Privacy Policy

Updated 29. lokakuuta 2026

1. Who we are

GigBooks is operated by Insightish Labs Oy, Finnish Business ID 3418658-7, Otaniemi, 02150 Espoo, Finland. Contact privacy@gigbooks.fi for privacy questions and requests.

We are the controller of personal data used to administer accounts, subscriptions, support and our business. For personal data a business customer entrusts to us for its bookkeeping, that customer is normally the controller and we act as its processor under Section 12 of our Terms of Service. Requests concerning another business’s records should be directed to that business; we assist it where appropriate.

This notice covers our app, website and support services. The Service is intended for adults conducting business.

2. Information we collect

We process information you provide, information generated when you use the Service, and relevant information from sign-in and purchase providers:

Account and business details: names, contact details, account identifiers, business and tax-registration details, and preferences.
Business records: income, expenses, invoices, receipts, bank statements and related customer or supplier information you submit.
Communications: messages, attachments and information you share with the assistant or our support team.
Subscription details: purchase references, plan, payment status and subscription dates. App-store payments are handled by the store; we do not receive your full card details through that payment flow.
Technical and usage data: IP address, device and app information, service interactions, and error or diagnostic information.

Provide only information relevant to your use of the Service. Necessary account information is required to create and administer an account; optional information depends on the features you choose.

3. Why we use information

Where we act as controller, our purposes and GDPR legal bases are:

Contract performance: providing your account, agreed features, subscription access and requested support.
Service, tips and reminder emails: besides service emails such as sign-in links and a welcome message, we send getting-started tips, offers and reminders (for example a trial ending, a VAT deadline or a weekly recap). We send them on the basis of our legitimate interest in helping you use the Service and meet your deadlines. You can opt out at any time under Settings → Email notifications in the app or with the unsubscribe link in every such email. Service emails you need to use the account are not affected.
Legitimate interests: administering business relationships, maintaining and improving the Service, preventing fraud and abuse, and handling legal claims. We must balance those interests against your rights and limit processing to what is necessary.
Legal obligations: meeting applicable accounting, tax and regulatory requirements.
Consent: optional activities for which consent is required, including applicable tracking and device-access activities, and the app’s AI features (receipt scanning and chat assistance via Google Cloud Vision and Gemini). The app asks per feature, and you can withdraw consent at any time in Settings → Privacy & AI without affecting manual bookkeeping. Accepting our Terms does not provide that consent.

For records processed on behalf of a business customer, that customer determines the lawful purpose and we follow its documented instructions.

We use the following providers for the purposes indicated, sharing information needed for those services:

Railway and Supabase: hosting, account services and secure data storage.
Google Cloud Vision and Gemini: document recognition and AI assistance.
RevenueCat, Apple and Google Play: purchases and subscription management.
Apple and Google: sign-in providers, if you choose to sign in with them.
Cal.com: booking a support call; it receives your name, email address and time zone.
Expo: delivering app updates; it receives the device’s IP address and an app installation id when the app checks for updates.
Resend: delivery of service, tips, offers and reminder emails.
Sentry: error reporting and service diagnostics.
PostHog: product and website analytics, only after you allow it.

If you give a VAT number, it is checked against the EU VIES register run by the European Commission.

When you use AI features, relevant submitted content and business information are processed by our AI providers to deliver the requested feature. You review the resulting bookkeeping suggestions. We do not use AI to make solely automated decisions that have legal or similarly significant effects on you. In the app, receipt scanning and Chat assistance each ask for your permission before anything is sent to Google, and you can turn either off in Settings → Privacy & AI. Turning one off stops future sharing; it does not recall content already processed. Google does not use the data you share through these features to train its models. Gemini requests and responses are kept by Google for a limited time for abuse monitoring and legal obligations, and may be processed outside the EU (see Section 5).

Access by our personnel and advisers is limited to their responsibilities. We may also disclose information where required by law, to address legal claims, or as part of a business transfer with appropriate safeguards. Providers acting on our behalf must follow applicable contractual data-protection requirements. App stores also process information independently under their own privacy notices.

5. EU storage and international transfers

Your financial data is stored in Ireland, within the European Union. Some service providers may process information or provide support outside the European Economic Area (EEA). Storage location does not mean every processing activity takes place in the EU.

Transfers outside the EEA require an applicable legal safeguard, such as a European Commission adequacy decision or Standard Contractual Clauses, together with additional safeguards where necessary. You may contact us for information about the destinations and safeguards applicable to your data, including a copy or description of those safeguards.

6. Cookies, analytics and device permissions

We use local device storage for preferences such as your selected website theme. Website analytics (PostHog, EU data region) load only after you choose Allow analytics on the banner. We keep your choice in your browser for 12 months and then ask again; you can change it at any time via Privacy choices in the footer. Diagnostics help us identify faults. Permission to use one feature is not consent to unrelated tracking. In the app, product analytics is off until you allow it. The app asks once, the choice is stored with your account, and you can change it at any time in Settings → Privacy & AI.

The app uses the camera and photo library to capture receipts and documents. While you are tracking a shift it uses your location to calculate distance. The distance is calculated on your device, only the distance in metres is sent to us, and coordinates never leave the device. The app does not use notifications. You can manage these permissions through your device settings. Declining a permission may limit the associated feature.

7. Retention and account deletion

We retain information only for the purpose for which it is needed, subject to customer instructions and applicable law. The relevant criteria are the account relationship, the record type, statutory retention periods, unresolved support or security matters, applicable claim periods and backup cycles.

Finnish bookkeeping requirements generally include ten years from the financial year’s end for specified books and financial statements, and six years from the end of the calendar year in which the financial year ended for vouchers and other accounting material. These periods concern the relevant accounting records, not every item of personal data. Our own billing records are subject to our separate legal duties.

You can delete your account yourself in the app under Settings → Delete account; deletion is immediate. We then remove your name, email address, business name and business address, and delete your sign-in, your chat history with the assistant and your notifications in the app. We also ask Apple to revoke GigBooks’ Sign in with Apple authorisation if you signed in with Apple. Your bookkeeping records stay, tied to the closed account and not used for anything else, at least for the periods above; we do not promise automatic deletion afterwards. They include entries, work records such as shifts, sessions and customer details, invoices (with the customer details on them), receipts and their scanned text, bank statements and account numbers, and your business ID or VAT number. Purchase records stay with the app store and RevenueCat, and analytics and error reports linked to a pseudonymous account id expire under those services’ retention periods. You can also request account deletion or erasure of personal data by email. Account closure does not automatically erase records subject to lawful retention. We will explain any continuing retention or refusal, restrict retained information to the relevant purpose, and address deletion of other information and copies through the applicable deletion process. Contact us for the retention period applicable to a particular record or for assistance obtaining your data. Statutory privacy requests do not require a paid subscription.

Export records needed for your business before closing your account. Cancel an app-store subscription separately; account deletion does not itself stop store billing. See how to delete your account, including what is removed and what stays.

8. Security

We apply appropriate technical and organisational safeguards, including access controls and protection of information in transit, proportionate to the data and risks involved. No online service is completely risk-free. Contact us promptly if you suspect unauthorised access, and do not send passwords or payment credentials by email.

9. Your rights

Subject to the GDPR’s conditions, you may request access, correction, erasure, restriction of processing and data portability. You may object to legitimate-interest processing on grounds relating to your situation and object to direct marketing at any time. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Accounting corrections may need to preserve a traceable record.

Send requests to privacy@gigbooks.fi. We may verify your identity proportionately. We respond without undue delay, normally within one month. If the GDPR permits an extension of up to two further months, we will explain it within the first month. Requests are normally free, subject to the GDPR’s limited exceptions for manifestly unfounded or excessive requests.

You may complain to the Finnish Data Protection Ombudsman or another competent supervisory authority, including where you live or work in the EEA. You do not waive that right by contacting us first.

10. Updates and contact

We will update this notice when our processing materially changes and provide additional notice where required. A new purpose requires an appropriate legal basis and information before the new processing begins. The revision date does not constitute your consent.

Insightish Labs Oy · Business ID 3418658-7

Otaniemi, 02150 Espoo, Finland

privacy@gigbooks.fi