Privacy policy

1. Privacy at a glance

Below you can read what happens to your personal data when you use xaf-ok.nl. Personal data is any data that can identify you personally.

We receive data because you give it to us, for example your email address to sign in or a file you upload. Other data is recorded automatically by our systems when you visit the website, mainly technical data such as browser, operating system and time of access.

2. Controller

RADOM UG (haftungsbeschränkt)

Telemannstr. 2

60323 Frankfurt am Main

Germany

Email: support@xaf-ok.nl

Given the size of our company, appointing a data protection officer is not legally required. For privacy questions, contact support@xaf-ok.nl.

3. Cookies and analytics

We only use technically necessary cookies: a session cookie while you are signed in (30 days) and, if you convert without an account, a cookie with a pseudonymous identifier for the free daily conversion (until the end of the day). We do not use marketing cookies.

For visitor statistics we use Umami, which we run ourselves on our server in Germany. Umami works without cookies and does not store IP addresses; it counts page views and events such as “conversion started” with an error code, never the content of your files. Legal basis: legitimate interest in improving the website (Art. 6(1)(f) GDPR). We delete analytics data after 14 months.

If you create an account from the converter or the XAF viewer, your own browser keeps the chosen file locally for up to 24 hours (not on our server) so you can continue after signing in.

Server log files

Our server automatically records data your browser sends: browser type and version, operating system, referrer URL, time of the request and IP address. We delete these logs after 14 days. Legal basis: legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

Account and sign-in

You can create a free account. For this we process your email address; you sign in with a link we send by email, there is no password. We keep your account data as long as you have the account (Art. 6(1)(b) GDPR). You can delete your account and all your conversions yourself at any time in your dashboard.

4. Third-party services

• Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Our servers are located in Germany. Data processing agreement under Art. 28 GDPR.
• Azure OpenAI (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland): when our fixed rules cannot reliably match a ledger account to an RGS code, we send only that account’s name and number to Azure OpenAI; no amounts or bookings. PDF ledgers are read by sending the full pages as images to Azure OpenAI; these can contain names, amounts and descriptions. This also applies to uploads without an account. The Azure resource is in Sweden Central; the actual processing location depends on the Azure deployment type and can include the EU data zone or other Azure regions. Under the Azure terms Microsoft does not use inputs and outputs to train the base models; for abuse detection Microsoft may run automated checks and temporarily store flagged content for human review. Transfer is encrypted via HTTPS. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Data processing agreement under Art. 28 GDPR via the Microsoft product terms.
• Payments: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Your payment data goes directly to Stripe; we do not store full card details. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Email: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Workspace). We send sign-in and service emails through Google and receive email to support@xaf-ok.nl there. Data processing agreement under Art. 28 GDPR.

5. Processing for our service

Ledger files you upload (CSV, Excel or PDF) are processed to create an XAF audit file. They can contain booking dates, amounts, descriptions, ledger accounts and names of business partners. We do not keep the uploaded file itself: it is only in memory and in the processing queue during the conversion. We keep the generated XAF file and the conversion details (company name, KVK number, fiscal year, number of lines, unmapped accounts and any error messages). Files you open in the XAF viewer are processed in memory only and not stored. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

If you use xaf-ok.nl for business purposes with personal data of your clients or business partners, we are your processor for that data; our data processing agreement applies.

Retention periods

• Conversions in your account: deleted automatically 90 days after they were created. You can delete them earlier yourself in your dashboard.
• Conversions without an account: deleted automatically after 7 days. During that time you can move the file to a free account after creating it. We do not link these conversions to your IP address but to a pseudonymous identifier.
• Server log files: 14 days. Visitor statistics: 14 months.
• If you delete your account, we immediately and irrevocably delete your account, sessions and conversions. Data we must keep longer by law, such as invoices, is kept only as long as that obligation applies.
• We back up the database daily and delete backups after 14 days, so deleted data also disappears from the backups no later than 15 days later.

Automated decision-making

We do not take decisions with legal effects based solely on automated processing. Azure OpenAI only suggests RGS codes; you see the result, including unmapped accounts, before you download the file.

6. Your rights

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR), unless a legal retention obligation applies
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdrawal of consent (Art. 7(3) GDPR)

You can exercise your rights via support@xaf-ok.nl.

You have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Postfach 3163, 65021 Wiesbaden, Germany. You can also complain to the Dutch Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, the Netherlands.

7. Security

This website uses TLS encryption. Your data is stored on servers in Germany. We take technical and organisational measures to protect your data.

8. Changes

We may update this privacy policy when the law or our service changes. The new version then applies to your next visit.