Privacy information

The controller for the service's own processing is Starberg & More Solutions AB, company reg. no. 559200-6612: the connection, the email addresses, the search text, the support journal, the statistics, the operational logs and the rest listed under what is stored below. For the data in your bookkeeping, meaning what the service fetches and what the change log and an approval in progress hold, your company is the controller and we are the processor. Contact: info@amore.cloud.

What is processed

The service fetches data from your Fortnox account when you ask. It may contain personal data: names, addresses and contact details in customer and supplier registers, on invoices and in vouchers.

What is not stored

No copy of your bookkeeping. Data fetched from Fortnox is not stored anywhere in the service: it is passed to your AI assistant and is then no longer held by us. To keep follow-up questions fast, what was fetched is held in the service's working memory for at most three minutes, never on disk and only for the same company, and a change you make through the service clears it at once. The one exception is changes you approve, which leave a line in the change log described below, with Fortnox's response and the record read back. Files you upload pass through the service to Fortnox and are not stored. A document read for you is held in a temporary file while that happens and then deleted, after 15 minutes at the latest.

What is stored, encrypted

• The access token that lets the service reach your Fortnox account. A connection unused for 30 days lapses and is deleted, together with the email address and the connection's other details.
• The email address you gave when connecting. It is used to tell you in advance about what the agreement requires, such as changes to the price or the terms. The trial and billing are handled by Fortnox, so you hear about those from them. It is also used to tell you when a company is added to your connection, when someone asks for access to a company you manage and when an invitation you sent has been used. It is not used for newsletters or marketing. When a company is added, the company gets an email at its address in Fortnox about the connection, showing your address. It is removed when the connection is removed or lapses.
• Who reaches the company through the service. For each connection: which AI app it was made in, whether it may read or also write, when it was made and how it came about. Someone who came in through an invitation is listed with their own and the inviter's email address; someone who came in through a request, with the name and email address Fortnox holds for them. This is shown to whoever manages the company, and removed when the access is removed.
• Pending invitations and requests. An invitation holds the recipient's email address, who invited them and which right it gives, and is valid for seven days. A request for access holds the person's name and email address at Fortnox, and stays until it is approved, declined or withdrawn, or the connection ends. We receive a copy of every request. When someone asks for access, the service checks who they are through a sign-in at Fortnox and gives that access back at once.
• The weekly email, if you sign up. The recipient's email address and which company the letter covers. A sign-up not confirmed within a week is removed. The link in every letter ends it, and the sign-up is also removed with the connection.
• A log of changes sent, which you can read yourself: what kind of change, when, to which company and whether it succeeded, together with Fortnox's response and the record we read back afterwards, that is, the data in the record you changed. The log is kept on your behalf, as part of the processing described below. The log cannot be altered afterwards; it is what ensures a change is never sent twice. Its lines are deleted automatically 90 days after the change. For a change where it never became clear whether it reached Fortnox, only a lock without content is kept after that, so that it cannot be sent twice.
• An approval in progress, while you decide. It holds the content of the change and is removed automatically after ten minutes.
• What is searched for in the tool list. When your assistant looks for a function, the search text is saved so that we can see what customers ask for that the service does not do. It may contain a name or an amount if you typed one. It is encrypted, deleted after 90 days, and accessible only to us through the support tool. When the company uses protection mode, only the fact that a search was made is saved. The content of the answers to your questions is never saved.
• Events around the connection, such as a company being connected or added, an invitation being used or the weekly email being ended, with the company's name and number in Fortnox and whether it succeeded or why not. They are kept in the same support journal as the search text and deleted after 90 days.
• Usage statistics. Per day and company, only how many calls were made and how many ended in an error; those lines are deleted after 90 days. Without the company, which kinds of calls and error codes occurred is also counted, and kept for just over a year. What the calls contained is never saved.
• A few facts about your conversations, not your books. When your latest conversation began, so the assistant can tell you what has happened since. When the example questions, the news and the tips about your AI app's settings were shown, so they are not shown again. And if Fortnox refused a change: only Fortnox's error code and the time, never what the change was, so the assistant can offer to pick it up next time. The refusal is deleted once followed up, and everything is deleted with the connection.

Operational logs record which kind of call was made, whether it succeeded, which company it concerned and the question's parameters, such as a period. The content of an answer or a change is never logged. The web server also logs IP address, time, page and browser for every visit, including to the website. The operational logs are deleted after 90 days at the latest, often sooner.

If you arrive from a Google ad. When you click through to Fortnox from a page you reached through an ad, the ad’s click ID is saved in the operational log together with the time of the click. No cookie is set. If the service is then activated in Fortnox shortly afterwards, we report the click ID and the time of the purchase to Google (Google Ireland Limited, which is responsible for its advertising service), so that we can see which ads lead to purchases. Nothing else is given to Google, neither the company nor anything from the accounts. The click ID is deleted with the operational log.

If you write to us. What you send through the contact form or by email (name, email address, company and message) is not stored in the service. It reaches our email and is kept there for as long as the matter requires.

Why, and on what legal basis

• The access token, the email address and the connection's details: to perform the agreement with your company (Article 6(1)(b) GDPR). Details of colleagues who were invited or asked for access are processed on the company's and our legitimate interest in knowing who reaches the company through the service (Article 6(1)(f)).
• The weekly email: to deliver what you asked for (Article 6(1)(b)).
• The search text, the support journal, the statistics, the facts about conversations and the operational logs: legitimate interest (Article 6(1)(f)) in the service working, being secure, being supportable and getting better.
• The ad click ID: legitimate interest (Article 6(1)(f)) in knowing which ads lead to purchases. Only the click ID and the time are given to Google.
• What you write to us: legitimate interest (Article 6(1)(f)) in being able to answer you.
• The data in your bookkeeping, including what the change log and an approval in progress hold, we process as a processor, on your instructions; its legal basis is your company's.

Where processing rests on legitimate interest, you have the right to object to it.

Your sign-in details

Your Fortnox sign-in never passes through the service. You sign in directly at Fortnox, which then gives the service limited access that you can withdraw yourself.

Where the data is, and who receives it

The service runs on servers in the EU (Amazon Web Services, Ireland), email from the service is sent from there, and encrypted backups of what the service stores are kept in the same region for 90 days; what is deleted leaves them within that time. The service runs in the EU and we move no data out of it.

What you fetch is passed to the AI service you chose and connected, and that provider's own privacy policy governs what happens afterwards, including where it is processed. What the providers promise is set out on the AI providers page. The service passes data to no one else.

Processing on your behalf

When the service fetches data from your bookkeeping, we process personal data on your behalf: you are the controller and we are the processor. This includes the change log and approvals in progress, which hold the data in the records you change; they are kept on your behalf so that a change is never sent twice and you can see afterwards what happened. A name or amount you type in a question may be kept in the search text. Amazon Web Services (Ireland) is our sub-processor for hosting, backups and email; we tell you at least 30 days before engaging a new one, and you can object and terminate the agreement. We help with security measures, impact assessments and prior consultations as needed, and tell you if an instruction infringes data protection rules. This section of the privacy information, together with the user agreement, forms the data processing agreement between us. A summary is here.

Your rights

You have the right to information, rectification, erasure, restriction, objection and data portability. For the data we are responsible for ourselves, such as the email addresses, the connection's details, the search text, the support journal, the statistics and the operational logs, write to us at info@amore.cloud. The bookkeeping data is in your Fortnox, as the service does not store it, and a request about it is handled there with our assistance. This also covers what is in the change log. If you believe personal data has been processed incorrectly, you can complain to the Swedish Authority for Privacy Protection (IMY).