Privacy policy.

1. Who we are

The system is built and operated by Afanasyevs OÜ, registry code 16464061, VAT EE102476503, Tööstuse tn 48, 10416 Tallinn, Estonia. Contact: support@afanasyevs.com.

2. Our role

For the accounting data we extract from your systems, you are the controller and we are the processor within the meaning of Article 28 GDPR. We process that data only on your documented instructions, which are given by connecting a company and by the configuration you set in the service. We do not determine the purposes of that processing and we do not use the data for our own ends.

For the contact details of the people who administer your account we act as controller, on the basis of Article 6(1)(b) GDPR — performance of the contract.

3. What we process

From each connected accounting company we read the trial balance for the periods you select and the chart of accounts. That means account codes and names, period balances, currency, and the counterparty names that appear within those reports. We do not request transaction-level detail, payroll records, bank credentials or customer contact data.

Personal data is processed only to the extent it is contained in your accounting records — for example where a counterparty is a natural person, or where an account name identifies an individual.

4. Purpose

Mapping source accounts to a group chart of accounts, currency translation, intercompany elimination, and production of consolidated statements for your group. Nothing else.

5. Sub-processors

We use the following processors. We will give you at least 30 days’ notice by email before adding or replacing any of them, and you may terminate if you object.

Supabase

Database and storage, in the region you choose. Where that region is outside the EEA, the transfer is made under the European Commission’s standard contractual clauses.

n8n

Workflow orchestration. Hosted in the European Union.

Intuit

QuickBooks Online, the source system. Operated from the United States. Data flows from Intuit to us; we send no client data to Intuit beyond the API requests needed to read the reports named above.

Cloudflare

Delivery and protection of the service’s web interface. Global network.

No language model or other artificial-intelligence service processes data extracted through Ledger Sync. No data is used to train any model, ours or anyone else’s. No data is sold, and none is shared between clients.

6. Retention and deletion

We retain extracted data for as long as the service is in use, plus any period required by law. You may disconnect at any time from the Apps page in your accounting system. On written request we delete all data extracted from your companies within 30 days and confirm the deletion in writing. Request logs are retained for twelve months for security and audit purposes.

7. Security

Your deployment is separate: its own database and its own automation instance, with access separated at the database level by row-level security. Client data is never brought together. Data is encrypted in transit. Access credentials for your accounting system are stored encrypted and are used only for the read requests described in section 3. Every request made to your systems is logged with its Intuit request identifier, and the log is available to you on request.

8. Your rights and those of data subjects

Because we act as processor for your accounting data, requests from data subjects should be addressed to you as controller; we will assist you in answering them. For data where we are the controller, you have the rights of access, rectification, erasure, restriction, portability and objection. Write to support@afanasyevs.com. You may also lodge a complaint with the Estonian Data Protection Inspectorate or with the supervisory authority in your own country.

9. Data processing agreement

We will sign a data processing agreement on request, and we will accept yours if it reflects the arrangement described here.