Privacy Policy

1. Who Are We

Zenboek is a product of Softply, a company registered in the Netherlands. We are the data controller within the meaning of the GDPR (General Data Protection Regulation).

2. What Data We Collect

We only collect personal data that is necessary for providing our services. We collect the following categories:

3. Cookies

We use cookies and similar technologies. Below is a summary:

You can manage or withdraw cookie consent at any time via your browser settings or our cookie banner.

If you consent to Analytics cookies, we also track - in addition to Google Analytics - which public pages of zenboek.com are visited, through which source (e.g. a search engine, LinkedIn, or an AI assistant such as ChatGPT), and any associated campaign data (UTM parameters). Based on your IP address we determine an approximate location and, for business internet connections, possibly a company name - used solely to recognise whether a visiting company is a relevant prospect for our own marketing. We do not perform that lookup ourselves: your IP address is sent to IPinfo Inc. (United States), which returns the country, city, approximate coordinates and any organisation name. Only IP addresses are sent there, never account, bookkeeping or contact data. This data is never linked to your account if you are also a customer, and is automatically deleted after 6 months of inactivity at the latest (see section 6). Visits from automated search-engine and AI crawlers (such as Googlebot or GPTBot) are counted separately and fully anonymised, without recording any IP address or other personal data - these are not natural persons and fall outside GDPR's scope.

Google Analytics 4 runs on zenboek.com only, on the production environment only, and only after you have consented to Analytics cookies; without that consent the script is not loaded at all. IP anonymisation is enabled, so Google only receives your IP address in truncated form. Google Analytics further processes your user agent, the pages you visit and a pseudonymous cookie ID. Google LLC is established in the United States; that transfer is safeguarded by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses (see section 5c).

In addition, we measure ourselves, on our own servers, how visitors use the public pages of zenboek.com, in order to improve the website (conversion optimisation). Without consent to Analytics cookies this is strictly anonymous: for each page visit we record which parts of the page came into view, how far the page was scrolled, where was clicked (as a position on the page and a fixed identifier of the clicked element), how long the page was open, the type of device (mobile, tablet or desktop), the screen size, the referral category (for example a search engine) and campaign data (UTM parameters). The identifier of the page visit only exists while the page is open. We do not store your IP address, do not keep your user agent (only the device type derived from it) and never record what you type into a form field or any other text of the page. For forms we only record which field was used and whether the form was submitted. We also record how long the mouse pointer (only with a mouse, not with touch) rested in an area of the page and how long each part of the page was in view. Your browser adds this up itself per area of about 40 pixels high; we only receive those totals and never the path of the mouse, the order of movements or a recording of your screen. If your browser sends a Global Privacy Control or Do Not Track signal, we do not measure anything at all.

When we compare two or more versions of a page (an A/B test), you only take part if you have consented to analytics cookies. We then record which version you saw with your visitor profile of our own website measurement, so you see the same version on your next visit and we can count per version how many visitors created an account or requested a demo. Without that consent, or if your browser sends a Global Privacy Control or Do Not Track signal, you always see the standard version and do not take part. We do not set a separate cookie for this; the zb_ab cookie we used until 10 October 2026 is removed on your next visit.

If you have consented to Analytics cookies, we link these page visits to the visitor profile described above, so we can see which route visitors take through the website. You can withdraw your consent at any time via the cookie banner.

Our own server also records when a step in the sign-up process is reached (contact or demo request, account created, trial started, onboarding completed, first invoice sent, subscription paid). We only record internal IDs and attributes (user ID, company ID, plan, amount) and never your name, email address, BSN number or IBAN. Only with your consent to Analytics cookies is such a step linked to your website visit. This measurement data stays on our own servers and is not shared with third parties. We delete raw measurement data after 90 days; after that only aggregated statistics that cannot be traced back to individuals remain, for at most 25 months.

Address search

When you search for a Dutch address, we send the address search term or postal code and house number through our server to the PDOK Locatieserver. After your selection we retrieve the matching public BAG address. These requests do not include an account ID, customer or employee name, email address or other form data. You can also enter addresses manually.

License plate lookup (workshop and used-car sales modules)

When a car business uses the workshop or used-car sales module and requests vehicle details from the RDW, we send only the license plate through our server to RDW Open Data, the public dataset of the Dutch Vehicle Authority (Rijksdienst voor het Wegverkeer). The customer's name, address or other data are not included. We keep the answer (make, model, date of first registration, fuel type, colour and APK expiry date) in a cache for at most 24 hours, so the same license plate is not requested again. The RDW is not a sub-processor here: it is a public source that we consult. Vehicle details can also be entered manually.

Vehicle and object data (workshop module)

In the workshop module a business records the vehicles, machines and appliances of its customers, such as a car, bicycle, boat, agricultural machine or washing machine. This includes identification numbers: license plate, chassis number (VIN), frame number, serial or build number and hull identification number (CIN), as well as make, model, meter readings in kilometres or operating hours, inspection and maintenance dates and optionally the address where the object is located at the customer. Because these numbers can be traced back to the owner, we treat them as personal data: we process them solely as a processor on behalf of that business and for its workshop administration, we do not record them in log files, and only the license plate is ever sent to an external source (RDW Open Data, see above). A serial or frame number you enter when booking an appointment online is only linked to an object that the business already holds under your own name.

Staffing: temporary workers and hours approval (staffing module)

When a staffing agency uses the staffing module, we process on behalf of that agency and as a processor the placements of its temporary workers with hirers (position, period, hourly wage and rate), the timesheets, the phase in the phase system, the date on which the agency checked the identity with the type of document and its expiry date (without a copy and without a document number), and the validity of any work permit. If you are a hirer's contact person and approve hours via the link in the email, we record your name, your email address, the time, your IP address, your browser and a checksum of the approved hours as proof of the approval. The approval page only shows you the worker's name, position, days and hours, never the wage or rate. Approved timesheets are part of the payroll and invoice records and follow the 7-year retention period. Within its own records, the agency can link vacancies to hirers and scheduled shifts to placements. The vacancy link requires access to recruitment and staffing; the shift link requires access to planning and staffing. These internal links do not give the hirer access to candidate or employee files. The existing hours approval through the email link remains separate from these links. For payroll administration, the agency also records verified employment agreements, opening phase balances, references for worked and paid holiday weeks, and pension and fund participation. Legally required AWf evidence includes document references, signature and validity dates, and the type of UWV employer payment, without medical details. Missing payroll source data for historical hours is confirmed separately with a source reference and verification date. Historical calculation data is stored encrypted with the payroll records. Hirers cannot see these data, which follow the same access controls and applicable retention periods. For housing, the agency processes occupancy periods, rental agreements, quality and certification references, voluntary housing choices and separate, revocable payroll deduction authorisations. Transport planning includes trips, drivers and passengers. Verified payroll agreements, deductions, reservation balances and dated sick pay rules retain the necessary financial source and history, without diagnoses. Dated hirer employment conditions and verified income guarantee sources include the relevant conditions, arrival and first-work dates and evidence references, without inferring nationality or origin. These data are available only within the agency's organisation to users with appropriate HR, staffing and financial permissions. An ordinary administration reset preserves these HR and payroll histories. No new blanket retention period applies to housing or transport data: the agency determines the applicable period for each purpose and legal obligation. Pension declarations use separate test and production configurations; transmission to a pension administrator requires the explicitly configured connection and the relevant permission.

Emergency contacts of employees (HR module)

A company can record up to two emergency contacts for an employee: name, relationship to the employee (for example partner or parent) and telephone number. The employee can also enter and update them in the employee portal or the app. These are personal data of someone other than the employee. We process them as a processor on behalf of that company, only so that someone can be reached in an emergency. They are visible only to the employee and to users with HR permissions within the company, are not recorded in log files and are replaced by fictitious data in anonymised copies. Once the employee leaves, the purpose ends: Zenboek automatically deletes the emergency contacts 3 months after the end date of employment and tells HR when this will happen as soon as that date is recorded. Deleted data may remain in our encrypted backups for up to 30 days; those expire automatically.

Traffic fines on company vehicles (fleet module)

When a company records traffic fines on its vehicles, we process on its behalf the details of the fine (CJIB number, offence code, offence, time, place and amount, and the scan of the notice in protected storage) and the presumed driver. If the company wants to set off a fine against wages, a user with the permission to manage personnel data records when and where the employee gave written consent and which protected earnings amount (beslagvrije voet) applies; the set-off only runs through a verified payroll agreement that protects the minimum wage. The employee sees their own fines in the employee portal and can lodge an objection; while an objection is pending, nothing is deducted. The objection, the decision and the history are visible only to the employee and to users with HR permissions within the company, and the explanations are stored encrypted. Fines that have been set off are part of the payroll records and follow their retention period; the company determines the period for other fine data.

On-site maintenance and service (service module)

When an installation, maintenance or repair-service business uses the service module, we also process on its behalf: locations of its customers with the name, phone number and email address of an on-site contact person and access instructions (no codes or passwords; the application warns against this); readings and results of maintenance checklists; an F-gas log per installation including the name of the technician; certificates issued by inspection bodies; and fault reports with the name and phone number of the person reporting and optionally a photo. Certificates and photos are stored in a protected location and can only be opened through the application by staff of that business with the right permissions. A fault you report as a customer in the customer portal only goes to the business you are a customer of. A route button opens the technician's maps app; we do not send anything to a map service ourselves. The business keeps the F-gas log for at least five years, as required by the F-gas Regulation (EU) 2024/573; an installation with a recent log can therefore not be deleted.

4. Why We Process Your Data

MCP applications and import sources you connect

When you authorize an external MCP application, we process and share data within the company permissions you grant. You choose per area (for example invoicing, accounting, CRM or staff) whether the application may read, create drafts or also finalize, and the application never gets more access than the user who set up the connection. Citizen service numbers (BSN), bank account numbers of individuals, passwords and health data (including absence and sick leave) are never shared through a connection; salary data only when you choose that separately. For an MCP import, Zenboek reads the source function you select and stores the mapped preview encrypted. Records are added only after your confirmation. Access tokens and synchronization conflicts are stored encrypted. Disconnecting removes stored access to an import source and pending previews; previously imported records remain in your administration. Revoke permission with the external provider as well where necessary. That provider has its own privacy policy.

Web shops and marketplaces you connect (Shopify, WooCommerce, bol.com)

When you connect your Shopify store, your WooCommerce web shop or your bol.com seller account, Zenboek retrieves data on your instructions to keep your records: orders with name, email address, delivery and billing address, ordered items and amounts of your customers (Shopify and WooCommerce), and the invoices and settlements bol.com issues to you. From orders we create sales invoices and customer records in your administration; these fall under the statutory tax retention obligation. The keys that give Zenboek access are stored encrypted and are never shown or logged. Zenboek only reads and sends no customer data back to the platform. Disconnecting deletes the keys; previously imported records remain in your administration. The platform processes the data under your own agreement with that platform and is not a sub-processor of Zenboek; that platform has its own privacy policy.

Signing in to apps you connect (single sign-on via SAML)

When your company uses Zenboek as the sign-in service (SAML identity provider) for other apps, for example Claude, Google Workspace or Microsoft 365, Zenboek sends identity data on your instructions to the app you connected for that purpose each time a team member signs in: the email address or a fixed, non-traceable user ID per app, and only the data you switch on per app (first and last name, display name, role or company role in Zenboek). You choose the apps and who has access; Zenboek never sends more. We keep the time of the most recent sign-in per team member per app and record every sign-in in your company's audit log; we do not store or log the content of the message to the app. The key Zenboek uses to sign those messages is stored encrypted. When you disconnect an app or a team member becomes inactive, signing in through Zenboek stops immediately. The app is a recipient you choose and not a sub-processor of Zenboek; you remain the controller, and the app is governed by your own agreement with that party and its privacy policy, also where it processes the data outside the EEA.

5. Sub-processors

We use the following third-party sub-processors whose services are necessary for delivering Zenboek. A full list is available at zenboek.com/en/sub-processors. We never sell your data to third parties.

5b. AI Processing and Automated Decision-Making

Zenboek offers features based on artificial intelligence, such as transaction categorisation, the AI accounting assistant, tax tips and reading invoices and receipts. We also use AI for our own LinkedIn prospect research (see above).

Only with your company's consent. Data from your administration is only processed by AI after your company has given consent, during onboarding or via Settings > AI Autopilot. That consent is voluntary: without consent Zenboek works as normal, just without AI features, and no data from your administration is sent to an AI provider. You can withdraw consent at any time via Settings > AI Autopilot; this switches off all AI features. Giving and withdrawing consent is recorded. Automatic AI features (for example categorising imported bank transactions) additionally only run when you switch on the corresponding toggle in the AI settings.

Which data. When you use an AI feature, the data that feature needs is sent to the AI provider. This data is not anonymised for that purpose. Depending on the feature, it includes among other things: images of receipts and PDFs of (purchase) invoices and other documents, transaction descriptions with the counterparty's name and IBAN and amounts, customer and CRM data, CVs and application data of candidates, employee data (such as name and job title) when drafting a contract, and financial figures from your administration for analyses and advice. The AI features in the application are processed by Google (Gemini); the other AI providers in the table above are used for the purposes stated there.

Automated decision-making (GDPR Art. 22): Zenboek does not apply fully automated decision-making that has legal effects on you. AI suggestions are always informational and require your own review; you can always manually adjust or ignore AI output.

5c. International Data Transfers

Your data is primarily stored within the EEA (Hetzner, Germany/Finland). For specific functions, data is transferred to service providers outside the EEA, mainly the United States: AI processing (Google, OpenAI, Anthropic, Cohere), push notifications (Expo), website analytics (Google Analytics) and the IP location lookup for our visitor statistics (IPinfo). These transfers are safeguarded by Standard Contractual Clauses (SCCs) and/or the EU-U.S. Data Privacy Framework in accordance with GDPR Art. 46. Which safeguard applies to which party is set out in the sub-processor list.

Audio and video from demo and customer calls do not leave the EEA: they run through a LiveKit media server that we operate ourselves on our own infrastructure in Germany, without an external video provider.

Data from our own website measurement (conversion optimisation) never leaves our own servers within the EEA: no external analytics service is involved.

6. Retention Periods

We do not retain your data longer than necessary. The following retention periods apply:

7. Your Rights Under the GDPR

As a data subject you have the following rights. Submit requests to privacy@zenboek.com. We respond within one month.

8. Security

We take data security seriously and implement the following technical and organisational measures:

• All data in transit is encrypted via HTTPS/TLS
• Passwords are stored as bcrypt hashes, never in plain text
• Two-factor authentication (2FA) is available for all accounts
• Our infrastructure runs on ISO 27001-certified data centres in the EU
• Regular automated backups, stored exclusively in the European Union
• A backup of your administration that you request yourself is written to non-public storage and can only be downloaded after you sign in, through an unguessable address. Passwords and access keys are excluded. After 7 days the download expires and the file is deleted from our servers.
• The mobile app never stores payslips, salaries, absence records, bank data or other special categories of personal data on the device, and removes fields such as BSN and IBAN from the offline copy. That offline copy (at most 7 days) is not separately encrypted by the app but is protected by the operating system; your sign-in token is kept in the device's secure storage. The copy kept on our server to prevent duplicate processing is stored encrypted and deleted after 8 days.
• In the event of a personal data breach that may put your rights and freedoms at risk, we notify you and the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) without undue delay, in accordance with GDPR Art. 33–34 (the Autoriteit Persoonsgegevens must be notified within 72 hours where required)

9. Contact

For privacy-related questions or requests, please contact us:

10. Changes to This Policy

We reserve the right to update this privacy policy. For significant changes, registered users will be notified by email at least 30 days in advance. The current version is always available on our website.

If you do not agree with the changes, you may contact us or terminate your account before the new version takes effect.