Privacy Policy

“Conta”, “we”, “us”, and “our” refer to Oba Labs B.V. (the “Company”). We are the data controller for personal information processed through our websites and services, including contabook.co, app.contabook.co, and getconta.app. This Privacy Policy applies to our marketing website and the Conta app unless a different policy is presented.

We may collect:

Account and contact information: name, email address, company name, and role when you create an account, book a call, or contact us.

Business and financial data: invoices, receipts, transactions, vendor and customer details, and other accounting records you upload or create in the Conta app.

Accounting records: transaction records and supporting documents you choose to upload to the Conta app.

Billing information: plan selection, billing address, and payment status. Payment details are handled by our payment processors; we receive limited information such as payment status and the last four digits of a card where available.

Communications: support requests, emails, chat messages, and meeting notes.

Device and usage information: IP address, browser type, device identifiers, approximate location (derived from IP), pages viewed, and interactions.

Cookie and similar technology data: identifiers and preferences stored on your device (see Cookies).

We use information to:

Provide, maintain, and improve our website and services.

Deliver accounting services and generate reports you request.

Respond to inquiries and provide customer support.

Process subscriptions and manage billing.

Measure and understand performance of our website and marketing.

Protect against fraud, abuse, and security incidents.

Comply with legal obligations and enforce agreements.

If you are located in the EEA or UK, we process personal information under the following legal bases:

Contract (to provide the services you request and manage your account).

Legitimate interests (to secure, improve, and market our services, and prevent fraud).

Consent (for non-essential cookies and certain marketing activities).

Legal obligations (to comply with tax, accounting, and other regulations).

Cookies are small text files stored on your device. We may use cookies and similar technologies for:

Strictly necessary purposes (security, basic functionality).

Analytics (to understand how our website is used and improve it).

Advertising (to measure campaigns and, where permitted, show relevant ads).

When the consent banner is displayed, you can accept, reject or customise optional cookies. To revisit a saved choice, clear Conta’s stored site data in your browser settings and reload the website. You can also use your browser to block or delete cookies; some features may then work differently.

We use Google Ads and related measurement tools. These tools may set or read cookies or use similar technologies to:

Measure ad performance (for example, conversions and attribution).

Show ads that may be more relevant to you (for example, remarketing), where permitted by law and your choices.

Google may collect and process information about your visits to our site and other sites, and may use that information to provide advertising services. You can learn more and manage ad personalization in Google’s ad settings.

Google Ads Settings: https://adssettings.google.com

Google Privacy & Terms: https://policies.google.com

If you choose “Reject” in our cookie banner, we will not enable advertising cookies on our website. If you choose “Accept”, we may enable advertising cookies and consent mode signals that allow measurement and (where permitted) personalization.

We use Meta Pixel (Meta Ads) to measure the effectiveness of our marketing and, where permitted, show you relevant ads. Meta Pixel may collect information about your visits and interactions with our site. You can learn more in Meta’s privacy resources and manage ad preferences in your Meta settings.

Meta Pixel only runs on our site when you allow advertising cookies in the cookie banner.

We may share information with:

Service providers who help us operate our website and services (hosting, analytics, customer support, communications, and infrastructure).

Payment processors to handle subscriptions and billing.

Advertising partners (such as Google and Meta) where you have permitted relevant cookies and where allowed by law.

Professional advisors (legal, tax, or accounting) when needed.

Authorities if required by law or to protect rights, safety, and security.

Business transfers in connection with a merger, acquisition, or asset sale.

We process accounting documents and information to deliver the bookkeeping, reporting and assistance you request. AI-assisted processing may include the complete contents of invoice PDFs or images, extracted text, company profile information, names and contact details, invoice and tax identifiers, amounts, descriptions and payment information contained in those records.

Transaction classification uses transaction identifiers, descriptions and references. When you use the AI assistant, your messages, conversation history, selected document or transaction information and relevant tool results may be sent to the AI provider to answer the request.

We retain the accounting outputs and conversation history within Conta to provide the service. Operational and support logs may also contain document, transaction or conversation information.

Google Cloud Document AI reads documents. Google Vertex AI and Gemini APIs support structured extraction and transaction-processing paths. OpenAI supports extraction fallback, transaction classification and the in-app AI assistant. Mistral OCR is an available document-reading fallback. The provider used depends on the feature and processing path.

Supabase provides the app’s database, storage and backend infrastructure. Cloudflare provides website and processing-orchestration infrastructure. Provider processing is governed by the applicable business terms and data-processing agreements.

We use standard paid business/API accounts and do not enable optional sharing of customer content for provider model improvement or training.

This is not a zero-data-retention service. Providers may retain request content or related logs for service operation, caching, security, abuse monitoring or legal requirements under their applicable terms. These periods and purposes vary by provider and feature. For example, OpenAI’s standard API abuse-monitoring logs are normally retained for up to 30 days, subject to documented exceptions. This does not describe how long accounting records or chat history remain in Conta.

We process information to perform the services you request, comply with applicable legal obligations, and operate and secure Conta under the relevant lawful bases described in this policy. Optional marketing and cookie choices remain separate from accounting and AI-assisted service processing.

Professional advice and tax filings are handled by people. Automated assistant responses may appear without prior human review. You can contact the team to ask questions or request a correction.

Customer accounting data and content processed by Conta’s AI features are processed within the European Union.

We configure the relevant cloud and AI services, including fallback processing, for EU-only processing.

We retain accounting records for the applicable service, tax and legal periods. Dutch accounting records generally require seven-year retention; relevant immovable-property and OSS records can require ten years. The applicable start date and any legal hold depend on the record and circumstances.

Support and AI conversation history, operational logs and other service information are retained while needed for service delivery, support, security, resolving disputes or applicable legal obligations. We review their continued need and delete or anonymise information when it is no longer needed, subject to applicable obligations and backup handling.

Cancelling a subscription, closing a login or removing an item from normal view does not necessarily erase all records or copies immediately. Some document operations are soft deletions that preserve accounting history. We do not promise automatic deletion on a fixed day after cancellation.

Contact admin@contabook.co to exercise your privacy rights or request deletion. We assess the request and explain any records that must be retained and why.

Depending on your location, you may have rights to access, correct, delete, restrict, obtain a portable copy of, or object to certain processing of your personal information, and to withdraw consent where processing is based on consent.

Contact us to exercise your rights. You may also complain to the competent data protection authority, including the Autoriteit Persoonsgegevens in the Netherlands.

We use reasonable technical and organizational measures designed to protect personal information. No method of transmission or storage is completely secure.

Our services are not directed to children, and we do not knowingly collect personal information from children.

Email: admin@contabook.co

We may update this Privacy Policy from time to time. We will update the “Effective date” above when we make changes.