SoftbooqSoftbooq
Privacy Policy
Last updated: October 2026
Everbright & Co. ("Softbooq", "we", "our", or "us"), operating from Germany, European Union, is committed to protecting your personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable data protection laws. This policy explains what data we collect, why, how it is processed, and your rights.
1. Who Is Responsible for Your Data
Softbooq is provided by Cypran Akubude, operating as Everbright & Co., c/o Postflex #10549, Emsdettener Str. 10, 48268 Greven, Germany. Email: info@softbooq.com. We are the data controller for the personal data we use to run Softbooq itself: your Softbooq account and how you sign in, billing, the support you ask us for, our websites, and the emails we send you about your account. For the data a business keeps in its Softbooq workspace, including the personal data of its employees, customers and suppliers, that business is the data controller. We process that data on its behalf, as its processor, under the data processing agreement in our Terms (section 10). If you are an employee, customer or supplier of a business that uses Softbooq, please contact that business about your data first. We will help it answer you.
2. Data We Collect
We collect and process the following categories of data: Account and identity data: name, work email, organisation name, country, and workspace credentials. Employee and HR data (Pro plan): full name, contact details, job title, employment type, salary and compensation, bank account details (IBAN, sort codes) for payroll, emergency contacts, attendance and clock-in/out records, leave requests, payslips, deductions, bonuses, and payroll run history. Customer and contact data: customer names, email addresses, phone numbers, postal addresses, and company details entered by you or synchronised from connected CRM platforms (HubSpot). Financial and transaction data: invoice amounts, payment status, purchase orders, expense records, vendor details, bank connection data (via open banking), payment run records, and accounting journal entries synchronised with the accounting platforms you connect (see section 5). E-commerce data: orders, products, inventory levels, and customer records synchronised from connected online stores (Shopify, WooCommerce), and orders placed in a business's own online shop on Softbooq, including a delivery location when the shopper chooses to share one (see section 11). Project and task data: project names, task assignments, due dates, and status updates synchronised with the project management tools you connect (see section 5). IT and device data: managed device names, serial numbers, compliance status, and assigned user information entered by you. Contract and legal data: contract parties, dates, values, payment terms, and document content. Travel data: trip destinations, dates, accommodation, per diem claims and expense reports. Document and file data: images and content of documents you submit for AI processing (receipts, invoices, contracts, ID documents, business cards, resumes); file names and metadata from connected cloud storage accounts. Usage data: pages visited, feature usage, error logs, and session metadata used to maintain and improve the platform.
3. Legal Basis for Processing
We process your personal data on the following legal bases under GDPR Article 6: Contract performance (Art. 6(1)(b)): to provide, operate, and maintain the Softbooq service you have subscribed to. Legitimate interests (Art. 6(1)(f)): to ensure platform security, prevent fraud, and improve the service. Legal obligation (Art. 6(1)(c)): where required by applicable German, EU, or other applicable law. Consent (Art. 6(1)(a)): where explicitly provided by you, such as when enabling optional integrations. For special categories of data (e.g., where salary data intersects with health-related deductions), processing is based on explicit consent or as necessary for employment law obligations under Art. 9(2)(b).
4. AI & Machine Learning Processing
Softbooq's AI features are powered by the following large language model services: Anthropic Claude (Anthropic PBC, USA): the Softbooq AI assistant (conversations in both chat tiers, financial and business-intelligence questions, weekly briefings, document summaries and actions inside the platform), reading documents (OCR and data extraction from receipts, invoices, expenses, leases and other uploads), inline writing actions, automation steps and the setup assistant. Data sent: Your questions and conversation history, summaries of the workspace records relevant to the question (for example invoices, contracts, employee profiles, projects), and the images and text of the documents you submit or ask the assistant to analyse (receipts, invoices, contracts, expense photos, ID documents, business cards, resumes). What the provider keeps: Anthropic deletes requests and responses within 30 days. If its automated safety systems flag a request under its Usage Policy, it may keep that request for up to 2 years and the safety scores for up to 7 years, and it keeps data longer where the law requires. It does not use them to train its models without the customer's express permission. Google Gemini (Google LLC, USA): search embeddings (turning record and document text into search vectors), and a backup model for the fast chat tier, inline writing actions, automation steps, the setup assistant and travel-policy rates, used only when Anthropic does not answer. Data sent: Record and document text sent for search indexing; and, only when it stands in for Anthropic, the messages and record context of that one request. Document images are not sent to Google. What the provider keeps: Google keeps the requests and responses of its paid Gemini API for 55 days, solely to detect and prevent violations of its Prohibited Use Policy and for legally required disclosures; authorised Google staff may review them for that purpose. Google does not use them to improve its products, and trains no model on these logs other than the systems that enforce its policies. Important disclosures: - Softbooq does not use your business data to train AI models - Anthropic processes data under its API Terms of Service and does not use API input/output to train its models by default - Google processes data under Google's API Terms of Service; by default, Google does not use API input/output to train its models - AI-generated responses may contain errors and should be reviewed before acting on them - You can disable AI features at any time in Settings > Softbooq AI - Standard Contractual Clauses (SCCs) are in place with both Anthropic PBC and Google LLC for international data transfers Data transmitted to AI providers is used to generate responses to your queries. How long each provider keeps it, and why, is set out above.
5. Third-Party Sub-Processors
We use the following third-party services to operate the platform. Each acts as a sub-processor of personal data under its own privacy policy and a data processing agreement with Softbooq. Core sub-processors (used for every workspace): - Supabase (Supabase Inc., AWS eu-central-1, Frankfurt, Germany): authentication, database, file storage and serverless functions. - Stripe (Stripe Payments Europe, Limited, USA / EU): subscription billing and payment processing, including Stripe Connect payments; card data is entered with Stripe and never stored on Softbooq servers. - Brevo (Sendinblue SAS, EU): transactional email delivery. - Cloudflare (Cloudflare Inc., global edge network; backups in the EU): application hosting and content delivery (Cloudflare Pages and Workers), and storage of encrypted backups (R2). - GitHub Actions (GitHub, Inc., USA): running the nightly and weekly backup jobs, which encrypt the copies before they are stored. - Anthropic Claude (Anthropic PBC, USA): the Softbooq AI assistant (conversations in both chat tiers, financial and business-intelligence questions, weekly briefings, document summaries and actions inside the platform), reading documents (OCR and data extraction from receipts, invoices, expenses, leases and other uploads), inline writing actions, automation steps and the setup assistant. - Google Gemini (Google LLC, USA): search embeddings (turning record and document text into search vectors), and a backup model for the fast chat tier, inline writing actions, automation steps, the setup assistant and travel-policy rates, used only when Anthropic does not answer. Services you connect (optional): When an administrator of your workspace connects another service, such as an accounting tool, a cloud drive or an online shop, Softbooq sends it the personal data needed for what you connected it to do, and nothing before it is connected. Each service a workspace can connect, the company that runs it, its country and what it receives are listed on the Third-party services page at softbooq.com/third-party-services, which changes when a service is added or removed. Your own SMTP server, if you set one up for sending email, is configured by your administrator and subject to that provider's terms. Bot protection: - Cloudflare Turnstile (Cloudflare Inc.): bot protection on login forms using strictly necessary cookies. No cross-site tracking.
6. Data Storage & Infrastructure
Your data is stored and processed in AWS Europe (Frankfurt, eu-central-1). All database, authentication, and serverless infrastructure is hosted within the EU. API credentials and secrets are stored encrypted at rest, in database tables that only Softbooq's servers can read. We do not transfer your personal data outside the European Economic Area without appropriate safeguards. Standard Contractual Clauses (SCCs) are in place with providers based outside the EEA, including Anthropic PBC (USA), Google LLC (USA) and GitHub, Inc. (USA). A service you connect applies its own safeguards for transfers; its country is shown on the Third-party services page.
7. Data Retention
We retain your data for as long as your account is active or as needed to provide the service. If you delete your personal Softbooq account, your personal data is deleted or anonymised within 30 days, except what the law requires us to keep. If a free trial ends without a plan being chosen, the workspace becomes read-only, so everything in it can still be read and exported, and it is cancelled 14 days later. A cancelled workspace, or one that is closed, is permanently deleted 90 days after it was cancelled or closed, unless a document in it is under legal hold; until then it can be reopened. We email the workspace's administrators 30, 7 and 1 day before it is deleted. Encrypted backup copies, kept in the EU, may hold deleted data for up to 14 more weeks before it is removed from them. AI conversations, in the assistant in Softbooq and in the Softbooq AI app, are deleted once they have gone unused for the period the workspace chose in Settings > Softbooq AI: 24 months unless an administrator chooses 6, 12 or 36 months, or to keep them indefinitely. None of them is deleted while the workspace is under legal hold. Documents generated in a conversation are deleted with it; the log of actions the assistant took is kept. A business that uses Softbooq is responsible for keeping the records the law requires it to keep, such as its accounts under German commercial law (HGB § 257), and should export them before its workspace is deleted. We keep our own billing records for as long as the law requires us to. You may request an export of your data at any time prior to deletion by contacting info@softbooq.com.
8. Your Rights (GDPR)
Under the GDPR, you have the following rights: Right of Access (Art. 15): request a copy of your personal data. Right to Rectification (Art. 16): correct inaccurate or incomplete data. Right to Erasure (Art. 17): request deletion of your data ('right to be forgotten'). Right to Restriction (Art. 18): restrict how we process your data. Right to Data Portability (Art. 20): receive your data in a structured, machine-readable format. Right to Object (Art. 21): object to processing based on legitimate interests. Right to withdraw consent (Art. 7): where processing is based on consent, you may withdraw it at any time. To exercise any of these rights, contact us at info@softbooq.com. We will respond without undue delay and in any event within one month of receiving your request (GDPR Art. 12(3)).
9. Data Breach Notification
In the event of a personal data breach, Softbooq will: - Notify the relevant supervisory authority (for us: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit; or the authority of the affected EU member state) within 72 hours of becoming aware of the breach, where it is likely to result in a risk to your rights and freedoms (GDPR Art. 33). - Notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms (GDPR Art. 34). - Maintain an internal record of all data breaches, including those not meeting the notification threshold. Notifications will be sent to the primary account email address on file.
11. Customer Accounts, Delivery Locations and the Supplier Portal
A business using Softbooq can let its customers sign in to a customer account on the business's public site, and can give its suppliers a personal link to a supplier portal. Customer accounts. A customer signs in with their email address and a six-digit code we email to them. The code works once and stops working after 10 minutes. A customer can sign in when their email address is on the business's record for them, unless the business has turned this off, or when the business invites them. We keep the customer's email address, which of the business's customer records they are linked to, and a record of what they do in the account, such as downloading an invoice, starting a payment or raising a support request, with the IP address for some of those actions. A signed-in session lasts one hour and is kept only in the customer's browser tab. In the account, the customer sees the invoices, orders, quotes, contracts, bookings and other records the business keeps for them, and any files the business chooses to share. Payments, saved cards and direct-debit mandates are handled by Stripe, on the business's own Stripe account; we keep only Stripe's reference and, for a mandate, the last four digits of the account. Sign-in emails are sent through the email provider the business has chosen, or through our default provider. Delivery location. At the checkout of a business's online shop, a shopper whose order is delivered can share exactly where to deliver: by choosing "Use my current location", after which their browser asks for permission, or by pasting a Google Maps link or Plus Code. We store that map point with the order, with the accuracy the phone reported, and give it to the business and the person delivering the order. It is collected only when the shopper takes one of these actions, never in the background, and is used only to deliver the order. A customer can also add a point to a delivery address saved in their customer account, for their later deliveries. If the business or the person delivering opens the point in a map app such as Google Maps or Waze, that app's provider receives it under its own privacy policy. Supplier portal. A business can send a supplier a personal link, valid for the period the business chooses (up to 90 days) and revocable at any time. We keep only a fingerprint of the link, not the link itself. Through it, the supplier sees their open purchase orders, the requests for quotation they are invited to and the payment status of their orders, and can acknowledge an order and post delivery updates. We keep when the link was last used, and the supplier's acknowledgements and updates. Who is responsible. For customer accounts, delivery locations and the supplier portal, the business is the data controller, and Softbooq processes this data on its behalf as a processor (see section 1). The business is responsible for having a lawful basis for giving this access and for informing its customers and suppliers how their data is used. Anyone the business allows to manage customers can remove a customer's access at any time; it ends at once, and the person can return only if invited again. A customer can download their data from the account and ask for it to be erased; the request goes to the business, which decides on it. Softbooq is not a party to the relationship between a business and its customers or suppliers. How long we keep it. Sign-in emails are deleted the day after they are sent. Rate-limiting records, which can contain an email or IP address, are deleted within two days. A supplier link is deleted 30 days after it expires or is revoked. When a business approves a customer's erasure request, their name and contact details are removed from its records, the IP addresses are cleared from their activity record, and their sign-in is deleted unless they are still linked to another business on Softbooq. A delivery location is kept with its order and delivery for as long as the business keeps them, and a point saved with an address until the customer changes or removes that address. When a workspace is deleted, everything above that belongs to it is deleted with it, including the sign-ins of customers who were linked only to that business. A business on legal hold keeps its records until the hold is lifted.
12. Your Responsibilities
When you connect third-party services to Softbooq - such as payment providers (Wise, Revolut), cloud storage, accounting platforms, CRM, project management tools, or email providers - you are responsible for: - Ensuring you have the authority to connect those accounts to Softbooq - The security of API credentials, access tokens, and passwords you provide - Any transactions, data access, or costs incurred through those connected accounts - Complying with those third-party providers' terms of service - Where connecting services that process personal data of third parties (e.g., Shopify customer records, HubSpot contacts), ensuring you have a lawful basis under GDPR for that data processing Softbooq acts as a conduit when accessing connected third-party accounts. Disconnecting a service in Softbooq stops Softbooq using it. Where the provider allows it, it also ends Softbooq's access at the provider; where it does not, also remove Softbooq's access in that provider's own settings.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification. Your continued use of the platform after such notification constitutes acceptance of the updated policy.
14. Contact & Complaints
For privacy-related questions or to exercise your data rights, contact us at info@softbooq.com. If you believe your rights have been violated, you have the right to lodge a complaint with your national data protection authority. The supervisory authority competent for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI), Wilhelmstraße 7, 65185 Wiesbaden, Germany, https://datenschutz.hessen.de.