Klarby Data Processing Agreement

The Data Processing Agreement under Article 28 GDPR (version 2026-11-05) between the customer using Klarby, as controller, and Shivarev Enterprises Limited, as processor. It forms part of the Terms of Service and is accepted with them at sign-up or checkout. It is available in English and German.

• Processing only on the customer's documented instructions; confidentiality of everyone authorised to process the data.
• Technical and organisational measures: hosting in Frankfurt, database and files in Google Cloud's EU regions, TLS and encryption at rest, per-company access checks and roles, TOTP two-factor sign-in, an append-only change history, period locks, daily backups kept 7 days.
• Sub-processors under general authorisation, with 30 days' notice of changes and a right to object.
• Assistance with data-subject requests and with Articles 32 to 36 GDPR; breach notification without undue delay, where feasible within 48 hours.
• Deletion when a company or account is deleted, with backups cleared within 7 days; information and audits on reasonable notice.

Sub-processors

• Enable Banking (Enable Banking Oy, Finland) — Bank and payment-account connections. Registered with the Finnish Financial Supervisory Authority (FIN-FSA) as an account information service provider. Processing: European Union. Receives: Identifiers, balances and transaction history — including the description text your bank supplies — for accounts you choose to connect.
• Stripe (Stripe Payments Europe, Limited, Ireland) — Your Klarby subscription payments. Processing: European Union and United States. Transfer basis: EU–US Data Privacy Framework and Standard Contractual Clauses. Receives: Your own billing details only: name, email address, billing address and payment details. Never your books, and never your customers' data.
• Resend (Plus Five Five, Inc., United States) — Transactional email. Processing: United States. Transfer basis: Standard Contractual Clauses and EU–US Data Privacy Framework. Receives: Recipient addresses and the content of the emails we send: reminders, data-request notifications, team invitations, and the text of support messages and enquiries you send us.
• Render (Render Services, Inc., United States) — Application hosting. Processing: Frankfurt, Germany (hosting region); Render, Inc. staff and systems in the United States. Transfer basis: EU–US Data Privacy Framework; EU Standard Contractual Clauses if it ceases to apply. Receives: All application traffic passes through it. Our application logs are kept for 7 days and contain store domains, internal identifiers and operational messages; request logging at the platform level is under Render's control and not visible to us.
• Cloudflare (Cloudflare, Inc., United States) — Network delivery and security in front of klarby.eu. Processing: Global network. Transfer basis: EU–US Data Privacy Framework; EU Standard Contractual Clauses for any other restricted transfer. Receives: Request metadata, such as IP address and the requested URL.
• Google Cloud and Firebase (Google Cloud EMEA Limited, Ireland) — Database, file storage and sign-in. Processing: European Union for stored data (database in the eur3 multi-region; file storage in the EU multi-region); Google may process data wherever it or its sub-processors maintain facilities. Transfer basis: Google's Data Transfer Solution (EU–US Data Privacy Framework) and Standard Contractual Clauses. Receives: All account and accounting data you keep in Klarby.
• Anthropic (Anthropic Ireland, Limited, Ireland) — The AI features you use in Klarby: the assistant, reading invoices and receipts, finding invoices in your email, and suggesting categorisation rules. Processing: United States (stored data, and model inference — every request is pinned to US infrastructure). Transfer basis: Standard Contractual Clauses, incorporated in Anthropic's Data Processing Addendum. Receives: The input of the feature you use — for example your chat messages and account figures, an uploaded invoice, the sender, subject, date and start of the text of an email that may be an invoice (from any Gmail mailbox connected to the company), or transaction descriptions. When you ask the assistant about your records or to change them, it receives the records it looks up: expenses and entries in Pending review (supplier name and country, amounts, currency, dates, descriptions, category, VAT treatment, recurring flag and status — including entries Klarby found in your email), sales and credit notes (number, date, amounts, and the customer's company or name and country), bank transactions (account, date, amount, counterparty, description and what each is matched to) and the company's own accounts, subscriptions, suppliers, ledger balances and lines, and VAT figures; for a change it prepares, it also receives the current values of the fields that change (such as an expense's note or tax shares). When it reads a document attached in Klarby or a file you attach to a chat, it receives that document's text; a scan or image is first read by AI to get its text. This can include personal data of suppliers, customers, people named in descriptions or documents, and other parties in your bank transactions, sent on your behalf. When the assistant searches the web, its search query is sent to Anthropic's web search tool and the results come back to the assistant; the assistant is instructed never to put amounts, bank details, the names of private individuals or other contents of your records into a query. The assistant only proposes changes; nothing is applied until you confirm. Not used to train models.

Privacy Policy · Terms of Service · Data Processing Agreement · Legal Notice
Klarby is operated by Shivarev Enterprises Limited · Reg. HE 480 115 · VAT CY60206451B · Mykinon 8, 1065 Nicosia, Cyprus · support@shivareventerprises.com