Privacy Policy

Data controller

The controller of personal data is the operator of the Zettl platform:

1. Scope of processed data

1.1 Identification and contact data

• First name, surname, email address
• Company name, business address (street, city, postal code, country)
• Company ID, VAT ID, VAT payer status
• Language and currency preferences, display preferences

1.2 Financial data

• Bank transaction records (date, description, amount, currency, category)
• Invoices including line items, pro forma invoices, credit notes
• Receipt files and extracted metadata
• Bank API credentials (encrypted tokens)
• Client records (encrypted)
• Budget line items and expense records
• Billing details and subscription payment history (once payments launch); payment card details are processed by Stripe directly and the controller never sees them

1.3 Technical and operational data

• IP addresses (audit logs)
• User agent strings (audit logs)
• Email processing logs (sender, subject, attachment count, status)
• Synchronisation error logs
• Rate limit counters
• OAuth tokens for Google Drive (encrypted)
• Application error reports and recordings of a sample of sessions with text masked (Sentry)

2. Purposes of processing and legal basis

3. Recipients and processors

Personal data may be disclosed to the following categories of recipients (processors):

The database and uploaded files are stored in the EU (Ireland), error reports in the EU (Germany). Some processors, however, are US companies or run global infrastructure, so personal data may be transferred outside the EU by processors marked “EU/USA” or “USA”, and by US-based processors even where data is stored in the EU. Such transfers rely on the European Commission's adequacy decision (EU-US Data Privacy Framework) for certified recipients and otherwise on standard contractual clauses (Art. 46 GDPR). When web fonts are loaded from Google Fonts, Google LLC processes the visitor's IP address. Our sign-in and access-request forms use Cloudflare Turnstile: to tell people from bots, Cloudflare processes the IP address and technical browser and device data. The legal basis for both is our legitimate interest in keeping the service secure and working (Art. 6(1)(f) GDPR).

4. Security of personal data

• Encryption at rest: AES-GCM field-level encryption using PBKDF2-derived keys
• Encryption in transit: HTTPS/TLS for all communication
• Row Level Security: PostgreSQL RLS — users only access their own data or organisation-shared data
• Audit logs: logging of all sensitive operations
• Sign-in protection: CAPTCHA (Cloudflare Turnstile) and rate limiting
• Backups: daily encrypted backups kept for 30 days

5. Retention periods

• Active account data: for the lifetime of the account
• After the subscription or trial ends: 12 months in read-only mode (viewing and export), then deletion no earlier than 30 days after an e-mail notice
• After account deletion: database records and the document and logo files the Platform holds are deleted without undue delay, within 30 days at the latest; from backups within a further 30 days. Files no longer linked to any record are deleted within 30 days of a request sent to info@idex-corp.com
• Accounting documents for subscription payments: for the period required by accounting and tax law
• Audit logs: 12 months from creation
• Email processing logs: 6 months

6. Data subject rights

Under the GDPR you have the following rights:

• Right of access (Art. 15 GDPR) — confirmation of processing and a copy of data
• Right to rectification (Art. 16 GDPR) — correct inaccurate data
• Right to erasure (Art. 17 GDPR) — “right to be forgotten”
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR) — export in JSON format
• Right to object (Art. 21 GDPR) — to processing based on legitimate interests
• Right to withdraw consent — at any time, without affecting prior lawful processing
• Right to lodge a complaint — with the Czech Office for Personal Data Protection (www.uoou.cz)

You can exercise your rights by emailing info@idex-corp.com. We will respond without undue delay, within 30 days at the latest.

7. Export and deletion

The Platform allows full export of user data in JSON format (transactions, invoices, receipts, clients, matching, audit logs).

Account and data deletion are available through Platform settings or by request to the controller’s email.

8. Automated decision-making and profiling

The Platform uses AI features to extract data from documents and match transactions. This is automated processing, not automated decision-making with legal effects within the meaning of Art. 22 GDPR.

Data read from documents is saved straight away, and the user can correct it at any time. A match with a score of at least 70 out of 100 is applied automatically, without the user's confirmation; based on a verified incoming payment, the Platform may also mark an issued invoice as paid. A match of a document with a payment can be undone with one click; an invoice marked as paid is reverted by changing its status. Users must check the results before relying on them.

9. Changes to this policy

We will inform you of changes by email or notices on the Platform. The current version is always available on the Platform.

10. Contact