browser for your browser and your visit PostHog records no text that you type, no name, no e-mail address, no amount, no data of a company, no full address of a page and no query string. Your browser sends the data to our own website (`/x`), and our server passes on only the data, never your cookies or your IP address. We switched off the location lookup of PostHog. When you sign up in a browser in which you accepted analytics, we link the visits that PostHog records in that browser to a random analytics ID of your account, not to your e-mail address or your name. Then we can see the visits together with the events of the sign-up and the onboarding (section 4). Google Analytics runs in your browser in the Google tag, a script of Google. The Google tag runs only on the home page and the other marketing pages, the content pages such as the guides and the tools, the page to sign up, and the onboarding, and only when the address of the page holds nothing but the code of an ad click or the name of a campaign. It never runs on the rest of the service, on the page to log in, in the developer docs, on the pages of an invitation, a password reset or an identity check, on the pages to move or cancel a call, or on the consent pages of a connected app. When you go to a page where it does not run, your browser loads that page anew, so the Google tag stops. With your consent to analytics, your browser sends Google directly, for Google Analytics: - the page that you open, as its general address with no data of your company, and the time - the code of the ad that you clicked and the name of the campaign, if you came from one of our ads - that you signed up, as a count with no amount - the address of the website that sent you to us - your IP address, the type and version of your browser and operating system, the language of your browser, and the size of your screen - random IDs that Google keeps in cookies on our website for your browser and your visit We send Google no name, no e-mail address, no phone number, no data of your company and no text that you type, and we do not link Google Analytics to your account. We switched off the features of Google Analytics that collect such data (user-provided data), Google signals, the detailed location and device data, and the data sharing of Google Analytics. Google states that Google Analytics uses the IP address of a user in the EU only to find the country and region, on servers in the EU, and then discards it without storing it. We use the data to see which pages, sources and campaigns bring visitors and sign-ups, so that we can improve the website. We do not use it for remarketing or personalised advertising, we build no audience from it, and we use it for no decision about you. We linked Google Analytics to our Google Ads account, with personalised advertising switched off. With this link, Google Analytics shows us the campaign and the ad group of each visit that came from one of our ads, and the clicks and the cost of our ads. Google Ads also shows us counts from Google Analytics, such as the time on our pages after an ad click. If you accept analytics but not advertising measurement, our Google tag tells Google that it may not use your data for advertising, and Google Analytics does not set or read the cookies of Google Ads. Google states that it then uses the code of your ad click only to measure the visits to our website. If you also accept advertising measurement, Google Ads can also receive the data of your visits from Google Analytics ("Advertising measurement with Google", below). We do not use the sign-ups that Google Analytics counts as conversions in Google Ads, and we share no audience with Google Ads. We keep a record of each choice in the cookie banner: a random ID of the record, the version of the banner, your choice for analytics, for session recordings and for advertising measurement, the time, and your account when you are logged in. We store no IP address and no browser with it. The record proves your consent. You can change your choice or withdraw your consent at any time with "Cookie settings" in the footer of the website or in the security settings of your account (section 11). When you withdraw it, or when you log out, we stop PostHog in that browser and delete its cookies and the data that it stored in your browser. When you withdraw it, we also delete the cookies of Google Analytics and load the page again, so that Google Analytics stops. When you withdraw only your consent to session recordings, PostHog stops the recording at once, and analytics continues. ### Session recordings, only with your consent If you accept "Session recordings" in the cookie banner or in "Cookie settings", PostHog records what you see and do on the public pages and in the onboarding: the pages, your clicks, your scrolling and the time between them. We watch the recordings to find the places where the website is difficult to use, and then we improve them. Session recordings need analytics, so you can accept them only together with analytics. If you accept only analytics, reject, close the banner or make no choice, PostHog records nothing, and the recording code does not load. A recording is not a video. It is a copy of the structure of the page, and your browser changes it before it sends it: - It hides every field that you fill in. Not even the length of what you type is sent. - On the pages to sign up and to log in and in the onboarding, it also hides all text except our own headings, labels and buttons. So it never shows the name or the registry code of your company, a board member, your answers about your business, your e-mail address, a name, an amount or an ID code. - It does not record your answers to questions with options (for example yes or no), your mouse movements, files, images that you add, the chat with our team, the payment form of Stripe, the identity check of Didit or any other embedded page. - It records no address of a page with its query string, no request to our servers, and no messages of your browser console. PostHog records only on the public pages and in the onboarding. It stops when you go to another part of the service, and it never records the rest of the service, other websites or other tabs. A recording holds a random ID of your browser and of your visit. When you sign up in a browser in which you accepted session recordings, we link the recordings of that browser to the random analytics ID of your account (as for analytics, above), not to your e-mail address or your name. We keep a recording for 30 days, then PostHog deletes it. Only our own staff who improve the website can watch the recordings. We use them for no decision about you, for no check under RahaPTS and for no advertising. ### Advertising measurement with Google, only with your consent We advertise Oscar on Google Search. To learn which of our ads led to a sign-up, we use Google Ads, of Google Ireland Limited (section 8, "Google Ads, a separate controller"). The Google tag sends data to Google Ads only if you accept "Advertising measurement" in the cookie banner or in "Cookie settings". If you reject it, close the banner or make no choice, the Google tag sends Google Ads nothing, and it does not load at all unless you accept analytics (above). If you accept only analytics, the Google tag tells Google that it may not use your data for advertising (above). The Google tag runs only on the pages that "Analytics, only with your consent" names (above), and it stops in the same way when you go to another page. With your consent, your browser sends Google directly, for Google Ads: - the page that you open, as its general address with no data of your company, and the time - the code of the ad that you clicked and the name of the campaign, if you came from one of our ads - that you signed up, as a count with no amount - the address of the website that sent you to us - your IP address, the type and version of your browser and operating system, the language of your browser, and the size of your screen - random IDs that Google keeps in cookies on our website for your browser and your visit We send Google no name, no e-mail address, no phone number, no data of your company and no text that you type. We switched off the features of Google Ads that collect such data (enhanced conversions and user-provided data). We use the data to count which ads and campaigns bring sign-ups, and to set our bids on Google. We do not use it for remarketing or personalised advertising, we build no audience from it, and we use it for no decision about you. If you accept both analytics and advertising measurement, Google Ads can also receive the data of your visits from Google Analytics, through the link that "Analytics, only with your consent" describes (above). Google Ads still counts each sign-up only from the Google tag, not again from Google Analytics. ### The waitlist For each person on the waitlist, we store: - your e-mail address - the date and time when you joined and gave your consent - the version of this policy that you saw We use this data only to tell you that Oscar launched and to invite you to become a client. We send you no other e-mail, no newsletter and no advertising, and we do not give your e-mail address to another company for its own use. The waitlist is closed: nobody can join it now. ### E-mails to us When you write to support@oscaraccountant.com, we receive your e-mail address, your name if you give it, and the content of your message. We use this data to answer you and to handle your request. Section 4, "Support", says how we handle these e-mails. ### The chat of the website The public website has a chat, "Ask our team", in which a visitor can write to our team. For the chat, this applies: - Before you send your first message, you agree to this policy, and a security check of our network provider Cloudflare (Turnstile) runs in your browser, to tell people from automated attacks. Your browser loads this check from Cloudflare. Our servers send Cloudflare the result of the check and your IP address, to confirm the result. - We store your messages, your name and your e-mail address if you give them (both are optional), when you agreed to this policy and the version that you saw, and when you last used the chat. - A cookie tells the chat that the conversation is yours (section 6). You cannot attach a file in the chat. - A person of our team answers. If you gave your e-mail address, we also send our reply to that address: at once when the chat is not open in your browser, and otherwise when you do not read the reply within 5 minutes. - If you log in to the service in the same browser, the conversation moves to your account. Section 4, "Support", says how we handle the messages, and section 10 says how long we keep them. ### Booking a call You can book a short video call with our team: on the page to book a call, in the chat of the website, and, if your company is a client, under "Messages" in the service. Our team can also book a call for you when you ask for one. For a booking, this applies: - On the website, you agree to this policy before you book, and the security check of Cloudflare (Turnstile) runs as for the chat (above). In the service, the booking uses the name and the e-mail address of your account. - We store your name, your e-mail address, the name and the registry code of your company if you give them (both are optional), the topic if you give one (optional), the time of the call, your time zone, the language of the e-mails, where you booked, and when you agreed to this policy and the version that you saw. If the call is cancelled, we store when, who cancelled it, and the reason if you give one (optional). - On the website, we also store your name and your e-mail address as for the chat, and set the cookie of the chat (section 6). - We use this data to hold the call and to send you e-mails: the confirmation, a reminder 24 hours before the call if you booked earlier than that, a reminder 1 hour before the call, and an e-mail when the call moves or is cancelled. The confirmation and the e-mails of a change hold the invitation as an `.ics` file. Each e-mail holds the link of the call and links to move or cancel it. Do not forward them: a person with these links can change the call. - The booking opens a support conversation, or joins your open one, and we show the booking, the changes and the reason of a cancel there (section 4, "Support"). You can answer an e-mail of the booking to write to us. - We write the call into our Google Calendar, with your name or the name of your company, your e-mail address and the topic. Google Meet makes the link of the call. You are not a Google attendee: we send the invitation ourselves. Anyone with the link of the call can join it, so do not share it. - A person of our team holds the call. The calls are in English. We do not record the calls. ### Data we do not collect on the website - We use no analytics and no session recordings unless you accept them (above). - We use no advertising measurement unless you accept it (above), and we use no remarketing, no personalised advertising, and no advertising pixels of other companies, such as Meta or LinkedIn. - The home page loads no content from third parties. It has no embedded videos, maps or social media widgets. The security check of the chat and of the booking of a call, and the Google tag if you accept analytics or advertising measurement, are the only exceptions (above). - Our fonts are part of our own website. Your browser does not request them from Google or from another font service. - The forms of the public website are the sign-up form and the log-in form of the service (section 4), the chat and the booking of a call (above). ## 4. The accounting service: the data we control ### Your account When you sign up, or when a client invites you, we store your e-mail address, your name, your password in a form that cannot be read back (a hash), and, if you switch it on, your second factor (TOTP) and its recovery codes. If you sign in with Google, Google gives us your name, your e-mail address and the ID of your Google account. We also store which companies you can use and with which role, the invitations that you send and receive, the versions of the terms and of this policy that you accepted, and when. ### Security and access logs We log the sign-ins, the sign-outs, the failed sign-ins, the password resets and the changes of the second factor, with the time, the user and the IP address. We log the changes of access (memberships, roles, API keys, connected apps), every access of our staff to a client company, and the actions that change the books or that file a return for a client, with who did them and when. You can see and end your own sessions, with their browser and IP address. ### AI assistants and other apps that you connect You can connect an AI assistant, for example Claude or ChatGPT, or another app to the service through our MCP server (Model Context Protocol, at `https://oscaraccountant.com/mcp`) or through our API. On the consent page you choose the one organization that the app can reach, and you see whether it asks to read only or to read and write. When you approve, we store the name of the app, its app ID (`client_id`), the address that it sends you back to, the organization and the permissions that you approved, and when. We store its access tokens and refresh tokens only as a hash. For each request of a connected app, our MCP server logs the time, the IP address, the app, the user, the organization, the path and the result. It never logs a token, and it does not log the content of a request or of an answer. The actions of the app that change the books are in the security and access logs (above), as for every other user. The app can read and change only what your role and the permissions of the connection allow, and we send the data that the app asks for only to that app. We do not receive your conversations with the assistant. The provider of the assistant processes them, and the data that the assistant reads from Oscar, under your own agreement with that provider (section 8). You can see each connected app, and revoke it, under "Connected apps" in the security settings of your account. A change of your password or of your second factor revokes every connection. ### The iOS app You can also use the service in our iPhone app, Oscar. In the app you can only sign in. We set up your account when your company becomes a client, and you sign up, finish the onboarding and manage the billing on the website. The app uses no analytics, no advertising and no tracking. It processes the data of your account and of the books as this section and section 5 describe, and also: - **Sign-in.** The app keeps the key of your session in the keychain of your iPhone, so that you stay signed in. A session of the app ends when you sign out, when you change your password, or after 90 days without use. You can see and end it with your other sessions. - **Scans, photos and files.** When you scan a document, the app makes a PDF of the pictures on your iPhone. When you choose a photo, the app reads only that photo, not the rest of your photo library. The app sends the PDF or the file to the books of your company, and our automatic reading of invoices reads it (section 8, "The AI features"). - **Sharing to Oscar.** You can share a PDF or a picture from another app, for example Mail, Files or Photos, to Oscar. The app sends only the files that you share. - **The upload queue.** A document waits on your iPhone until the app has sent it, for example while you have no network. After the upload, the app deletes its copy on the phone. When you sign out, the app deletes the documents that it has not sent yet, and the data of your account and of the website that it keeps on the phone. - **Face ID.** You can lock the app with Face ID, Touch ID or the passcode of your iPhone. iOS checks your face or your fingerprint on the phone. We never receive your face, your fingerprint or the result of the check. The lock is off until you turn it on. - **Notifications.** If you allow notifications on your iPhone, iOS gives the app a device token: a random code with which Apple delivers a notification to the app. The app sends us the token, the version of the app and its language, and we store them with your account. We can notify you of a new message from your accountant, of the payments that still need a receipt, of a new request of your accountant, and of a bank connection that ends or has ended. We switch these notifications on step by step, so you may not receive them yet. A notification shows no amount and no name of a customer or a supplier. If you use more than one company, it shows the name of the company. The Apple Push Notification service delivers it (section 8). A notification never replaces an e-mail of ours. You can turn each kind off in the settings of the app, and every notification in the settings of your iPhone. We log that we sent a notification, its kind and its company, but not its text. - **Crash reports.** When we switch them on, the app sends a report to our error tracking provider when it fails (section 3, "Error reports"). The data that the app keeps on your iPhone is strictly necessary for the service that you request, as the storage of section 6 is. ### The events of the sign-up and the onboarding Our servers send PostHog (section 8) an event when you reach a step of the sign-up and the onboarding, and when your company becomes a client and pays. The events are: your account was made, you confirmed your e-mail address, you finished a step of the onboarding, you confirmed your company, your identity check started, was sent and was decided, you accepted the client agreement, you chose a plan, you saved a card, your company was ready for our review, we approved or refused it, the move of your books was sent and done, the service started, and our first invoice was paid. Each event holds the random analytics ID of your account, the time, and at most one or two plain values: the language at the sign-up, the name of the step, the result of the identity check (approved or rejected, nothing else), the plan, whether a promotion code was used, and whether the books come from Merit or from other software. An event never holds your e-mail address, your name, your personal identification code, a phone number, a bank account, the name or the registry code of your company, an amount, data of your books or invoices, or any content or result of the identity check beyond "approved" or "rejected". We send no events for our own staff, or for a company that our firm set up. The events link to your visits of the website only if you accepted analytics in the browser in which you signed up (section 3). We use these events to see where people stop in the sign-up and the onboarding, so that we can improve them. You can object to them at any time (section 11). ### The onboarding and the identity checks The law requires us to know our clients before we serve them, and to keep checking them while we serve them (RahaPTS § 20). For a company that wants to become a client, we process: - the data of the company from the Estonian Business Register: its name, registry code, address, activity, board members, shareholders and beneficial owners - the answers to our questionnaire: for example the activity of the company, its website, its countries, its customers and suppliers, the source of its money, and whether a person is a politically exposed person (PEP) - the website of the company, and a short summary of it, which our website reading provider makes from the public pages of the site (section 8) - for each representative and board member: the result of an identity check. Our identity verification provider asks you to sign in with Smart-ID or Mobile-ID, to take a photo of your identity document and to take a short video of your face. We receive your name, your date of birth, your personal identification code, your citizenship, the data and the photos of your document, the photos of your face, the results of the liveness check and the face match, the check of your device and IP address, and the result of the screening against sanctions, PEP and adverse media lists, with the ongoing monitoring of that screening - for a beneficial owner who is not a board member: the same identity check, or a copy of an identity document - for each board member and beneficial owner: the result of the adverse media check, a search of the public web with the name of the person, the name of the company and fixed words about fraud, money laundering, sanctions, court cases and bankruptcy (section 8, "The AI features") - the risk score of the client, the checks of our staff, their decisions and the reasons, and our correspondence about these checks We also screen the counterparties in the books of a client against the sanctions lists, and we review the activity in the books to meet our duty of ongoing monitoring (RahaPTS § 20 (1)). For this purpose we use the books as a controller, only for these checks, and never for marketing (RahaPTS § 48). ### The client agreement and billing We store the client agreement in the version and the language that the client accepted, the data of the person who accepted it (the name, the personal identification code, the time, the IP address and the browser), the plan, and our invoices and payments. Our payment provider processes the card or the other payment method. We do not receive or store the full card number. ### Filings for a client When we file a return for a client with the Tax and Customs Board, we record the return, who approved it and when, the electronic signature of the approval, the receipt of the Tax and Customs Board, and the request and the answer of the state data exchange layer (X-tee). A return can hold personal data, for example the pay data of the employees in the form TSD. ### Support You can write to our team in the service, under "Messages", by e-mail to support@oscaraccountant.com, and in the chat of the website (section 3). "Talk to support" in the onboarding and "Ask your accountant" in the AI assistant also open a conversation. A call that you book also opens a conversation, or joins your open one (section 3, "Booking a call"). For each conversation, we store: - the messages, the files attached to them, who wrote each message and when, and the company and the person that the conversation is about - for an e-mail: the whole e-mail as it arrived, with its files, its sender and the result of the checks of the sender address - whether the client and our team have read the messages - the internal notes of our team, which the client never sees - the drafts of our replies that an AI model writes, and what our team did with each draft (section 8, "The AI features") - the translation into English of a message when we find that it is not in English (a very short message can stay without a translation), and the translation of our replies into the language of the conversation, because our team works in English If you open a conversation from the AI assistant, the conversation links to your conversation with the assistant, and our team can read it. We log each time that a person of our team reads it. **E-mail.** Our e-mail provider keeps the mailbox support@oscaraccountant.com. It sends a copy of each e-mail to that address to Resend, which brings it into the service. Our e-mails ask you to answer to an address of the form `support+@inbox.oscaraccountant.com`, with a code for the conversation. Resend receives the answer, and the code puts it in the right conversation. We connect a new e-mail to your account only if it comes from the address of your account and passes the check of the sender domain (DMARC). Otherwise we mark the sender as not confirmed. An answer with the code joins its conversation, and we mark it when its sender is not the person who started the conversation. When we reply in the service and you do not read the reply there within 5 minutes, we send it to you by e-mail. If you wrote to us by e-mail, we send our reply by e-mail at once. When nobody of our team reads a new message within 5 minutes, we send it by e-mail to our team. ## 5. The accounting service: the data we process for our clients For each client, we keep the books and their source documents, as the client instructs us under the client agreement. They can hold the personal data of: - the employees and the board members: name, personal identification code, pay, taxes, bank account, working time and absences, as far as the payroll needs them - the customers, the suppliers and the other counterparties: name, address, registry or personal identification code, VAT number, bank account, and the content of the invoices and the contracts - the persons in the bank transactions: name, bank account and the payment details The data comes from the client: from its uploads and entries, from the e-mails forwarded to its invoice inbox (section 8), from the bank accounts that it connects (section 8), from the Stripe account that it connects, from the account at an e-invoice operator (Finbite or Billberry) that it connects, and from the books of its previous accounting software when it moves them to us. We use the data only to keep the books, to prepare and file the returns and the reports of the client, and to give the client its data, except for our own checks under RahaPTS (section 4). When you connect a bank account, we receive the transactions your bank makes available, up to the past year. We keep the transactions from before your books start with us separately from your books, so that our staff can complete your books if days are missing. We delete those we do not use 90 days after your migration is done, and at once if you disconnect the bank or end the service, unless a law or an open procedure requires us to keep them. ## 6. Cookies and browser storage We set cookies and storage for analytics, session recordings and advertising measurement only if you accept them (below). Without your consent we use only storage that is strictly necessary: - Your choice of the light or the dark theme (`theme`), in the local storage of your browser. This value stays on your device. We do not receive it. - Your language (`NEXT_LOCALE`), a cookie that lasts 12 months. - Your choice in the cookie banner (`oscarai.cookie-consent`), in the local storage of your browser: your choice for analytics, for session recordings and for advertising measurement, the version of the banner and the time. It lasts 12 months, and then the banner asks again. - A security cookie that protects our forms against forged requests (cross-site request forgery, `csrftoken`). - When you log in to the service: a session cookie that keeps you logged in (`sessionid`). It ends when you log out or when the session expires. - In the service: a cookie that remembers whether the side menu is open (`sidebar_state`), and keys in the local storage and the session storage of your browser whose names start with `oscarai.`. They remember the panels that you opened, your recent searches in the command menu, the cards that you hid, and the page to go back to after a bank login, an identity check or the sign-in of a device. These values stay on your device. - Our network provider Cloudflare can set a security cookie that helps it tell people from automated attacks, also in the security check of the chat and of the booking of a call on the website (section 3). - When you send a message in the chat of the website, or book a call on the website: a cookie that tells the chat that the conversation is yours (`oscar_support_visitor`). It holds a random code that we sign, the scripts of the page cannot read it, and it lasts 12 months after your last message or booking. The chat also keeps a note in the local storage of your browser that you have a conversation (`oscar.support.visitor`), so that it can show you a new reply. - On the payment page of the onboarding, our payment provider Stripe loads its own form. Stripe can set cookies that it needs to process the payment and to prevent fraud. Only if you accept analytics: PostHog keeps a cookie and a key in the local storage of your browser whose names start with `ph_` (a random ID of your browser and of your visit, and your consent state), and keys in the session storage whose names start with `ph_`. If you also accept session recordings, PostHog can keep a part of a recording that it has not sent yet in a key of the session storage whose name starts with `ph_`. The cookie lasts up to 12 months. We delete them when you withdraw your consent or log out. Also only if you accept analytics: Google sets cookies on our website for Google Analytics. `_ga` and `_ga_` followed by an ID hold a random ID of your browser and of your visit; they last 12 months. We delete them when you withdraw your consent. Only if you accept advertising measurement: Google sets cookies on our website for Google Ads. `_gcl_au` holds a random ID for Google Ads, and, when you came from one of our ads, `_gcl_aw` or `_gcl_gb` holds the code of that ad click. Because Google Analytics is linked to Google Ads (section 3), Google can also set other cookies for Google Ads whose names start with `_gcl_` or `_gac_`. These cookies last 90 days. When we tell Google about your sign-up, we keep a note in the local storage of your browser (`oscarai.ads.signup-sent`), so that we do not tell Google twice. We delete these cookies and notes when you withdraw your consent. Article 5(3) of the ePrivacy Directive (2002/58/EC), as the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) applies it, and § 102 of the Electronic Communications Act (elektroonilise side seadus) require your prior consent before a website stores data in your browser or reads it, unless the storage is strictly necessary for a service that you request. This also applies to a script that makes your browser send data, with or without a cookie. That is why analytics, session recordings and advertising measurement start only after you accept them in the cookie banner. "Reject all" and "Accept all" have the same weight, closing the banner rejects all three, and "Settings" shows the three categories, analytics, session recordings and advertising measurement, and the strictly necessary storage, which is always on. You can change your choice at any time with "Cookie settings" in the footer of the website or in the security settings of your account. You can delete these values at any time in the settings of your browser. If you delete the session cookie, you are logged out. If you delete the cookie of the chat, the chat no longer shows your conversation in that browser. If you delete your choice in the cookie banner, the banner asks again. The API reference at `/docs/api` has a "try it" console. If you paste an API key into it, the key stays in the memory of the page only. The page does not store the key in your browser. The console sends your test request to our own website, not to a third party. ## 7. Why we process data, and the legal basis We process personal data under the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Estonian Personal Data Protection Act (isikuandmete kaitse seadus). - **Server logs, error reports, security and access logs:** our legitimate interest to operate the website and the service, to fix their errors, to keep them secure, and to prove who acted for a client and on what authority (GDPR Article 6(1)(f)). - **Analytics in your browser:** your consent (GDPR Article 6(1)(a), and Article 5(3) of the ePrivacy Directive). You give it when you accept analytics in the cookie banner. You can withdraw it at any time (section 11). The withdrawal does not affect the processing before it. - **Session recordings in your browser:** your consent (GDPR Article 6(1)(a), and Article 5(3) of the ePrivacy Directive). You give it when you accept session recordings in the cookie banner. It is separate from your consent to analytics. You can withdraw it at any time (section 11). The withdrawal does not affect the processing before it. - **Advertising measurement in your browser:** your consent (GDPR Article 6(1)(a), and Article 5(3) of the ePrivacy Directive). You give it when you accept advertising measurement in the cookie banner. It is separate from your consent to analytics and to session recordings. You can withdraw it at any time (section 11). The withdrawal does not affect the processing before it. - **The events of the sign-up and the onboarding:** our legitimate interest to measure and improve our sign-up and our onboarding (GDPR Article 6(1)(f)). The events hold only a random ID and plain values, no data that names you, so the effect on you is small. You can object to them at any time (section 11). - **The record of your choice in the cookie banner:** our legal obligation to be able to show your consent (GDPR Articles 6(1)(c) and 7(1)). - **The waitlist:** your consent (GDPR Article 6(1)(a)). You give it when you tick the box and join. You can withdraw it at any time (section 11). The withdrawal does not affect the processing before it. - **Your account and the use of the service:** the contract with you or with the client that invited you, and the steps before a contract that you ask for (GDPR Article 6(1)(b)). Where you use the service for a client that is a company, also our legitimate interest to give that client the service it asked for (GDPR Article 6(1)(f)). - **The identity checks and the other checks under RahaPTS, the sanctions screening, and the reports to the Financial Intelligence Unit:** a legal obligation (GDPR Article 6(1)(c)), under RahaPTS and the International Sanctions Act (rahvusvahelise sanktsiooni seadus). Where these checks process data about a criminal offence or a sanction, RahaPTS allows it. The biometric data of the face match is processed only for the identity check, under RahaPTS and with your explicit consent, which you give before the check (GDPR Article 9(2)(a) and (g)). - **The client agreement and billing:** the contract (GDPR Article 6(1)(b)), and our legal obligation to keep our own accounting records (the Accounting Act, raamatupidamise seadus, § 12) (GDPR Article 6(1)(c)). - **The filing records and the X-tee logs:** the legal obligations of a mediator of the state data exchange layer (GDPR Article 6(1)(c)), and our legitimate interest to prove each filing and to defend a claim (GDPR Article 6(1)(f)). - **E-mails, support and the chat of the website:** our legitimate interest to answer the people who contact us (GDPR Article 6(1)(f)). If you ask about becoming a client, we also process the data to take steps at your request before a contract (GDPR Article 6(1)(b)). For a client, support is part of the service under the client agreement (GDPR Article 6(1)(b)). The AI drafts and the translations serve the same interest: to answer you correctly, quickly and in your language. We keep the conversations of a client after the end of the service because they can be part of our records under RahaPTS (GDPR Article 6(1)(c)). - **Booked calls:** for a call about becoming a client, the steps that you ask for before a contract (GDPR Article 6(1)(b)). For a client, the call is part of the service under the client agreement (GDPR Article 6(1)(b)). For any other call, and when our team books a call for you, our legitimate interest to answer the people who contact us (GDPR Article 6(1)(f)). - **The books of a client:** we process them as a processor, on the client's instructions. The client decides its own legal basis, which is often its legal obligation to keep books and to file returns. ### Automated decisions We check your identity and screen you against sanctions lists automatically. If every check passes, you can finish the onboarding and set up your account. A person on our staff then reviews and approves your company before we provide any service. The automated checks are the face match and the liveness check, the screening against sanctions and PEP lists, the adverse media check of board members and beneficial owners, and a risk score. We make no decision that has a legal or a similarly significant effect on you based only on automated processing. We do not build profiles of visitors. Our analytics counts visits and steps, and our session recordings show how visitors use the pages; we use them for no decision about you, for no remarketing and for no personalised advertising. Our advertising measurement counts which of our ads led to a sign-up; we use it for no decision about you, and not to choose the ads that you see. ## 8. Who receives the data We do not sell personal data. We share data for advertising only with Google, only if you accept advertising measurement, and only to measure our own ads (below). ### Our service providers (processors) These service providers process personal data for us, under a contract and only on our instructions. For the books of a client, they are our sub-processors, and the client authorises them in the client agreement. - **Hetzner Online GmbH**, Industriestr. 25, 91710 Gunzenhausen, Germany: our hosting provider. It runs our servers and our databases, including the books of our clients, and keeps our encrypted backups, which include a copy of the files in R2, on a separate storage server (Storage Box). Both are in its data centre in Helsinki, Finland, in the EU. - **Cloudflare, Inc.**, 101 Townsend St., San Francisco, CA 94107, USA: the network and security provider in front of our servers. It receives each request before our servers do. Its file storage (R2) keeps the documents that you upload, the source documents of the books and the evidence of the identity checks, in its EU jurisdiction, so the files stay in the EU. It also runs the security check (Turnstile) of the chat and of the booking of a call on the website (section 3). - **Functional Software, Inc. (Sentry)**, USA: our error tracking provider. It stores the error reports of the website, the service and the iOS app in its EU region, in Germany. - **PostHog Inc.**, USA: our analytics provider. It stores the analytics and the session recordings of the website, only with your consent, and the events of the sign-up and the onboarding (sections 3 and 4) in its EU region, in Frankfurt, Germany. Under its data processing agreement, PostHog Inc. can also process the data in the United States. - **Google Ireland Limited**, Gordon House, Barrow Street, Dublin 4, Ireland (Google Analytics): an analytics provider, only with your consent to analytics (section 3, "Analytics, only with your consent"). It acts on our behalf under its data processing terms, and it can process the data in the United States (section 9). The data that Google Ads receives from Google Analytics through our link (section 3) is outside these terms ("Google Ads, a separate controller", below). - **Google Cloud EMEA Limited**, 70 Sir John Rogerson's Quay, Dublin 2, Ireland (Google Workspace): our e-mail provider. It receives and stores the e-mails that you send to us and that we send to you from our mailboxes. It also sends a copy of each e-mail to support@oscaraccountant.com to Resend (below). It also keeps the calls that you book with us in our Google Calendar, and runs the Google Meet video call (section 3, "Booking a call"). - **Plus Five Five, Inc. (Resend)**, 2261 Market Street #5039, San Francisco, CA 94114, USA: our provider for the e-mails that the service sends, for example the codes to confirm your e-mail address, the password resets, the invitations, the notices, the e-mails and invitations of a booked call, and our replies in a support conversation. It sends the e-mails from Ireland, but it stores its data, including the e-mail addresses and the logs, in the United States. We also send the launch e-mail to the waitlist through it. Resend also receives the e-mails that are forwarded to the invoice address of a client (below), and the e-mails to our support addresses (section 4, "Support"). Its mail servers for these e-mails are in Ireland. It keeps a copy of each e-mail in the United States for up to 30 days. - **Stripe Payments Europe, Ltd.**, Ireland: our payment provider for our own invoices to clients. It processes the payment method, the payments and our invoices. For the payment itself and for fraud prevention, Stripe is also a controller under its own privacy policy. - **Didit**, Spain: our identity verification provider. It runs the identity check of section 4 (Smart-ID or Mobile-ID, the document, the liveness check, the face match, the device and IP check, and the screening against sanctions, PEP and adverse media lists with its ongoing monitoring), and sends us the result. We copy the result to our own storage, and Didit deletes its copy after 3 months. - **SIA Catego**, Latvia: our open banking provider. It is an account information service provider licensed by Latvijas Banka under the Payment Services Directive (PSD2). When a client connects a bank account, the client gives Catego its consent at the bank, and Catego reads the balances and the transactions of that account for us. Catego deletes its copy 3 to 7 days after the consent ends. - **SpinTEK AS**, Estonia: the host of our security server of the state data exchange layer (X-tee), under contract X0902-2026 of 29.09.2026. It passes our requests, for example the returns of a client, to the Tax and Customs Board, and keeps the log of the requests and the answers, encrypted with our key, in Estonia. Its data processing agreement is based on the standard contractual clauses of the European Commission. It uses no sub-processors of its own. - **Firecrawl**, USA: our website reading provider. At the onboarding, it reads the public pages of the company website that you give us and summarises them, so that we can prefill the questionnaire. We send it only the address of the website, never a name or a personal identification code, but the pages can name people. - **Anthropic Ireland, Limited**, Ireland, with its parent company Anthropic, PBC, USA: an AI model provider. It runs the AI assistant of the service. It also reads the invoices and the receipts that the other models of the automatic reading cannot read with certainty, and it matches the bank transactions that OpenAI cannot match with certainty. It also writes the drafts of our support replies and translates the support messages. It processes the data outside the EEA, mainly in the United States. - **OpenAI Ireland Limited**, Ireland, with its affiliate OpenAI OpCo, LLC, USA: an AI model provider. It reads the invoices and the receipts for the automatic reading of invoices. When TypeSafe gives no answer, it also checks whether an e-mail to the invoice inbox holds an invoice. It also matches the bank transactions of a client to its open purchase invoices. It processes the data in the United States. - **OpenRouter, Inc.**, 169 Madison Avenue, New York, NY 10016, USA: a service that sends our requests to the AI models of other companies. For the automatic reading of invoices, it sends each invoice to a second AI model (GLM). One of several hosting companies runs that model, and the company can change with each request. We let OpenRouter choose only companies that do not keep the data and do not train on it. Mistral AI, 15 rue des Halles, 75001 Paris, France, reads the text of each PDF for OpenRouter (text recognition). OpenRouter and the hosting companies process the data outside the EEA, mainly in the United States. - **Mistral AI**, 15 rue des Halles, 75001 Paris, France: an AI model provider, used directly by us for the AML monitoring of the books and for the adverse media check of board members and beneficial owners. Its model reads the bank transactions and the invoices of a client, and points out the ones that can be a sign of money laundering, terrorist financing or proliferation financing. It also reads the results of the adverse media check, and points out the ones that can be adverse media about the person. It processes the data in the EU. It keeps the data for up to 30 days to detect abuse of its service, then deletes it. It does not train on the data. - **European Perspective SAS (Staan)**, Paris, France: a web search provider, used for the adverse media check of board members and beneficial owners. We send it the name of the person, the name of the company and fixed words such as "fraud" or "bankruptcy", and it sends back the public web pages that it finds. It processes the data in France, in the EU. - **TypeSafe AI, Inc.**, San Francisco, USA: an AI model provider. Its model reads the text of an invoice and the first two readings of it, and decides whether Anthropic must read the invoice too. It also checks whether an e-mail to the invoice inbox holds an invoice. It processes the data in the United States. ### Google Ads, a separate controller If you accept advertising measurement, the Google tag sends the data of section 3 ("Advertising measurement with Google") to Google Ads. If you also accept analytics, Google Ads can also receive the data of your visits from Google Analytics through our link (section 3). For Google Ads, Google Ireland Limited is a separate controller under its own terms. We and Google are jointly responsible for the collection of this data on our pages and for its transfer to Google; Google alone decides what it does with the data after that, under its privacy policy (https://policies.google.com/privacy). You can use your rights about this data with us (section 11) or with Google. ### The AI features The service uses AI models for the AI assistant, the automatic reading of invoices, the invoice inbox, the matching of bank transactions, the AML monitoring of the books, the adverse media check and support. The AI model providers above process only the content that each feature needs: - **The AI assistant:** Anthropic processes the messages to the assistant and the data of the books that the assistant reads to answer them. - **The automatic reading of invoices:** when a client uploads an invoice or a receipt, or one arrives in its invoice inbox, OpenAI and OpenRouter read it. TypeSafe then decides whether Anthropic must read it too. The result is a draft entry for the books of the client. - **The invoice inbox:** TypeSafe, and OpenAI as the fallback, check whether an e-mail holds an invoice or a receipt (below). - **The matching of bank transactions:** when no fixed rule matches a bank transaction of a client to an open purchase invoice, OpenAI reads the transaction (its date, amount, counterparty, account number, description and reference, and for a card payment the last four digits of the card, the name of the card and the merchant category code) and the open invoices that could match it, and proposes a match. When OpenAI cannot match it with certainty, Anthropic reads the same data. - **The AML monitoring of the books:** the Money Laundering and Terrorist Financing Prevention Act (RahaPTS) requires us to monitor the business relationship with each client. Fixed rules check every bank transaction and invoice of a client. Mistral then reads the transactions and the invoices that a filter keeps, without routine payments such as taxes and salaries (the date, the amount, the currency, the counterparty, the country, the description and the lines of an invoice) with the profile of the client in words, and points out the ones that can be a sign of money laundering, terrorist financing or proliferation financing. We send no personal identification code, no full account number and no name of a board member or an owner. A person of our firm reads each point and decides on it. The result is kept in our own AML records, and the client does not see it. - **The adverse media check of board members and beneficial owners:** RahaPTS requires us to know the people who run and own each client. When a company becomes a client, at each periodic review, in a case of enhanced due diligence and for a new board member or beneficial owner, we search the web for each board member and each beneficial owner (Staan, above). The search gets the name of the person, the name of the company and fixed words about fraud, money laundering, sanctions, court cases and bankruptcy. Mistral then reads the results (the title, a short extract, the website and the date of each page) with the name of the person, the role, the name of the company, the year of birth and the country of citizenship, and points out the results that can be adverse media about the person. We send neither Staan nor Mistral a personal identification code, a full date of birth or an address. Staan gets only the name of the person, the name of the company and the fixed words. A person of our firm reads each point and decides on it. We keep the links, the short extracts and the result in our own AML records. We do not keep the pages. The client does not see these records. - **Support:** when a client or a visitor writes to our team, Anthropic reads the conversation and writes a draft of our reply. It reads the messages, who wrote them, the internal notes of our team, and the names, types and sizes of the attached files, but not the files. For a client company, it also reads the data of the books of that company that it needs for the draft. For a visitor of the website, a sender that we cannot confirm, or a company whose books are not ready, it reads only our public pages and prices, and no books. It can only read and propose: it cannot change the books or send a message. Only our team sees the draft. A person of our team reads it, can change it, and decides whether to send it. So a client never sees a draft, and every reply comes from a person. Anthropic also writes a short subject for a new conversation, translates a message into English for our team when we find that it is not in English, and translates our replies into the language of the conversation. We find the language of a message on our own servers. We use no provider that trains its models on your data. Section 9 gives the safeguard of each transfer outside the EEA. **The invoice inbox.** Each client gets a private e-mail address to which it can forward the invoices and the receipts of its suppliers, by hand or with a filter of its mailbox. Resend (above) receives each e-mail sent to that address, and we copy it into the service. We read every e-mail: a cheap AI check (TypeSafe, and OpenAI as the fallback) decides whether each PDF attached to it, and the text of an e-mail with no PDF, is an invoice or a receipt. An e-mail or an attachment that is not an invoice or a receipt is dropped after this check: we do not store its content, its attachments or the e-mail itself. We keep only its sender, its subject, the names and sizes of its files and the result, so that the client sees it in the list of received e-mails. From an invoice or a receipt we keep the PDF, or the text of the e-mail as a PDF, and the whole e-mail as it arrived, as the source document of the books (section 5). When Gmail asks the address to confirm a forwarding, we send that confirmation on to the Gmail address that asked for it, and to no other address, and we keep that address and the time of the forward. ### Services that a client connects A client can connect other services to the service: its bank accounts (through Catego, above), its own Stripe account, its account at an e-invoice operator (Finbite or Billberry), and an AI assistant or another app through our API or our MCP connector. When a client connects a service, the data goes where the client tells it to go, and the terms and the privacy policy of that service apply. For example, when you connect Claude or ChatGPT to Oscar, the provider of that assistant receives the data that the assistant reads, under your own agreement with that provider. **Our Stripe App.** A client can connect its Stripe account with our Stripe App "OscarAI Accounting", or with a restricted key that it makes in Stripe. The app can only read the data that the books need: the balance, the payments and the refunds, the disputes, the payouts and the fees, the invoices and the credit notes, the customers, the products and the prices, the taxes and the financial reports. It cannot make a payment or change the data in the Stripe account. For the app, Stripe gives us an access token and a refresh token. We store these tokens, or the restricted key, encrypted, and use them only to get the data for the books of that client. When the client uninstalls the app in Stripe or disconnects Stripe in Oscar, we delete the tokens or the key at once. The records that we already put into the books are kept as the books are (section 10). If you sign in with Google, Google Ireland Limited processes your sign-in under its own privacy policy. If you install the iOS app, Apple processes the download from the App Store under its own privacy policy. If you allow notifications, Apple Distribution International Ltd., Ireland, with its parent company Apple Inc., USA, delivers them to your iPhone through the Apple Push Notification service, under its own terms. Apple receives the device token and the text of each notification. Apple can give us statistics of the downloads and, if you allowed it on your iPhone, crash reports, in a form that does not identify you. ### Public authorities We exchange data with these authorities. They are not our processors. Each processes the data under its own legal duties. - **The Tax and Customs Board (Maksu- ja Tolliamet)**: we file the returns of a client, and read its data, over X-tee and in e-MTA, on the client's behalf and within the rights that the client gives us. - **The Information System Authority (Riigi Infosüsteemi Amet)** runs X-tee. It logs the header data of each X-tee request, including the personal identification code of the person who is signed in, and keeps it for 3 years, under its X-tee joining agreement. - **The Estonian Business Register (the Centre of Registers and Information Systems, RIK)**: we read the public data of companies and their board members, shareholders and beneficial owners. We keep a copy of its open data, with the current persons only. We do not store the personal identification codes of the open data. - **The Financial Intelligence Unit (Rahapesu Andmebüroo)**: when the law requires it, we report a suspicion or answer a request of the Financial Intelligence Unit. The law does not allow us to tell you about a report (RahaPTS § 51). We also disclose data to another authority, a court or an auditor when a law requires it. ## 9. Transfers outside the EU We keep the data in the European Economic Area (EEA) when we can. Our servers, our backups, our file storage and the X-tee logs are in the EU. If a provider processes data outside the EEA, we transfer it only on a legal basis that the GDPR allows. This is an adequacy decision of the European Commission, or the standard contractual clauses of the European Commission. You can ask us for a copy of the safeguards. Cloudflare, Sentry, Resend, Firecrawl and PostHog are companies in the United States. For a transfer to them we rely on the EU-U.S. Data Privacy Framework, which the European Commission found adequate, for a company that is certified under it. Where that framework does not apply, the standard contractual clauses in the data processing agreement of the provider apply. Google Cloud EMEA Limited, Google Ireland Limited and Stripe Payments Europe, Ltd. are in Ireland. When they transfer data to Google LLC or Stripe, Inc. in the United States, they rely on the same framework, and on the standard contractual clauses as the fallback. OpenRouter and TypeSafe are companies in the United States. For a transfer to them we rely on the standard contractual clauses in their data processing agreements. The hosting companies to which OpenRouter sends a request can also be outside the EEA. OpenRouter must protect that onward transfer under the same clauses. Anthropic Ireland, Limited and OpenAI Ireland Limited are in Ireland. When they transfer data to Anthropic, PBC or OpenAI OpCo, LLC in the United States, they rely on the standard contractual clauses. Mistral AI and European Perspective SAS (Staan) are in France, in the EU. ## 10. How long we keep the data ### The website and the waitlist - **Server logs:** up to 30 days, then we delete them. We keep a log longer only when we need it to investigate a specific security incident. - **Error reports:** up to 90 days, then our provider deletes them. - **Analytics and the events of the sign-up and the onboarding:** 12 months, then PostHog deletes them. Our queue of the events to send keeps an event for up to 30 days after it was sent. The cookie and the storage of PostHog in your browser last up to 12 months, or until you withdraw your consent or log out. - **Google Analytics:** Google Analytics keeps the data of each visit for 2 months, then deletes it; its reports keep only counts. Its cookies (`_ga`) last 12 months, or until you withdraw your consent. - **Session recordings:** 30 days, then PostHog deletes them. The part of a recording that your browser has not sent yet stays in its session storage until it is sent, or until you close the tab. - **Advertising measurement:** the cookies of Google Ads (`_gcl_` and `_gac_`) last 90 days, or until you withdraw your consent. Google keeps the data that Google Ads receives under its own privacy policy. - **Your choice in the cookie banner:** 12 months in your browser. The record of each choice on our servers: 24 months, then we delete it. - **The waitlist:** until you leave the waitlist, or at the latest 12 months after we sent the launch e-mail. If you become a client, the rest of this policy applies from then on. - **The chat of the website:** 12 months after your last message. Then we delete the conversation, its messages, your name and your e-mail address. If the conversation moved to your account (section 3), we keep it as a support conversation of the service (below). - **A booked call:** at the latest 12 months after the call, or after it was cancelled. Then we delete the booking and the entry in our Google Calendar. A booking made on the website can go earlier, together with the conversation of the chat. The conversation of the booking follows the rule of the chat (above) or of support (below). - **E-mails:** as long as we need them to handle your request and any follow-up. If an e-mail becomes part of a contract, an accounting record, a record under RahaPTS or a legal claim, we keep it as long as that record. ### The service - **Your account:** as long as you have the account. When you or the client end it, we delete the account, except the records below that we must or may keep for longer. - **Sign-in events:** 1 year. The sign-in of a session in which you approved a filing: 7 years from the end of the calendar year. - **Approvals, filing records, the records of each X-tee request, staff access to a client and the access changes that a filing relied on:** 7 years from the end of the calendar year of the record, or of the last filing that relied on it. The Accounting Act (§ 12) makes a client keep its source documents for 7 years, and we must be able to prove each filing for that long. - **The X-tee request log that our host keeps:** 7 years from the end of the calendar year of the message. - **The identity checks and the other records under RahaPTS**, including the questionnaire, the risk score, the screening and the monitoring: 5 years after the end of the business relationship (RahaPTS § 47). For a company that we refused: 5 years after the refusal. For the data behind a report to the Financial Intelligence Unit: at least 5 years after the report. The Financial Intelligence Unit can order us to keep them for up to 5 years more. Then we delete them. - **The client agreement and the record of its acceptance:** until 31 December of the year in which the client relationship ends, plus 7 years. We delete the IP address and the browser of the acceptance 5 years after the relationship ends. - **Our invoices and our payment records:** 7 years from the end of the financial year (the Accounting Act, § 12). - **The books of a client and their source documents:** as long as the client agreement lasts. The client must keep its books for 7 years from the end of the financial year (the Accounting Act, § 12), and we keep them for the client while we serve it. When the agreement ends, the client can read and export its books for 90 days. Then we delete them, unless the client asks us to delete them earlier, or a law or an open procedure, for example a tax audit or an order of an authority, requires us to keep them. A client can delete an uploaded document that its books do not use. We then delete it at once, and our backups keep it until the backup expires, for at most 24 months. - **Bank transactions from before your books start:** 90 days after your migration is done, or at once when you disconnect the bank or end the service, unless a law or an open procedure requires us to keep them. A transaction that we put into your books is kept as the books are. - **The invoice inbox:** an invoice or a receipt from the invoice inbox, with the e-mail that brought it, is a source document of the books and is kept as the books are. Of an e-mail that brought no invoice and no receipt we keep only its sender, its subject, the names and sizes of its files and the result, as long as the client agreement lasts. - **Support:** a conversation of a client company, with its files, its internal notes, its drafts, its translations and the e-mails that brought it, is kept as long as the client agreement lasts. When the client deletes its data after the end of the agreement, we keep its conversations, because they can be part of our records under RahaPTS, and we keep them as those records (above). A conversation of a user that is not about a company is deleted with the account, with the e-mails that brought it. The record of the live updates of the conversations is deleted after 30 days. - **Connected apps:** an access token expires after one hour. A refresh token stops working 30 days after its last access token expired. A daily job deletes the expired tokens. When you revoke a connection, its tokens stop working at once. An app that registered itself and never connected is deleted after one day. The request log of our MCP server is kept as the server logs, up to 30 days. - **The Stripe connection:** we keep the tokens of the Stripe App, or the restricted key, while the connection lasts. We delete them at once when the client uninstalls the app or disconnects Stripe, or when Stripe no longer accepts them. When a client moves from a restricted key to the app, we use the key one last time to remove our webhook (the address to which Stripe sent us its events) from the Stripe account, then we delete the key. A record that we put into the books is kept as the books are. - **The iOS app:** we keep the device token of the notifications while you are signed in to the app on that iPhone. We delete it when you sign out in the app and when you delete your account. When the session of the app ends in another way, or Apple tells us that the token is no longer valid, we delete the token within 30 days. A document in the upload queue stays on your iPhone until the app has sent it or you sign out. - **Backups:** our encrypted backups of the databases, the books and the uploaded documents keep a deleted record until the backup that holds it expires, for at most 24 months. ## 11. Your rights Under the GDPR you have these rights: - to get access to your personal data and a copy of it - to correct data that is wrong - to have your data deleted - to restrict the processing - to object to processing that is based on our legitimate interest - to withdraw a consent at any time - to receive your data in a portable format, where this right applies To use a right, write to support@oscaraccountant.com. We answer within one month. We can ask you for information to confirm your identity. For server logs, we can often not link a log entry to you without more data from you. Some rights are limited by law. We cannot delete a record that RahaPTS or another law makes us keep until its period ends, and RahaPTS can limit your right of access to the records of our checks. If your data is in the books of a client, the client decides on your request, and we help the client to answer it. If you write to us, we pass your request to the client. ### How to withdraw your consent to analytics, session recordings or advertising measurement Open "Cookie settings" in the footer of the website, or in the security settings of your account, and choose "Reject all", or turn analytics, session recordings or advertising measurement off and save. If you turn analytics off, PostHog stops in that browser, and we delete its cookies and the data that it stored in your browser. We also delete the cookies of Google Analytics and load the page again, so that Google Analytics stops; it keeps the data that it received before until the end of its 2 months. If you turn only session recordings off, PostHog stops the recording at once. If you turn advertising measurement off, we delete the cookies of Google Ads from our website in that browser and load the page again, so that the Google tag stops sending data to Google Ads and tells Google that it may no longer use your data for advertising. Google keeps the data that it received before; to ask Google about it, see https://policies.google.com/privacy. Your choice holds for the browser in which you make it. The recordings that we already have stay until the end of their 30 days. If you ask us, we delete the recordings that are linked to your account earlier. We cannot find the recordings of a browser in which you did not sign up, because they hold only a random ID. To object to the events of the sign-up and the onboarding (section 4), or to ask us to delete your recordings, write to support@oscaraccountant.com. ### How to leave the waitlist You can leave the waitlist and withdraw your consent at any time. Write to support@oscaraccountant.com from the address on the waitlist, or use the link to leave the waitlist in any e-mail that we send you. We then delete your e-mail address from the waitlist. ### Complaints You also have the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee. We ask you to contact us first, so that we can try to solve the problem. ## 12. Security We protect the data with encryption in transit and at rest where our providers offer it, encrypted backups, a separate file for the books of each client, access limited to the people who need it for their job, a second factor for our staff, and a log of every access of our staff to a client company. The X-tee logs are encrypted with our own key, so our host cannot read them. ## 13. Links to other websites The website names and can link to other services, for example Claude, ChatGPT and banks. When you open another website, its own privacy policy applies. We do not control how other websites process data. ## 14. Changes to this policy We can change this policy when the website, the service or the law changes. We publish the new version on this page and change the date at the top. If a change is significant, we show a notice on the website and in the service, and we tell our clients by e-mail. If a change affects the waitlist in a significant way, we tell you by e-mail. ## 15. Contact For every question about this policy or your personal data, write to support@oscaraccountant.com.