Privacy Policy

1. Identity and Contact Details of the Controller

The data controller responsible for your personal data is:

No Data Protection Officer (DPO) has been appointed. Slipstrim does not meet the thresholds requiring mandatory DPO appointment under GDPR Art. 37. All data protection queries should be directed to legal@slipstrim.io.

2. Data We Collect

We collect only what is necessary to provide the service:

• Account data — email address, name, and password (hashed with bcrypt, never stored in plain text)
• Company data — company name, address, VAT number, bank details you enter in settings
• Document data — invoices, proformas, line items, customer records you create
• Voice input data — when you use the optional voice input feature in the AI chat, speech is processed locally by your browser's built-in speech recognition engine (Web Speech API). Slipstrim does not receive, record or store your audio. Only the resulting text transcript is transmitted to the Service, in the same way as typed input
• Bank connection data — where you connect a bank account via our open banking integration (invite-only beta), we receive read-only transaction data (account name, IBAN, balance, transaction history) necessary to display bank information in the app
• Usage data — pages visited, features used, actions taken; collected to improve the service
• Technical data — IP address, browser type, device type, timestamps, error logs

We do not collect payment card numbers. We do not sell your data to third parties.

3. Purposes and Legal Basis for Processing

We process your personal data only where we have a valid legal basis. The table below sets out each category of processing, its purpose, and the applicable legal basis under GDPR Art. 6.

4. Recipients and Categories of Recipients

We share your data with the following categories of recipients:

• Sub-processors — technology providers we engage to deliver the service (listed in Section 5)
• Meta Platforms Ireland Ltd — only if you accept marketing cookies: data collected by the Meta Pixel and the copies of our events that our server sends through the Conversions API, for which we and Meta are joint controllers (see Section 8)
• Accountants you invite — if you grant an accountant access to your account, they can view your documents and customer records
• Tax authorities, when you use fiscal features — when you confirm or submit an invoice, its data (including your and your customer's details) is sent to the Financial Administration of the Republic of Slovenia (FURS), the Croatian Tax Administration (Porezna uprava) or the Polish Ministry of Finance (KSeF). They receive it as independent controllers under their own legal obligations.
• European Commission (VIES) — when you look up a VAT number, that number is sent to the EU VIES service to fetch the company's name and address.
• Legal or regulatory authorities — where required by law, court order, or to protect our legal rights
• Acquirers — in the event of a merger, acquisition, or sale of assets, personal data may be transferred; we will notify you in advance

We do not sell, rent, or trade personal data to third parties for their own marketing purposes.

5. Sub-processors and International Transfers

We use the following sub-processors. Where a provider is based outside the European Economic Area (EEA), we ensure adequate safeguards are in place, typically the European Commission's Standard Contractual Clauses (SCCs) under GDPR Art. 46(2)(c).

Note on browser-based speech recognition: The voice input feature uses your browser's built-in Web Speech API. Depending on your browser, audio may be sent to your browser vendor's servers for transcription. This processing is governed by your browser vendor's own privacy policy, not this Privacy Policy. Slipstrim has no contractual relationship with browser vendors for this purpose and receives only the resulting text transcript.

6. Data Storage and Security

We apply the following security measures:

• AES-256-GCM encryption of your stored business data (settings, customers, documents), done in your browser with a key held on your device before the data is saved
• TLS 1.2+ for all data in transit
• Row-level security so users can only access their own data
• 15-minute automatic session timeout
• Optional two-factor authentication (TOTP)

Some features need to read data on our servers to work: AI features, sending email, fiscal confirmation and KSeF submission, and VAT lookups. For these, the data needed is decrypted in your browser and sent over TLS to our server functions and the providers listed in Section 5. It is not stored there unencrypted, except where a provider keeps its own records (for example a tax authority or an email you send).

When you add a calendar event to your phone or computer calendar, its title, date and time leave your browser unencrypted: on iPhone they pass through our server, which returns them as a calendar file and stores nothing; on Android they go to Google Calendar, which you open in a new tab. You can turn this off in Settings.

7. AI Agents — Email and Website Access

When you enable the Inquiry Capture agent or any other agent that requires email or website access, the following applies:

• OAuth only — We use OAuth 2.0 for email connections. We never see or store your email password. You authenticate directly with your email provider and grant us a limited, revocable access token.
• Read-only access — We request the minimum scope required (read-only). The agent cannot send, delete or modify your emails.
• Zero email retention — Raw email content is processed in memory only. We extract structured data (sender name, contact details, service requested) and immediately discard the original message. Email bodies are never written to our database or logs.
• What we store — Only the extracted structured data: customer name, email address, phone number, and a summary note. This is stored encrypted in your account using AES-256-GCM with a key held on your device.
• IMAP / custom domain — If you connect via IMAP, you provide an app-specific password (not your main account password). This credential is stored encrypted in your vault and used solely to read the configured mailbox.
• Revoking access — You can disconnect any connected account at any time from Agent settings. You can also revoke access directly from your email provider's account security settings.
• Third-party inquirers — When a third party sends you an inquiry, their personal data (name, email) is processed to create a customer record in your account. You, as the business owner, are the data controller for that individual's data. Slipstrim acts as a data processor on your behalf.

The legal basis for processing email data is contract performance (Art. 6(1)(b)) — you have explicitly enabled this feature to automate your business workflow.

8. Cookies and Similar Technologies

We use cookies and similar local storage technologies as described below. Essential cookies are set automatically as they are strictly necessary for the service to function. Non-essential cookies (analytics, marketing) are only set after you give consent via the cookie banner, and the scripts that set them are not loaded before then.

Essential cookies (always active)

Analytics cookies (requires consent)

Marketing cookies (requires consent)

Performance monitoring — Our application hosting provider's Speed Insights and Web Analytics measure page load speed and count page visits without cookies or device identifiers; visits are told apart only by a hash of the request that is discarded within 24 hours. The results are aggregated and do not identify you. Legal basis: Art. 6(1)(f) GDPR (legitimate interests); see Section 5.

Website analytics (Google Analytics 4) — With your consent to analytics cookies, we use Google Analytics 4 (Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland) to measure which pages are visited, how long visits last, where visitors come from and how they move through sign-up. The data is pseudonymous: it is linked to the random identifier in the _ga cookie, not to your name or email address. Google Signals, advertising features and ad personalisation are disabled. The Google script is not loaded at all until you accept analytics cookies. Legal basis: Art. 6(1)(a) GDPR (consent) and Art. 5(3) ePrivacy Directive.

Advertising measurement (Meta Pixel and Conversions API) — With your consent to marketing cookies, we use the Meta Pixel of Meta Platforms Ireland Ltd (Merrion Road, Dublin 4, D04 X2K5, Ireland) to learn whether our ads on Facebook and Instagram lead to visits and sign-ups. The Pixel sends Meta the page address, the event and its details (for example that a sign-up was completed, whether it was a user or an accountant account, the interface language and the campaign you came from), your IP address, browser information and the _fbp and _fbc identifiers. We have turned off the Pixel's automatic collection of button clicks and page content. For the events we send (for example a completed sign-up), our server also sends Meta a copy through the Meta Conversions API, so the event is not lost to ad blockers. Both copies carry the same event ID, so Meta counts them once. The server copy contains the same event details, your IP address, your browser's user agent and the _fbp and _fbc values. We never send your name, email address or phone number. Meta may link this data to your Facebook or Instagram account and use it for its own purposes, including ad delivery. For the collection and transmission of this data, we and Meta are joint controllers under Art. 26 GDPR, on the terms of Meta's Controller Addendum (facebook.com/legal/controller_addendum); Meta is solely responsible for what it does with the data afterwards, described in its Privacy Policy (facebook.com/privacy/policy). You can exercise your rights against us or against Meta. Meta may transfer the data to Meta Platforms, Inc. in the USA, which is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR). The Meta script is not loaded, and no server copy is sent, until you accept marketing cookies. Legal basis: Art. 6(1)(a) GDPR (consent) and Art. 5(3) ePrivacy Directive.

Changing or withdrawing consent — You can change or withdraw your consent at any time, as easily as you gave it: use Cookie settings in the website footer, the button below, or Settings → Legal & Privacy in the app. When you withdraw, we tell Google Analytics and the Meta Pixel to stop, delete their cookies on this site and stop loading their scripts. Our server then stops sending Conversions API copies. Withdrawal does not affect the lawfulness of processing before it (Art. 7(3) GDPR). We ask for your consent again after 12 months, or sooner if we add a new purpose.

9. Data Retention

We retain your data for as long as your account is active. Retention periods for each category are as follows:

• Account and company data — retained for the duration of your account. Deleted immediately when you delete your account in Account Settings → Delete.
• Document data (invoices, proformas) — retained for the duration of your account and deleted immediately with it — see the note on financial records below.
• Usage and technical data (logs, analytics) — retained for a maximum of 12 months, then deleted or anonymised.
• Google Analytics data — event-level data is deleted by Google after at most 14 months (our retention setting); aggregated reports contain no identifiers.
• Meta Pixel and Conversions API data — Meta keeps the data it receives according to its own Privacy Policy; we do not store this data ourselves.
• Email agent extracted data — retained until you delete the customer record or your account, whichever is sooner.
• Bank connection data — transaction data from our open banking provider is not persistently stored beyond display purposes; access tokens are stored encrypted and deleted when you disconnect.

Financial records exception: EU law (VAT Directive 2006/112/EC) and national tax rules require invoices to be kept for several years (for example 10 years in Slovenia, 5 years in Poland). As the controller of your business records, this obligation is yours. Deleting your account removes your invoices from Slipstrim immediately and we keep no copy, so export them first (Settings → Export). Afterwards we keep only: your email address on our unsubscribe list, if you unsubscribed; failed-login records, which expire on their own; roadmap votes and promotion-claim records with your user ID removed; and, for a limited time, our hosting provider's encrypted backups until they rotate out.

10. Your Rights Under GDPR

As an EU/EEA resident you have the following rights regarding your personal data:

• Right of access (Art. 15) — request a copy of the personal data we hold about you
• Right to rectification (Art. 16) — correct inaccurate or incomplete data
• Right to erasure / right to be forgotten (Art. 17) — request deletion of your personal data where there is no overriding legal basis to retain it. You can initiate account deletion directly from Account Settings → Delete tab. Deleting your account in Settings takes effect immediately; requests sent by email are handled within 30 days.
• Right to data portability (Art. 20) — receive your personal data in a structured, commonly used, machine-readable format (JSON or CSV). To request a data export, email legal@slipstrim.io or use the Export function in Settings. We will deliver your data within 30 days.
• Right to restriction of processing (Art. 18) — request that we limit how we process your data in certain circumstances
• Right to object (Art. 21) — object to processing based on our legitimate interests (e.g. security monitoring or performance measurement). We will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent (Art. 7(3)) — where processing is based on consent (marketing emails, non-essential cookies), you may withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint — you have the right to lodge a complaint with the supervisory authority in your country. The competent authority in Slovenia is the Informacijski pooblaščenec (Information Commissioner), Dunajska cesta 22, 1000 Ljubljana, Slovenia — ip-rs.si, +386 1 230 97 30.

To exercise any right, email legal@slipstrim.io with the subject line "Data Subject Request". We will respond within 30 days. We may ask you to verify your identity before processing your request.

11. Provision of Data — Contractual and Statutory Requirements

Provision of your name and email address is a contractual requirement to create an account and use the service. Without this data we cannot provide the service. You are not legally obliged to provide it, but if you do not, you will not be able to use Slipstrim.

Where you issue invoices through the service, certain data (VAT number, company address, invoice amounts) may also constitute a statutory requirement under applicable tax law. You are responsible for ensuring your invoices comply with the invoicing rules of your jurisdiction.

12. Automated Decision-Making and Profiling

We do not carry out any automated decision-making, including profiling, that produces legal effects or similarly significant effects on you within the meaning of GDPR Art. 22. AI features (e.g. line-item suggestions, document drafting) are assistive tools only and all outputs require your review and explicit action before use.

13. Children

Slipstrim is not directed at children under 16. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us immediately at legal@slipstrim.io.

14. Changes to This Policy

We may update this policy from time to time. We will notify you by email or via the app at least 14 days before material changes take effect. The "last updated" date at the top of this page reflects the current version. The previous version will remain accessible upon request.

15. Contact

Questions, requests, or concerns relating to your personal data:

legal@slipstrim.io
V2 Labs OÜ, Ahtri tn 12, Kesklinna linnaosa, Tallinn, Harju maakond, 15551, Estonia

Imprint · Terms of Service

You also have the right to lodge a complaint with the Slovenian supervisory authority: Informacijski pooblaščenec, ip-rs.si.