The data controller responsible for your personal data is:
No Data Protection Officer (DPO) has been appointed. Slipstrim does not meet the thresholds requiring mandatory DPO appointment under GDPR Art. 37. All data protection queries should be directed to legal@slipstrim.io.
We collect only what is necessary to provide the service:
We do not collect payment card numbers. We do not sell your data to third parties.
We process your personal data only where we have a valid legal basis. The table below sets out each category of processing, its purpose, and the applicable legal basis under GDPR Art. 6.
| Processing activity | Purpose | Legal basis |
|---|---|---|
| Account creation and authentication | Creating and maintaining your account; verifying your identity | Art. 6(1)(b) — performance of contract |
| Delivering the core service | Storing and displaying invoices, customer records, documents you create | Art. 6(1)(b) — performance of contract |
| Bank account connection | Displaying your bank account data within the app when you choose to connect a bank | Art. 6(1)(b) — performance of contract; Art. 6(1)(a) — consent (you initiate the connection) |
| Transactional emails | Sending invoice reminders, payment confirmations, system notifications you configure | Art. 6(1)(b) — performance of contract |
| AI-assisted features | Processing invoice content and document data through AI APIs to provide line-item generation, document drafting, and the AI assistant | Art. 6(1)(b) — performance of contract |
| Voice input processing | Converting speech to text when you use the optional voice input button in the AI chat; audio is processed by the browser only — the resulting text transcript is treated as user input | Art. 6(1)(b) — performance of contract (you opt in by clicking the microphone button and granting browser permission) |
| Email agent (Inquiry Capture) | Reading your configured mailbox via OAuth or IMAP to extract business inquiry data | Art. 6(1)(b) — performance of contract (you explicitly enable this feature) |
| Security and fraud prevention | Detecting unauthorised access, abuse, and fraudulent activity; maintaining platform security | Art. 6(1)(f) — legitimate interests (our legitimate interest in keeping the platform secure and protecting other users) |
| Service improvement and analytics | Analysing aggregated usage patterns to improve features and user experience | Art. 6(1)(f) — legitimate interests (our legitimate interest in developing and improving our service). We anonymise usage data where possible. |
| Legal compliance | Meeting obligations under Slovenian and EU law, including tax record-keeping requirements | Art. 6(1)(c) — legal obligation |
| Marketing communications | Sending newsletters, product updates, and promotional content | Art. 6(1)(a) — consent (you can withdraw at any time; see Section 10) |
We share your data with the following categories of recipients:
We do not sell, rent, or trade personal data to third parties for their own marketing purposes.
We use the following sub-processors. Where a provider is based outside the European Economic Area (EEA), we ensure adequate safeguards are in place, typically the European Commission's Standard Contractual Clauses (SCCs) under GDPR Art. 46(2)(c).
| Provider | Purpose | Location | Safeguard |
|---|---|---|---|
| Database and authentication provider | Database hosting, authentication, row-level security | EU (Germany) | Data stored in EEA — no third-country transfer |
| Application hosting provider | Application hosting, edge functions, CDN, anonymised performance monitoring | USA (EU edge nodes used where available) | Standard Contractual Clauses (SCCs) |
| AI processing provider | AI processing — invoice fill, AI assistant, document drafting. Invoice content (line items, amounts, customer names) is sent when you use AI features. | USA | Standard Contractual Clauses (SCCs); does not use API input/output to train models by default |
| Email delivery provider | Transactional email delivery (invoice reminders, system notifications) | USA | Standard Contractual Clauses (SCCs) |
| Open banking provider | Open banking — bank account connections for displaying transaction data in the app (only when you initiate a bank connection) | UK / EU | UK adequacy decision applies; regulated financial institution; DPA in place |
| Identity and email access provider | OAuth authentication (Sign-In); mailbox access when you connect your email account to the AI agent | USA | Standard Contractual Clauses (SCCs) |
| AI provider (optional) | Optional AI provider for enhanced features; only active when you explicitly enable it. Invoice content is sent when enabled. | USA | Standard Contractual Clauses (SCCs) |
| Analytics provider (Google Analytics 4) | Website analytics — page views, session data, traffic sources. Only active after you accept analytics cookies. No advertising or cross-site tracking is enabled. | Ireland (EU) | Data stored in EEA — no third-country transfer; Google Ireland Ltd DPA in place |
Note on browser-based speech recognition: The voice input feature uses your browser's built-in Web Speech API. Depending on your browser, audio may be sent to your browser vendor's servers for transcription. This processing is governed by your browser vendor's own privacy policy, not this Privacy Policy. Slipstrim has no contractual relationship with browser vendors for this purpose and receives only the resulting text transcript.
Your data is stored in the European Union. We apply the following security measures:
When you enable the Inquiry Capture agent or any other agent that requires email or website access, the following applies:
The legal basis for processing email data is contract performance (Art. 6(1)(b)) — you have explicitly enabled this feature to automate your business workflow.
We use cookies and similar local storage technologies as described below. Essential cookies are set automatically as they are strictly necessary for the service to function. Non-essential cookies (analytics, preferences) are only set after you give consent via the cookie banner.
| Cookie name | Provider | Purpose | Expiry |
|---|---|---|---|
| sb-access-token | Slipstrim | Authenticates your session; required to keep you logged in | 1 hour |
| sb-refresh-token | Slipstrim | Renews your authentication session without requiring re-login | 7 days |
| slipstrim_cookie_consent | Slipstrim | Stores your cookie consent choice so you are not asked again | 12 months (localStorage) |
| Cookie name | Provider | Purpose | Expiry |
|---|---|---|---|
| _slipstrim_analytics | Slipstrim (first-party) | Anonymous usage statistics — pages visited, feature interactions. No personally identifiable information is collected. | 90 days |
| _ga | Google Ireland Ltd (third-party) | Google Analytics 4 — distinguishes unique visitors using a randomly generated identifier. No personal data is collected. Only set after analytics consent is granted. | 2 years |
| _ga_* | Google Ireland Ltd (third-party) | Google Analytics 4 — stores and counts page views for this property. Only set after analytics consent is granted. | 2 years |
| Cookie name | Provider | Purpose | Expiry |
|---|---|---|---|
| slipstrim_prefs | Slipstrim (first-party) | Stores UI preferences such as language and display settings | 12 months (localStorage) |
Performance monitoring — We use an anonymised performance monitoring script that collects Web Vitals metrics (page load speed, interaction timing) via your browser's built-in performance API. This script does not set cookies and does not collect personally identifiable information. It is processed by our application hosting provider (see Section 5).
Website analytics (Google Analytics 4) — With your consent, we use Google Analytics 4 (provided by Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland) to collect anonymised data about how visitors use the website — including pages visited, session duration, and traffic sources. No advertising features, remarketing, or cross-site tracking are enabled. Google Analytics 4 uses Consent Mode v2: the script loads on page entry but collects no data until you accept analytics cookies. You can withdraw consent at any time via the Cookie preferences link in the app footer. Legal basis: Art. 6(1)(a) GDPR (consent).
We do not use advertising or cross-site tracking cookies. You may withdraw or change your cookie consent at any time by clicking the "Cookie preferences" link in the app footer or by clearing your browser's cookies and local storage for this site.
We retain your data for as long as your account is active. Retention periods for each category are as follows:
Financial records exception: EU law (VAT Directive 2006/112/EC) and national tax regulations require invoices and related financial documents to be retained for a minimum of 7–10 years depending on your country (e.g. 10 years under Slovenian tax law). If your account contains invoices subject to this obligation, you — as the data controller for your business records — are responsible for maintaining compliant copies before requesting deletion. We will retain only the minimum necessary data to comply with this legal obligation (Art. 6(1)(c)).
As an EU/EEA resident you have the following rights regarding your personal data:
To exercise any right, email legal@slipstrim.io with the subject line "Data Subject Request". We will respond within 30 days. We may ask you to verify your identity before processing your request.
Provision of your name and email address is a contractual requirement to create an account and use the service. Without this data we cannot provide the service. You are not legally obliged to provide it, but if you do not, you will not be able to use Slipstrim.
Where you issue invoices through the service, certain data (VAT number, company address, invoice amounts) may also constitute a statutory requirement under applicable tax law. You are responsible for ensuring your invoices comply with the invoicing rules of your jurisdiction.
We do not carry out any automated decision-making, including profiling, that produces legal effects or similarly significant effects on you within the meaning of GDPR Art. 22. AI features (e.g. line-item suggestions, document drafting) are assistive tools only and all outputs require your review and explicit action before use.
Slipstrim is not directed at children under 16. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us immediately at legal@slipstrim.io.
We may update this policy from time to time. We will notify you by email or via the app at least 14 days before material changes take effect. The "last updated" date at the top of this page reflects the current version. The previous version will remain accessible upon request.
Questions, requests, or concerns relating to your personal data:
legal@slipstrim.io
V2 Labs OÜ, [Registered address], Estonia
You also have the right to lodge a complaint with the Slovenian supervisory authority: Informacijski pooblaščenec, ip-rs.si.