Privacy Policy

1. Introduction

GoMonio is a financial management platform operated by Tilitoimisto Kipinä Oy ("we," "our," or "us"). This Privacy Policy explains how we collect, use, share and protect personal data when you use gomonio.com and the GoMonio application ("Service").

The legal grounds we rely on for each type of processing are described in Section 4.

2. Data Controller and Our Role

2.1 Controller

Tilitoimisto Kipinä Oy is the data controller for the personal data of our users, such as account details, login data, billing and support communications.

• Company: Tilitoimisto Kipinä Oy, Finland
• Privacy contact: support@gomonio.com

2.2 Customer Data We Process on Your Behalf

Companies use GoMonio to keep their books, send invoices and manage cash flow. This data can include personal data about third parties, such as customers, suppliers and employees named in invoices, receipts and bank transactions. For this data, the customer company is the controller and we act as its processor. We process it only to provide the Service and according to the customer's instructions.

3. Information We Collect

3.1 Account and Contact Information

• Account registration information (name, username, email address, password)
• Company and profile information for Business and Agency profiles
• Team member and client invitations
• Support requests and feedback you send us
• Product update and marketing email preferences

3.2 Billing Information

Payments are handled by our merchant of record, Paddle.com. We do not receive or store your card details. We store the subscription and customer identifiers that Paddle gives us, and the company details needed for invoicing.

3.3 Financial Information

• Bookkeeping entries, receipts, purchase and sales invoices, and VAT reports
• Documents and files you upload
• Transactions imported from CSV and Excel files
• Bank account and transaction data, when you connect a bank account through GoCardless Bank Account Data (PSD2)
• Categories, budgets, goals, forecasts and reports

3.4 Technical Information

• Log data (IP address, access times, pages requested)
• Session and login data, including active sessions and devices
• Browser and device information
• Usage statistics collected with Rybbit Analytics (cookieless)
• Error and performance data collected with Sentry
• Cookies and similar technologies, as described in our Cookie Policy

3.5 Agency and Client Data

When an agency, such as an accounting firm, manages a client company in GoMonio, we process the agency-client relationship, its permissions and the invitations between them. Agency users can access a client's data only after the client has authorized it.

4. How We Use Your Information and Legal Basis

• Providing the Service (contract): creating and managing your account, storing and processing your financial data, bank connections, agency-client access, subscriptions and billing, and customer support
• Transactional emails (contract): account verification, login confirmation links, password resets, security notices, invitations, and subscription and billing notices
• Security and improvement (legitimate interest): preventing fraud and abuse, rate limiting, fixing errors, and understanding how the Service is used so we can improve it
• Product updates and marketing emails (consent): only if you opt in. You can unsubscribe at any time.
• Support and feedback widget (consent): Featurebase loads only if you accept it in the cookie settings
• Legal obligations: accounting, tax and other legal requirements, and responding to lawful requests from authorities

5. Service Providers and Data Sharing

5.1 Service Providers

We use the following service providers (sub-processors) to deliver the Service:

• Hetzner Online: servers, database and infrastructure hosting in the EU
• Storadera: storage of uploaded documents and files in Finland
• Paddle.com: merchant of record. Paddle handles payments, invoicing and sales tax, and acts as the seller for all transactions. Paddle's privacy policy is available at paddle.com/legal/privacy.
• GoCardless (Bank Account Data): bank connections and transaction data through PSD2
• Mailjet: sending transactional and marketing emails
• Sentry: error and performance monitoring. Error reports can include your IP address and user identifier. Data is processed in Sentry's EU region.
• Featurebase: support chat, feedback, roadmap and changelog
• Rybbit: cookieless website and usage analytics
• Iconify: some icons are loaded from Iconify's public service, which receives your IP address as part of the request

5.2 Data Processing Agreements

Our service providers process personal data only on our instructions and under data processing terms that meet GDPR requirements. We do not sell, rent or trade your personal data.

5.3 Sharing Within Your Organization

Data in a company profile is visible to the members of that profile according to their roles, and to an agency that the company has authorized to manage its data.

5.4 Legal Disclosures

We may disclose information when required by law or to:

• Comply with legal obligations, court orders or requests from authorities
• Protect against fraud, security threats or illegal activities
• Defend our legal rights

6. Cookies

We use essential cookies to keep you logged in and remember your settings. Optional cookies are only used with your consent. We do not use advertising cookies. See our Cookie Policy for the full list and how to change your choices.

7. Data Security

7.1 Security Measures

• Encryption of data in transit (HTTPS)
• Password hashing with Argon2
• Email confirmation for logins
• Row-level security (RLS) in the database to keep each company's data separate
• Role-based access control within company profiles
• Rate limiting and protection against automated attacks

7.2 Access Controls

Only authorized personnel can access personal data, and only to the extent needed for their work, for example to resolve a support request.

7.3 Data Breach Response

If a personal data breach occurs, we will notify the supervisory authority within 72 hours where required by GDPR, and inform affected users without undue delay when the breach is likely to put them at high risk.

8. Data Retention

8.1 User Accounts

When you delete your account, it is deactivated immediately: you are logged out on all devices and your preferences are deleted. If you do not ask us to reactivate it, the account is permanently deleted one year after deactivation. We send you a reminder email before the deletion. Registrations that are never verified are deleted after one day.

8.2 Company Profiles and Financial Data

While your account and subscription are active, we keep the financial data in your company profile for at least 10 years, so that your accounting records are available for the retention periods required by the Finnish Accounting Act.

When a company profile is deleted, its data is permanently deleted after 30 days. A profile that has no active subscription and none of whose members has logged in for one year is deleted in the same way, after warning emails 30 days and 7 days in advance. Before deleting a profile or letting it lapse, export any records you are required to keep. The company remains responsible for meeting its own legal retention obligations.

If your company stops operating, the owner or an admin can move a company profile on the Free plan to the read-only archive for a one-time fee. Archived data is kept until 10 years after the end of the company's last financial year with bookkeeping, or 10 years after archiving if that is later, and is then permanently deleted. Archived profiles are not deleted for inactivity, and we do not send reminders before an archive is deleted.

8.3 Agency-Client Data

When an agency-client relationship ends, the agency's access to the client's data is revoked immediately. The client's data stays in the client's own profile.

8.4 Email Preferences and Cookie Consent

We keep your product update and marketing preferences until you withdraw your consent or your account is deleted. If you are logged in, we store your cookie choices in your account to show that consent was given. They are deleted when your account is deleted.

8.5 Logs and Error Data

Log, security and error data is kept only for a limited period and then deleted automatically.

9. International Data Transfers

Our servers, database and document storage are located in the European Union. Some service providers are located outside the EU, for example Paddle and GoCardless in the United Kingdom. When personal data is transferred outside the EU or EEA, we rely on:

• European Commission adequacy decisions, such as those for the United Kingdom and the EU-US Data Privacy Framework
• Standard Contractual Clauses (SCCs) where no adequacy decision applies
• Additional technical and organizational safeguards where needed

10. Your Rights Under GDPR

You have the following rights regarding your personal data:

10.1 Right of Access

You can request a copy of the personal data we hold about you. You can also download it yourself from your account settings.

10.2 Right to Rectification

You can correct your personal information in your account settings or ask us to correct it.

10.3 Right to Erasure

You can delete your account in your account settings or ask us to delete your personal data, subject to the retention rules in Section 8 and our legal obligations.

10.4 Right to Data Portability

You can download your personal data as a JSON file from your account settings. Financial data can be exported with the export features of each module.

10.5 Right to Object

You can object to processing based on our legitimate interests, such as usage analytics.

10.6 Right to Restrict Processing

You can ask us to restrict processing in certain situations, for example while we check whether your data is accurate.

10.7 Right to Withdraw Consent

You can withdraw your consent for product update and marketing emails or optional cookies at any time. This does not affect processing that took place before you withdrew it.

10.8 Right to Lodge a Complaint

You can lodge a complaint with a data protection authority. In Finland, this is the Office of the Data Protection Ombudsman (tietosuoja.fi). You can also contact the authority in the EU country where you live or work.

If your data is stored in a company profile managed by your employer or another company, please contact that company first. We will help it respond to your request.

11. Children's Privacy

Our Service is not intended for anyone under 18 years of age. We do not knowingly collect personal data from children under 18. If we learn that we have done so, we will delete it promptly.

12. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, technology or legal requirements. We will notify you of material changes by:

• Email to your registered email address
• A notice within the Service
• Updating the "Last Updated" date at the top of this policy

13. Contact Information

If you have questions about this Privacy Policy or want to exercise your rights, contact us:

• Company: Tilitoimisto Kipinä Oy
• Email: support@gomonio.com
• Support: Contact Support

14. Governing Law

This Privacy Policy is governed by the laws of Finland and the EU General Data Protection Regulation (GDPR). Disputes related to privacy matters are subject to the jurisdiction of Finnish courts, without limiting your right to contact a data protection authority.