Privacy Policy
This policy covers the personal data Solju itself decides how to use: the people who sign in to Solju on behalf of an accounting firm, and visitors who ask for a demo through this website. It does not cover the financial records an accounting firm uploads about its own clients while using Solju — that data belongs to the firm, the firm decides how it is used, and it is covered instead by the Data Processing Agreement between Solju and that firm.
Who is responsible
Solju is operated by [the legal entity behind Solju - name, registration number and address to be confirmed before this goes live]. Questions about this policy or a request concerning your own data can be sent to [contact address to be confirmed].
What is collected, and why
| Who | What | Why |
|---|---|---|
| A demo request | Name, accounting firm name, email address, an optional message | To reply to the request. Nothing else is done with it. |
| A signed-in accountant | Email address, and whichever authentication details Supabase (our sign-in provider) requires to keep an account secure | To sign you in, and to know which firm and which role (owner or member) you hold within it |
| Anyone using the app | An audit trail of actions taken — which run was started, which setting was changed, by which account, when | Accountability for a tool that proposes entries into a company's books. This record is never edited or deleted - see "How long" below |
| Anyone using the app | Ordinary web server logs (IP address, the page requested, the time) for the duration they are kept | Diagnosing a problem with the service. Receipt filenames are deliberately excluded from this log because they can carry a vendor's name and an amount |
Where it is kept
Application data — accounts, the audit trail, run records — is held by our database provider, Supabase, in their eu-west-1 (Ireland) region. It does not leave the European Union. Uploaded documents (bank statements and receipts) are held on a server in Helsinki, Finland. Their nightly backups are encrypted on that server and then kept by Cloudflare in its EU jurisdiction; Cloudflare does not have the key to read them.
Who else sees it
Four companies process data on Solju's behalf, and a fifth only for an accounting firm that chooses it, each under their own agreement with us, none of them permitted to use it for their own purposes:
- Supabase — authentication and the application database (Ireland). It also sees the IP address of each sign-in request.
- Hetzner Online GmbH — the server the application and uploaded documents run on (Helsinki).
- Cloudflare, Inc. — keeps the nightly backups of uploaded documents, encrypted before they leave our server, in its EU jurisdiction; and runs the check against automated sign-ins on the sign-in page (Turnstile), which sees your browser and IP address and runs on Cloudflare's global network. Cloudflare is a United States company.
- Lettermint B.V. — sends Solju's email: sign-in codes, invitations, the documents and journal a firm asks Solju to deliver, and our notice of a demo request. A Dutch company, on infrastructure in the EU. [For the office: which provider holds the mailbox that receives those notices (a demo request, an operator alert), and whether it has to be named here, is to be confirmed.]
- Anthropic, PBC — only for an accounting firm that switches on the AI reader: reads the receipts and invoices that firm uploads, to propose their values for a person to check. Anthropic is a United States company; the documents are processed outside the EU under the EU's standard contractual clauses and, under its current terms, are not used for training and not kept after the answer.
Solju also asks the Finnish Patent and Registration Office's public register about a client company's business ID; only that ID is sent. [For the lawyer: a sole trader's business ID can be personal data.] A firm's documents go to its own accounting software only when the firm asks for that.
Nobody else. Solju does not sell data, does not use it for advertising, and does not share it with any party not named above.
How long it is kept
Stated plainly rather than rounded up to sound tidier than it is:
- A demo request is kept until it is answered and for a reasonable time afterward, then deleted.
- An account and the audit trail tied to it are kept for as long as your firm has a relationship with Solju. The audit trail is append-only by design — a past entry is never edited or removed — which is also why closing an account does not retroactively erase history that already existed.
- Uploaded documents and generated output are not automatically deleted today. An automatic retention period is planned and will be described here once it exists, rather than described in advance of being true.
Your rights
Under the EU General Data Protection Regulation you can ask to see what is held about you, correct it, or ask for it to be deleted where the law allows deletion — an append-only audit trail cannot be edited even at your own request, for the same reason it cannot be edited by us. Write to the address above. You can also complain to your national data protection authority; in Finland this is the Office of the Data Protection Ombudsman.
Security
Every accounting firm's data is separated by a database policy, not only by application code — a firm's own row-level access is enforced at the database itself, and it is proven with an automated check rather than assumed. Connections are encrypted in transit (TLS). Sign-in uses cryptographically signed tokens rather than a password Solju itself stores.
Changes to this policy
If this changes in a way that matters, firms with an account are told directly rather than left to notice a date at the bottom of this page.