Effective: September 2026 ยท Last updated: September 2026
KontraBooks is a cloud-based accounting platform for small and medium-sized businesses. We are the data controller for information collected through our website and service at kontrabooks.com. For questions about this policy, contact us at privacy@kontrabooks.com.
This policy applies to all personal data we collect and process when you visit our website, create an account, or use the KontraBooks service. It covers our obligations under the EU General Data Protection Regulation (GDPR) and applicable global privacy laws. As GDPR sets the highest applicable standard, complying with it satisfies our obligations worldwide.
KontraBooks operates as a data processor for the financial and business data you enter into the platform (which belongs to you), and as a data controller for personal data we collect to operate the service (your account information, usage data, and communications with us).
Account and identity data
First name, last name, email address, and password (stored as a hashed value we cannot read). We do not store your password in any recoverable form.
Business data
Company name, base currency, tax registration status, and plan tier. This is configuration data, not personal data in most cases.
Financial data you enter
Invoices, bills, expenses, contacts, payments, journal entries, and reports. This data belongs to you. We process it only to provide the service.
Technical and usage data
IP address, browser type, device type, operating system, timezone, pages visited, and timestamps. Collected automatically when you use the service.
Communications
Emails you send to us, support requests, and feedback. We retain these to resolve your issue and improve the service.
We do not purchase data from third parties or use data brokers.
| Purpose | Lawful basis (GDPR Article 6) |
|---|---|
| Providing the accounting service | Contract performance (Art. 6(1)(b)) |
| Sending transactional emails (verification, invoices, reminders) | Contract performance (Art. 6(1)(b)) |
| Billing and subscription management | Contract performance (Art. 6(1)(b)) |
| Retaining financial records | Legal obligation (Art. 6(1)(c)) - financial records are subject to statutory retention requirements |
| Security, fraud prevention, and abuse detection | Legitimate interests (Art. 6(1)(f)) |
| Product improvement and bug fixing | Legitimate interests (Art. 6(1)(f)) |
| Responding to support requests | Legitimate interests (Art. 6(1)(f)) |
| Sending product update emails (where opted in) | Consent (Art. 6(1)(a)) |
We do not sell, rent, or trade your personal data. We share data only with the sub-processors required to operate the service, and only to the extent necessary. A complete, current list of our sub-processors is available at kontrabooks.com/legal/subprocessors.
We may disclose personal data to law enforcement or regulatory authorities if required by law, court order, or to protect the rights and safety of our users or the public. We will notify you of such requests where legally permitted to do so.
In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity, subject to the same privacy protections described in this policy.
Your data is hosted on cloud infrastructure located in the European Union. Some of our sub-processors operate outside the EU/EEA. Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or we rely on adequacy decisions where applicable.
Details of transfer mechanisms for each sub-processor are available upon request at privacy@kontrabooks.com.
| Data type | Retention period |
|---|---|
| Account data (name, email) | Duration of account + 30 days after deletion request |
| Financial records (invoices, bills, payments) | 7 years from the date of the transaction (legal obligation) |
| Audit logs | 2 years |
| Support communications | 3 years from last interaction |
| Backups | Rolling 30-day window; deleted on schedule |
| Marketing consent records | Until consent is withdrawn + 3 years for audit purposes |
Financial records are retained beyond account deletion to satisfy statutory obligations. Where deletion is legally required but retention is also required, we anonymise the personal identifiers (name, email) while retaining the transaction record.
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, as required by GDPR Article 33-34.
KontraBooks uses only strictly necessary cookies - those required for the service to function. We do not use advertising, tracking, or analytics cookies.
| Cookie | Purpose | Duration |
|---|---|---|
| access_token | Authenticates your session securely (httpOnly) | Short-lived; auto-refreshed |
| refresh_token | Allows your session to be renewed without re-login (httpOnly) | 7 days |
| csrftoken | Prevents cross-site request forgery attacks | Session |
Because all cookies are strictly necessary for the service to function, no cookie consent banner is required under GDPR. You may disable cookies in your browser settings, but doing so will prevent you from logging in.
For full details, see our Cookie Policy.
Under GDPR and applicable privacy laws, you have the following rights. To exercise any of them, email privacy@kontrabooks.com. We will respond within 30 days.
Right of access
Request a copy of all personal data we hold about you.
Right to rectification
Correct inaccurate or incomplete personal data. Most data can be corrected directly in your account settings.
Right to erasure
Request deletion of your personal data. We will delete or anonymise your data, subject to legal retention obligations (see Section 8).
Right to data portability
Receive your data in a structured, machine-readable format (JSON/CSV) to transfer to another service. Available via your account settings.
Right to restrict processing
Request that we limit how we use your data while a dispute or complaint is being resolved.
Right to object
Object to processing based on legitimate interests. We will cease unless we have compelling legitimate grounds that override your interests.
Right to withdraw consent
Where processing is based on consent (e.g. marketing emails), withdraw it at any time. Withdrawal does not affect processing carried out before withdrawal.
Right to lodge a complaint
If you believe we have not handled your data correctly, you have the right to lodge a complaint with a data protection supervisory authority in your country of residence.
KontraBooks is a business accounting service not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and display a notice in the application at least 30 days before the changes take effect. The date at the top of this page reflects when the policy was last updated. Continued use of the service after changes take effect constitutes acceptance of the updated policy.
For privacy-related questions, data subject requests, or complaints, contact us at:
You also have the right to lodge a complaint with the data protection authority in your country of residence. For EU residents, a list of national supervisory authorities is available at edpb.europa.eu.