Klarby Privacy Policy

This is the privacy policy for Klarby, accounting and VAT software for EU e-commerce sellers. It explains what personal data we collect, why, who we share it with, how long we keep it and what rights you have. The full policy is set out below.

Data controller

Shivarev Enterprises Limited (director: Eduard Shivarev), Mykinon 8, Nicosia 1065, Cyprus, is the controller responsible for your personal data. Contact: privacy@shivareventerprises.com.

What we collect and why

• Identity and contact data — first name, last name, email address. Lawful basis: performance of a contract (providing your account) and consent.
• Technical data — IP address, login data, browser type and version, time zone. Lawful basis: legitimate interests (keeping the application secure and working).
• Integration Data (Shopify) — Klarby connects to Shopify through BooksBridge, Klarby's Shopify app. For each order BooksBridge sends, Klarby keeps the order number, date, amounts, taxes and payment fees, the store it came from, and the customer's name, company, address, country and VAT number: the country to classify the sale for VAT and OSS, and the rest to issue invoices, including the reverse-charge note on invoices to business customers. Klarby does not receive or store your customers' email addresses. Lawful basis: Performance of a contract (the bookkeeping, VAT and reporting features you asked for).
• Google account data — your name, email address and profile picture from Google Sign-In, used to create and identify your account.
• Gmail data (optional) — If you switch on email invoice scanning, read-only access to your Gmail is used to find supplier invoices and receipts and attach them to the matching expense. If you switch on scheduled scanning, Klarby checks your inbox for new invoices regularly using the access you granted, until you switch it off or revoke access. It is never required to sign in and can be revoked at any time in your Google Account. Invoice details Klarby extracts from your email can be used by the assistant when you ask it about those entries.

Data about other people in your records

Your books contain personal data about people other than you, and we hold it on your behalf as your processor — you are its controller. That covers your customers (names, emails, company names, billing addresses and VAT numbers that arrive with orders), your suppliers (details on invoices and receipts, and supplier names on expenses), and other parties in your bank transactions (the name, IBAN and payment reference your bank reports). Some of it is copied into your accounting records — a bank transaction's description becomes its ledger entry's description, and ledger entries are never altered after posting, only reversed. A request from one of these people to see or erase their data is a request to you, and we will help you answer it. Records tax law requires you to keep are retained for the statutory period even after such a request. There is no automated erasure for supplier or bank-transaction details today; we handle those requests with you directly.

Bank and payment data

If you connect a bank account or payment provider, we receive your transaction history: dates, amounts, currencies, account identifiers, and the description text your bank or provider supplies. That description normally names the other side of the transaction — a supplier, a customer, an employee, or another person — and where that person is an individual, their name forms part of what we receive.

We use this to match transactions to your invoices and expenses, to categorise them for your accounts, and to produce your reports and VAT figures. Lawful basis: performance of our contract with you.

Bank connections are provided by Enable Banking Oy (Finland), which is registered with the Finnish Financial Supervisory Authority as an account information service provider. We never receive your online banking credentials — you authenticate with your bank directly, and you can withdraw that access at any time, in Klarby or with your bank. Disconnecting in Klarby ends our access and asks your bank to close the consent.

How Google user data is used

Klarby uses Google Sign-In to authenticate you and give you access to your own Klarby account and business data. We receive only your name, email address and profile picture from Google, and we use them to create and identify your account — nothing else.

Separately, and only if you switch it on, Klarby asks for read-only access to your Gmail (googleapis.com/auth/gmail.readonly) so it can find supplier invoices and receipts in your inbox and attach them to the matching expense in your books. You are asked for this in its own consent step, it is never required to sign in, and you can revoke it at any time in your Google Account. Klarby never sends email on your behalf, never modifies or deletes anything in your mailbox, and never uses your Google data for advertising or to train AI models.

Klarby's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data to third parties except as necessary to provide the service, comply with law, or as part of the processors listed in our privacy policy, and we never use it for advertising or to train AI models.

Sharing and processors

We do not sell your personal data. We use these processors to run the service:

• Enable Banking (Enable Banking Oy, Finland) — Bank and payment-account connections. Registered with the Finnish Financial Supervisory Authority (FIN-FSA) as an account information service provider. Processing: European Union. Receives: Identifiers, balances and transaction history — including the description text your bank supplies — for accounts you choose to connect.
• Stripe (Stripe Payments Europe, Limited, Ireland) — Your Klarby subscription payments. Processing: European Union and United States. Transfer basis: EU–US Data Privacy Framework and Standard Contractual Clauses. Receives: Your own billing details only: name, email address, billing address and payment details. Never your books, and never your customers' data.
• Resend (Plus Five Five, Inc., United States) — Transactional email. Processing: United States. Transfer basis: Standard Contractual Clauses and EU–US Data Privacy Framework. Receives: Recipient addresses and the content of the emails we send: reminders, data-request notifications, team invitations, and the text of support messages and enquiries you send us.
• Render (Render Services, Inc., United States) — Application hosting. Processing: Frankfurt, Germany (hosting region); Render, Inc. staff and systems in the United States. Transfer basis: EU–US Data Privacy Framework; EU Standard Contractual Clauses if it ceases to apply. Receives: All application traffic passes through it. Our application logs are kept for 7 days and contain store domains, internal identifiers and operational messages; request logging at the platform level is under Render's control and not visible to us.
• Cloudflare (Cloudflare, Inc., United States) — Network delivery and security in front of klarby.eu. Processing: Global network. Transfer basis: EU–US Data Privacy Framework; EU Standard Contractual Clauses for any other restricted transfer. Receives: Request metadata, such as IP address and the requested URL.
• Google Cloud and Firebase (Google Cloud EMEA Limited, Ireland) — Database, file storage and sign-in. Processing: European Union for stored data (database in the eur3 multi-region; file storage in the EU multi-region); Google may process data wherever it or its sub-processors maintain facilities. Transfer basis: Google's Data Transfer Solution (EU–US Data Privacy Framework) and Standard Contractual Clauses. Receives: All account and accounting data you keep in Klarby.
• Anthropic (Anthropic Ireland, Limited, Ireland) — The AI features you use in Klarby: the assistant, reading invoices and receipts, finding invoices in your email, and suggesting categorisation rules. Processing: United States (stored data, and model inference — every request is pinned to US infrastructure). Transfer basis: Standard Contractual Clauses, incorporated in Anthropic's Data Processing Addendum. Receives: The input of the feature you use — for example your chat messages and account figures, an uploaded invoice, the sender, subject, date and start of the text of an email that may be an invoice, or transaction descriptions. When you ask the assistant about specific records or to change them, it receives those records: supplier name and country, amounts, currency, dates, descriptions, category, VAT treatment, recurring flag and status — including entries Klarby found in your email. This can include personal data of suppliers or people named in descriptions, sent on your behalf. The assistant only proposes changes; nothing is applied until you confirm. Not used to train models.

Services you choose to connect — Shopify, and Gmail if you switch on email invoice scanning — send us your data rather than processing it for us. We use no advertising, marketing or analytics tracking, and the only cookies set are those required for authentication and session management.

Shopify: data from your Shopify store arrives through BooksBridge, Klarby's Shopify app, which has its own privacy policy.

EU VAT number checks (VIES): Only if you switch on VAT number checks (Settings → Bookkeeping rules), Klarby sends each buyer VAT number on your sales, together with your own VAT number, to the European Commission's VIES service to confirm it is valid. Klarby keeps the result, the registered name and address VIES returns, and the consultation number with the sale, as proof for your VAT records.

Retention

Closing your account

Closing your Klarby account permanently deletes every company you own and everything in it, including books, ledger, invoices, uploaded documents and audit history. This cannot be undone. Tax law requires most businesses to keep their accounting records for several years, and that obligation stays with you after you leave Klarby. Export your records before closing your account (Settings → Closing & export → Download full backup). Deleted database records and files may remain in backups for up to 7 days before being permanently removed.

While your account is open, your records stay in Klarby for as long as you keep them there. Deleting a company removes that company and everything in it in the same way.

Shopify uninstalls and end-customer requests

• A customer asks what data you hold (customers/data_request): we assemble what we hold about that customer, email you that a request arrived with the date you must answer by, and make the details available in Klarby. You answer your customer; we are your processor and do not contact them.
• A customer asks to be erased (customers/redact): we replace their name, email, company, address and VAT number with [REDACTED] on every record that holds them. We keep the country, because your VAT return depends on it, and we keep the financial record itself.
• You uninstall BooksBridge: BooksBridge deletes what it holds for your store, including its connection to your Klarby account, so Klarby stops receiving data; Klarby holds no credentials for your store. When Shopify later sends shop/redact, Klarby records it. Your books stay in your Klarby account — uninstalling is not closing your account and does not delete your accounting records. To delete those, close your account (Account → Delete account) or email us.
• Why erasure pseudonymises rather than deletes: orders and credit notes are accounting records that tax law requires you to keep. Article 17(3)(b) GDPR disapplies erasure where processing is necessary to comply with a legal obligation, so we remove the identity from the record rather than deleting the record. The record stays in your books for as long as you keep them in Klarby, and is deleted with them.
• Invoices already issued: An erasure request pseudonymises your working records in Klarby, but an invoice or credit note that has already been issued keeps the customer's name and address. Tax law requires an issued invoice to be kept exactly as issued, so Klarby keeps those documents unchanged for that purpose only (GDPR Article 17(3)(b)) and uses them for nothing else.
• What erasure does not reach: It also does not reach data already sent to another accounting system you connect, which lives in your own account there.

The change history of your records

Klarby keeps a history of changes to your accounting records — who changed what, and when — because an accounting record has to show how it came to be. That history is append-only: entries are never edited or deleted.

When a customer's details are changed, the history records that they changed but not what they said. Descriptions are kept as written, so a name typed into a description stays in the history. We keep the history for as long as the records it describes; because it is needed to comply with a legal obligation, GDPR Article 17(3)(b) means an erasure request does not remove it.

Your rights

Under the GDPR you may request access to, correction of, erasure of, restriction of or transfer of your personal data, object to processing, and withdraw consent at any time. To exercise any of these, email privacy@shivareventerprises.com. You also have the right to lodge a complaint with a supervisory authority — ours is the Cyprus Commissioner for Personal Data Protection.

Privacy Policy · Terms of Service · Legal Notice
Klarby is operated by Shivarev Enterprises Limited · Reg. HE 480 115 · VAT CY60206451B · Mykinon 8, 1065 Nicosia, Cyprus · support@shivareventerprises.com