Privacy Policy

• Controller: ADSio OÜ is the controller of the data of user accounts and customers, such as login, billing, usage and support data.
• Processor: for the contents of documents uploaded by customers (receipts, invoices and the data extracted from them), ADSio OÜ is a processor. The controller of that data is the customer – usually the company or accounting firm whose organization the documents are uploaded to. We process this data only on the customer’s instructions, which are given through the Service and our Terms of Service.

If your personal data appears in a document uploaded by one of our customers (for example on an invoice issued by a sole proprietor), please contact that customer with any requests concerning the data. We will help the customer to respond.

• Account data: name, email address, password (stored only as a hash), language and other settings, organization memberships and roles.
• Organization data: company name, registry code, VAT number, integration settings and API credentials for accounting software (stored encrypted).
• Document data: uploaded files and the data extracted from them, such as the seller, buyer, dates, amounts and line items. Documents may contain personal data, for example the names of individuals or sole proprietors.
• Receipt inbox data: emails forwarded to an organization’s receipt inbox address, including the sender’s address, subject, content and attachments.
• Billing data: purchases, invoices, credit usage and payment status. We do not receive or store full card details.
• Technical data: IP address, browser and device details, logs and cookies needed for logging in, as well as aggregated usage statistics.

• Providing the Service and managing accounts – performance of a contract (GDPR Article 6(1)(b)).
• Processing document contents on behalf of customers – the customer’s instructions under a processing agreement (GDPR Article 28).
• Payments, invoicing and accounting – performance of a contract and compliance with legal obligations, including the Estonian Accounting Act (Article 6(1)(b) and (c)).
• Transactional emails, such as sign-up confirmation, payment receipts and important Service notices – performance of a contract (Article 6(1)(b)).
• Security, prevention of abuse and fraud, error tracking and improvement of the Service – our legitimate interest (Article 6(1)(f)).
• Answering enquiries and support – performance of a contract or our legitimate interest.

We do not sell personal data, we do not use customer documents to train artificial intelligence models, and we do not send marketing emails without your consent.

We use the following service providers (sub-processors) to provide the Service. They may process data only on our instructions and to the extent necessary to provide their service:

• Supabase – database, user authentication and file storage (EU region).
• TeamoRouter and Anthropic – reading documents with artificial intelligence. Document images and text are sent to these providers to extract the data.
• Maksekeskus AS – processing card and bank link payments.
• Emailit – transactional emails and the receipt inbox (receiving forwarded receipts).
• Vercel – hosting and delivery of the web application, and aggregated usage statistics.

Some sub-processors may process data outside the European Economic Area. In that case, transfers are made on the basis of an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework) or the European Commission’s standard contractual clauses. We will update this list before adding or replacing a sub-processor.

• Account data is kept for as long as the account is active and is deleted after the account is closed, unless we must keep it by law.
• Documents and extracted data are kept for as long as the customer keeps them in the organization. The customer can delete documents; when an organization or account is deleted, its documents are deleted as well.
• Purchase and invoicing data is kept for 7 years as required by the Estonian Accounting Act.
• Logs and technical data are kept for a short period, normally no longer than 90 days.
• Deleted data is removed from backups in the normal backup cycle.

Under the GDPR you have the right to:

• access your personal data and receive a copy of it;
• have inaccurate data rectified;
• have your data erased, unless we must keep it by law;
• restrict processing or object to processing based on our legitimate interest;
• receive the data you have provided in a machine-readable format (data portability);
• withdraw your consent at any time where processing is based on consent.

To exercise your rights, write to contact@adsiou.com. We will respond within one month. For data in documents uploaded by our customers, please contact the customer concerned (see “Controller and processor”).

We protect data with technical and organizational measures: data is encrypted in transit, access is restricted by roles and organizations (row-level security), API credentials for accounting software are stored encrypted, and only those who need access for their work have it.

We use only cookies and similar technologies that are necessary for the Service to work, such as keeping you logged in and remembering your language and display preferences. We do not use advertising cookies.

If you believe that your personal data is being processed unlawfully, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or with the supervisory authority of your country of residence. We would appreciate the chance to resolve your concern first, so please contact us beforehand.

We may update this Privacy Policy when the Service, our sub-processors or the law change. We will notify you of material changes by email or in the Service. The date of the latest update is shown at the top of this page.

ADSio OÜ, registry code 14619536, Ranna tn 6, Võiste alevik, Häädemeeste vald, 86501 Pärnu maakond, Estonia. Email for data protection enquiries: contact@adsiou.com.