Privacy policy
Last updated 14 November 2026
1. Who we are
SasoBooks is an online bookkeeping service at books.sasomor.com, run by SASOMOR CONSULTING LTD, a company registered in Cyprus ([HE number], [registered address]). For privacy questions or requests, write to dor@sasomor.com. We have not appointed a data protection officer, because the law does not require one for a business of our size and kind; the contact above handles all privacy matters.
2. Our two roles
- Controller for the data of the people who sign up and use SasoBooks (you and your team), and for billing data. This policy covers that data.
- Processor for the bookkeeping data your company puts into SasoBooks about other people, such as customers and suppliers on invoices and bank lines, and employees in payroll. Your company is the controller of that data. Our Data processing agreement covers it.
3. What we collect, why, and on what legal basis
| Data | Examples | Why we use it | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Account | Email, name, password (stored only as a hash), two-step verification setup, the companies you belong to and your role | To create and run your account and keep it secure | Contract (b); legitimate interest in keeping accounts secure (f) |
| Sign-in and security records | Time of sign-in, IP address, browser, changes you make (audit log) | To prevent and investigate misuse and show who changed what in the books | Legitimate interest in security and a reliable audit trail (f) |
| Company profile | Legal name, registration and VAT numbers, address, logo, colours | To set up your books and show your details on invoices | Contract (b) |
| Billing | Plan, our invoices to you, card brand and last 4 digits (Stripe holds the full card details) | To charge you and keep our own accounting records | Contract (b); legal obligation to keep accounting records (c) |
| Support | Messages you send us, technical logs | To answer you and fix problems | Contract (b); legitimate interest in running a working service (f) |
You give us this data when you sign up and use SasoBooks. We need the account and billing data to provide the service; without it we cannot open an account. We do not make decisions about you by automated means that have legal or similar effects.
We do not sell personal data, do not use it for advertising, and do not use your bookkeeping data to train AI models.
4. Cookies
SasoBooks uses only the cookies it needs to keep you signed in securely. We do not use analytics, advertising or tracking cookies, so we do not ask for cookie consent.
5. Bank data
You add bank lines by uploading statements (for example CSV files). Direct bank connections are not active at launch. If we switch them on, they will run through Enable Banking Oy (Finland), a licensed account information service provider: you sign in on your bank’s own page, we never see your banking password, access is read-only (account names, IBANs, balances and transactions), SasoBooks can never move money, and your bank asks you to renew consent at least every 180 days. We will update this policy before switching them on.
6. Who processes data for us
We use these providers. Each is bound by a data processing agreement. Data is stored in the EU where the provider allows it. Where data goes to the US, the transfer relies on the EU–US Data Privacy Framework (adequacy decision of 10 July 2023) and/or the European Commission’s Standard Contractual Clauses (SCCs). You can ask us for a copy of the relevant safeguards at dor@sasomor.com.
| Provider | What for | Where | Transfer safeguard |
|---|---|---|---|
| Supabase, Inc. | Database, sign-in and file storage | EU (Paris, France) | Stored in the EU; Standard Contractual Clauses (SCCs) cover any access from the US |
| Render Services, Inc. | Runs the SasoBooks application | EU (Frankfurt, Germany) | Processed in the EU; SCCs cover any access from the US |
| GitHub, Inc. | Source code and nightly encrypted database backups | United States | EU–US Data Privacy Framework and SCCs; backups are stored encrypted |
| Cloudflare, Inc. | Domain names, content delivery and protection against attacks | Global network | EU–US Data Privacy Framework and SCCs |
| Postmark (ActiveCampaign, LLC) | Service emails (sign-up, sign-in, invitations) and the receipts inbox (emails you send to your SasoBooks inbox address) | United States | EU–US Data Privacy Framework and SCCs |
| Stripe Payments Europe, Ltd | Card payments and billing for SasoBooks subscriptions | Ireland (EU); Stripe may transfer data to Stripe, Inc. in the US | EU–US Data Privacy Framework and SCCs |
| Enable Banking Oy | Optional read-only bank connections (not active at launch) | Finland (EU) | Stays in the EU |
When you check a VAT number in SasoBooks, the number is sent to the European Commission’s public VIES service. We may also disclose data where the law requires it, for example to the Cyprus Tax Department or a court. We will tell customers at least 30 days before adding a provider that handles bookkeeping data.
7. How long we keep data
- Account data: while your account is open. Ask us at dor@sasomor.com to close your login and we delete it, unless you are still the only owner of a company that has not been deleted.
- Company data and books: while the company exists in SasoBooks. An owner can ask to delete a company in Settings › Data. Everything in it is then deleted on or after 30 days; until then the owner can cancel, and everyone with access can still read it and owners and admins can download it. If you stop paying but do not delete the company, it becomes read-only and stays available for you to read and export; we will not delete it without telling you by email at least 30 days before.
- Our own billing records: 6 years after the end of the year they relate to, as Cyprus tax and company law requires.
- Backups: deleted data stays in our encrypted backups until they expire, at most [backup retention, e.g. 35 days]. We do not restore deleted data from backups except to recover from an incident.
- Technical logs: kept by our hosting providers for their standard periods, normally a few days to a few weeks.
Your company must keep its own accounting records for at least 6 years under Cyprus law. Before you delete a company, download the export in Settings › Data: one JSON file with all its records. Uploaded documents (receipts, invoices) are listed in the export with where each is stored; download any you need from the app.
8. Security
Two-step verification with an authenticator app is required for every user, and the database refuses access to books without it. Each company’s data is kept apart by database row-level security, checked on every request. Data is encrypted in transit (TLS) and at rest, and backups are encrypted before they are stored. Our staff access customer data only to provide support you ask for, to keep the service running, or where the law requires it. The security annex of the DPA has more detail.
9. Data breaches
If a breach affects personal data we control, we notify the Commissioner for Personal Data Protection within 72 hours of becoming aware of it where the GDPR requires, and tell you without undue delay if it is likely to put you at high risk. For bookkeeping data we tell your company as set out in the DPA.
10. Your rights
You can ask to access, correct, delete or receive a copy of your personal data, to restrict or object to how we use it (including use based on legitimate interest), and you can withdraw any consent you gave. Write to dor@sasomor.com; we answer within one month. For bookkeeping data about you held by a company that uses SasoBooks, contact that company; if you write to us, we pass your request to it and help it respond.
You can complain to the Commissioner for Personal Data Protection in Cyprus (Law 125(I)/2018), or to the authority where you live or work. We would appreciate the chance to help first.
11. Changes
We post changes on this page and update the date at the top. For material changes we email account holders at least 30 days before they take effect.