AccountCloud
NLGet a test key

Privacy policy

Which personal data we process about you, why we do it, how long we keep it and what your rights are.

Version
1.0
Effective
4 November 2026
Status
DraftThis text is still being reviewed by our lawyers before AccountCloud opens to everyone.
Contracting party
Informer Online Nederland B.V., trading as AccountCloud
Language
This English version is a translation, for your convenience. Where the two differ, the Dutch text prevails.
Also read
Terms of serviceData processing agreement

1. Who we are

AccountCloud is a trade name of Informer Online Nederland B.V., based in Rijswijk, the Netherlands, registered with the Dutch Chamber of Commerce under number 63388928. We are the controller for the processing described in this policy. A question or a request? Email [email protected].

2. Who this policy is for

This policy covers the personal data we process for ourselves, about:

  • people who visit our website;
  • people who create an account or work in the portal, usually on behalf of their business;
  • people who contact us.

Data in our customers’ documents and calls. When a customer sends us an invoice, a receipt or a lookup that contains personal data, we process it on that customer’s behalf. We are then the processor, and the customer is the controller. The arrangements for this are in the data processing agreement. Are you named on such a document and want to know something or have it changed? Please contact the business that uses us. We help that business with it.

One exception: if a customer deliberately shares a document with us when reporting an OCR error, we are responsible for that document ourselves (see “Improving recognition” below).

3. What data, why and for how long

Your account

  • What data: your name, your email address, your password (only as a hash), your language, your two-factor authentication setting, your role, and when you last signed in. About your business: its name, its country, and its VAT number or business register number.
  • Why: to give you an account and provide the service.
  • Legal basis: performance of the contract.
  • How long: as long as your account exists. When you close your account, we delete this data, except what the law requires us to keep.

Verifying your business

  • What data: the VAT number or business register number you provide, and the consultation number VIES returns. For a sole trader, that can be personal data.
  • Why: AccountCloud is for businesses only. We check that your business exists before you get live keys, we prevent misuse, and we need a valid VAT number to reverse-charge VAT.
  • Legal basis: performance of the contract, our legitimate interest in preventing misuse, and our legal obligation to invoice VAT correctly.
  • How long: as long as your account exists. What appears on an invoice, we keep for 7 years.

Signing up, signing in and security

  • What data: when you sign up, Cloudflare Turnstile’s check that you’re human. When you sign in, your session, with your IP address and browser, and the number of failed attempts. The audit log records who did what in the portal, with a hash of the IP address.
  • Why: to secure your account and the portal, prevent misuse and investigate incidents.
  • Legal basis: our legitimate interest in a secure service.
  • How long: a session until you sign out or it expires. The audit log as long as your account exists.

Your use of the API

  • What data: per call, the time, the key, the operation, the status, the duration, the cost, a hash of the IP address and the user agent. We don’t store the content of a request or response.
  • Why: to charge for calls, show you the request log in the portal, detect misuse and outages, and measure the service.
  • Legal basis: performance of the contract, and our legitimate interest in a secure, well-running service.
  • How long: 13 months. After that we keep only totals, without personal data.

Payments and invoices

  • What data: your top-ups, the payment method and status of each payment, your invoices and the company details on them. You pay through Mollie. From Mollie we receive the payment status, the payment method and, for automatic top-ups, the mandate details. We never see full card numbers.
  • Why: to add your credit, run automatic top-ups, invoice you and keep our books.
  • Legal basis: performance of the contract, and our legal retention obligation.
  • How long: 7 years, the Dutch tax retention period.

Email from us

  • What data: your name and email address, and whether an email was delivered.
  • Why: email about your account and the service: activation, invitations, your password, two-factor authentication, your credit, the base subscription, invoices, and changes to the service or the terms. We only send marketing email with your consent, or, if you’re a customer, about similar services of ours. Every marketing email has an unsubscribe link.
  • Legal basis: performance of the contract. For marketing email, your consent or our legitimate interest.
  • How long: as long as your account exists.

Contacting support

  • What data: whatever you send us: your name, your email address, your question, and perhaps a request_id or other details.
  • Why: to answer your question.
  • Legal basis: performance of the contract if you’re a customer, otherwise our legitimate interest.
  • How long: as long as needed to handle your question and any follow-up.

Improving recognition

  • What data: a document a customer deliberately shares with us when reporting an OCR error (allow_training: true), with our result and the customer’s corrections. It can contain personal data, such as names and addresses on an invoice.
  • Why: to test and improve how well we read documents. We don’t train an AI model of our own; we use the documents to test and adjust the way we work.
  • Legal basis: our legitimate interest in a better service. A customer shares only per document and deliberately, and can switch sharing off for the whole account.
  • How long: up to 12 months. Need a document removed sooner? Email us.

The website

  • What data: our server and Cloudflare record technical data about each request, such as the IP address, the time and the page requested.
  • Why: to secure the website and fix outages.
  • Legal basis: our legitimate interest.
  • How long: only as long as needed for that.

4. Cookies

  • The website sets no cookies of its own, and uses no analytics or tracking services. The fonts are served from our own server. Cloudflare, which protects the website, may set a strictly necessary cookie to recognise attacks.
  • The portal uses only the cookies needed to sign in and use it securely: a session cookie and a cookie against CSRF. These don’t require consent.
  • The documentation sets no cookies for analytics or tracking.

5. Who we share data with

We don’t sell personal data. We share it only with:

  • Service providers who work for us, with whom we have a data processing agreement:
    • Amazon Web Services: hosting, the database, storage and document processing, in Frankfurt;
    • Cloudflare: DNS, protection against attacks, the check at sign-up (Turnstile) and the status page;
    • Twilio SendGrid: sending email.
  • Mollie, for payments. Mollie is itself responsible for the payment data; see Mollie’s privacy policy.
  • Sources, such as VIES of the European Commission and the KvK. They receive the number being looked up, for example your VAT number when you sign up.
  • Authorities, when the law requires us to.

6. Data outside the EU

We store data in the EU, in Frankfurt. Amazon Web Services, Cloudflare and Twilio SendGrid are American companies. Where they may process data outside the European Economic Area, they do so under the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

7. Security

  • All traffic is encrypted (TLS).
  • The database cannot be reached from the internet, and is stored encrypted.
  • We store passwords and API keys only as hashes.
  • Two-factor authentication is available in the portal, and mandatory for our own staff.
  • Our staff can only access the data they need for their work, and what they do is logged.
  • Secrets and certificates are kept in AWS Secrets Manager, not in code.

8. Your rights

You have the right to:

  • access your data;
  • have incorrect data corrected;
  • have your data deleted;
  • have the processing restricted;
  • object to processing based on our legitimate interest;
  • receive your data in a common format;
  • withdraw a consent you gave.

Email your request to [email protected]. We respond within a month, and may ask you to prove who you are. If you’re not happy with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or the supervisory authority in your own country. We’d like to hear from you first.

9. Automated decisions

We make no decisions based solely on automated processing that significantly affect you. Checking your VAT number at sign-up is automatic. If it fails, a member of our staff can still verify your business.

10. Changes

We may update this policy. The date at the top tells you which version applies. We notify our customers of significant changes by email.