Privacy notice
Last updated 9 November 2026
1. Who is responsible
Koncernify is run by [Company name AB], org. nr [org. nr], [Street, postcode, city], Sweden. You can reach us about privacy at privacy@koncernify.com.
2. Our two roles
We are the controller for the data we need to run our own business: your account, billing, support emails and visits to this website.
We are a processor for what a customer puts into a workspace: journals, ledger data read through a connection, review decisions, reports and the people in the workspace. The customer decides how that data is used. Our data processing agreement sets out how we handle it. If your employer uses Koncernify and you have questions about that data, ask them first.
3. What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Your email address and name, from Google or Microsoft when you sign in | To create your account, show who made each decision and record it with each decision you sign | Contract (GDPR art. 6.1.b) |
| Workspace membership and role | To decide what you can see and approve | Contract |
| A sign-in cookie | To keep you signed in for up to 12 hours | Contract |
| IP address, held for a few minutes | To limit how many requests one address can make, which stops abuse | Legitimate interest in keeping the service safe (art. 6.1.f) |
| Billing details: company name, billing email, subscription status | To charge for the service. Stripe holds the card details. We never see them. | Contract, and bookkeeping law (art. 6.1.c) |
| Emails you send us | To answer you | Legitimate interest in giving support |
This website sets no cookies and runs no analytics or advertising trackers. We do not sell personal data, and we do not use it for advertising.
4. AI features
Each workspace chooses where its AI runs. An owner sets it, and a new workspace starts with it off. With the AI off, nothing is sent to a model. With our model, the following applies. With the workspace's own endpoint, the same data goes to that endpoint instead, under the customer's own agreement with its provider.
When someone in a workspace uses the box, what they type and the workspace's chart of accounts are sent to the AI model, Claude, which we run on Amazon Bedrock. For a question about the month, the figures we already hold for that month are sent with it. Nothing is sent unless a person uses the box. The requests are processed only in AWS regions inside the EU. AWS does not use them to train models and does not share them with Anthropic, which makes the model. We do not use customer data to train any model either.
5. Who we share data with
We use a small number of providers to run the service. They are listed with their purpose and location on the subprocessors page. They may only use the data to provide their service to us.
Accounting systems that a customer connects, such as Fortnox or Spiris, are the customer's own suppliers. We read from and write to them only on the customer's instruction.
We will disclose data to authorities only when the law requires it.
6. Transfers outside the EU
Our AI model runs only inside the EU. Some of our other providers, such as those for sign-in, are based in the United States. Where data leaves the EU or EEA, we rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses.
7. How long we keep data
- Account data: while you are a member of a workspace. You can delete your account yourself, from the list of your workspaces. If you leave every workspace, we delete your account within 30 days. Your email address stays on decisions you signed, because the record would break without it. That part belongs to the workspace's records.
- Workspace data: for as long as the customer keeps the subscription. After it ends, we delete it 90 days later. An owner can download it before then, or delete it sooner. The record of journals approved for a real ledger is the customer's accounting records: it keeps the names and email addresses of the people who prepared and approved them, and we keep it read-only until the end of the eighth calendar year after the latest journal date, because bookkeeping law requires the customer to keep it (art. 6.1.c).
- Billing records: seven years, as Swedish bookkeeping law requires.
- IP addresses for rate limits: a few minutes.
- Support emails: up to two years after the conversation ends.
8. Your rights
You can ask for a copy of your personal data, ask us to correct it or delete it, object to how we use it, ask us to restrict it, or ask to have it in a format you can move. Email privacy@koncernify.com. We answer within one month.
You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se, or to the authority in the country where you live.
9. Security
Connections are encrypted. Tokens for connected ledgers are encrypted where they are stored. Every review decision is signed, so a change to the record can be detected. More detail is on the security page.
10. Changes
If we change this notice in a way that matters, we will tell workspace owners by email before the change takes effect. The date at the top shows the latest version.