Privacy policy
This page explains what BookMiri keeps about you, why, who else sees it, and how long we keep it. It covers this website, bookmiri.com, and the BookMiri app at app.bookmiri.com.
1. Who we are
BookMiri is run by ModulOn Solution Ltd, a company registered in Cyprus.
- Registered name
- ModulOn Solution Ltd
- Registration number
- HE 489056
- Registered address
- Annis Komninis 37, 2nd Floor, Office 6, 1061 Nicosia, Cyprus
- support@bookmiri.com
For your account and your company's billing, we decide what happens with your data: we are its controller. The documents and bank statements a company sends to BookMiri belong to that company. We handle them on its behalf, only to provide BookMiri to it.
2. This website
bookmiri.com sets no cookies, uses no analytics or advertising, and loads nothing from other companies: its fonts, pictures and film come from our own server. Our hosting provider, Fly.io, receives your IP address in order to send you the page.
3. What the app keeps
- Your account: your email address, your name if you give one, and your password, stored only as a one-way scramble that cannot be turned back into the password. Also whether you have confirmed your email, and your email setting.
- Your sign-ins: for each place you are signed in, a description of your browser, when it was last used and when it ends. You can see them under Settings › Security. They do not include your IP address.
- Your companies: each company's name, its bookkeeping email address, its members and their roles, and its invitations. If you ask for the example month, an example company filled with invented documents is made for you alone.
- Documents and bank statements: the files you upload or forward (PDF, JPEG and PNG), and what we read from them: the names and tax numbers of the supplier and the customer, dates, document numbers, amounts and VAT. From a bank statement: the bank, the account number, the period, the balances, and for each payment its date, description, amount, the other party and the reference. Also your answers, notes and decisions, and who in the company made them.
- Forwarded email: for each email sent to a company's bookkeeping address, the sender's address, the recipient, the subject, the message ID, and the names, types and sizes of the attachments. We do not keep the text of the email. Attachments from a sender the company has not approved are kept aside, unread, until a member decides. From a sender the company has blocked, we keep no attachments.
- Billing: for each page we read, whether it was a PDF or a scan, what it was priced at, and which invoice it is on; each charge of the company's card and whether it was paid; the company's free-start dates; who the company's payer is; and the card's brand, last four digits and expiry date, as Stripe reports them. The card number is entered on Stripe's own page, and Stripe holds it: we never see it. The billing name, address and VAT number are entered there too, or changed in Settings › Billing, which passes them to Stripe without keeping them.
- What you have done in the app: when you last opened the Feed, which banners you have closed, and whether you have watched the explainer film and opened the example month, so the app stops offering them.
- Costs: for each document read, which AI model read it, what that cost, and the file's name.
- Security: to stop password guessing and mass sign-ups, we briefly record each attempt by email address or IP address. Old records are removed automatically.
- Logs: our hosting provider's logs record each request to the app, including the IP address.
4. Why we use it
- To provide BookMiri, under our contract with you (Article 6(1)(b) GDPR): your account, reading your documents, matching them to your bank statement, and the emails the service sends. Those are confirming your address, resetting your password, invitations, telling you which documents are missing, telling you when documents from a new sender are held, asking the company's payer (or its owners) to add a card when documents are waiting to be read, and telling the payer when a payment did not go through.
- To bill you and keep the invoices tax law requires (Article 6(1)(c) GDPR).
- To keep the service safe, our legitimate interest (Article 6(1)(f) GDPR): the limits on sign-in attempts, and the logs.
We send no marketing email, show no ads, and do not sell your data.
5. Who else receives it
- Fly.io, Inc. (United States): hosting
- The app, its database and your files are kept in Fly.io's Amsterdam region, in the Netherlands. Backup copies of the database are stored by Tigris Data, Inc. (United States), Fly.io's storage partner.
- Anthropic, PBC (United States): reading documents
- Each file you send goes to Anthropic in full, to be read. When we check a document against a payment, the payment's amount, date, other party and description go with it. Anthropic's commercial terms do not allow it to train its models on what we send.
- Resend (United States): email
- Resend sends the app's emails, and receives the email forwarded to your company's bookkeeping address, in its EU region.
- Stripe: payments and invoices
- For each company that adds a card, the app gives Stripe the payer's email address and the company's name; the payer gives Stripe the card and billing details on Stripe's own page, or changes the billing details in Settings › Billing. Stripe charges the card and issues the invoices. Stripe also uses payment data for its own legal and fraud-prevention duties, under its own privacy policy.
- Trello (Atlassian, United States): bug reports
- When you use Report a bug, what you write and any files you attach go to our Trello board, with your email address, the company's name, the page you were on and your browser's description.
- The people in your company
- Everyone who is a member of a company sees that company's documents and statements.
Outside the EU. Fly.io, Tigris, Anthropic, Resend and Atlassian are United States companies. Fly.io keeps the app and your files in the EU and Resend works in its EU region, but as US companies they may in principle be required to give US authorities access. Anthropic may process your documents in the United States. These providers offer European customers the European Commission's Standard Contractual Clauses, or certification under the EU–US Data Privacy Framework, as safeguards for such transfers.
6. How long we keep it
- While your account exists, we keep your data, so you can go back to past months.
- When you delete your account (Settings), every company where you were the last member is erased at once, with all its documents, files and records. A company that other members carry on with keeps the documents you added to it. A company that still owes €0.50 or more, or has a payment that failed, must pay before its last member can delete their account.
- Your name, email address and scrambled password are not yet erased when you delete your account: they are kept, marked as deleted. We are changing this. Until then, write to us and we will erase them.
- When you delete a document, it disappears from your company, but its file stays on our server. We are changing this so that the file is erased 30 days after you delete it.
- Bank statements stay until their company is erased.
- Backups: our server's storage is backed up every day. A deleted file can survive in those backups until they are replaced.
- Invoices and payment records are kept by Stripe for as long as tax and financial law requires.
- Records of sign-in attempts are removed automatically after a short time.
7. Your rights
Under the GDPR you have the right to:
- access a copy of the personal data we hold about you;
- correct data that is wrong;
- erase your data, unless the law requires us to keep it;
- restrict how we use it, in some cases;
- take it with you in a structured, machine-readable form;
- object to what we do on the basis of our legitimate interest.
You can do some of this yourself in the app: download a finished month with all its documents and a summary, and delete your account under Settings. For anything else, write to support@bookmiri.com, or by post to our registered address in section 1.
8. Complaints
If you think we have not handled your data properly, you can complain to the supervisory authority in Cyprus: the Office of the Commissioner for Personal Data Protection, 1 Iasonos Street, 1082 Nicosia, Cyprus (dataprotection.gov.cy).
9. Cookies and browser storage
- The app sets one cookie,
appbox_session, which keeps you signed in. The app cannot work without it, so we do not ask for consent. It ends 30 days after you sign in, or when you sign out. - The app remembers two settings in your browser: light or dark, and which dashboard sections you have folded. They never leave your browser.
- This website sets no cookies.
10. Changes to this page
We may update this page. The date at the top shows the latest version. We will tell customers about important changes.