Privacy policy

The data controller is GJO&PARTNERS LTD, a company registered in England and Wales under number 17319883, with its registered office at 128 City Road, London EC1V 2NX, United Kingdom.

For any question about your data, or to exercise your rights, write to contact@gjoandpartners.com.

Account data: your email address, a password stored in hashed form, your interface language, and the date the account was created.

File data: your company's name, country, currency, accounting framework and financial year dates, together with all your entries, accounts, supporting documents, counterparties, tax adjustments, shareholders and beneficial owners. This is the data you enter, import or upload.

Billing data: the plan taken, the state of the subscription and the matching Stripe identifier. No card data passes through our servers or is stored by us.

Technical data: access and error logs produced by our hosting providers, and an internal audit trail that records the sensitive actions of a file (invitation, role change, year-end close, override of a tax parameter).

Audience measurement: a count of page views, with no cookie, no persistent identifier and no individual profiling. It tells us where visitors drop out of the sign-up path.

To perform our contract with you: keeping your books, producing your statements, managing your subscription, giving you access to the service.

To meet our legal obligations: invoicing, retention of records, responding to requests from the competent authorities.

On the basis of our legitimate interest: security of the service, prevention of abuse, aggregate audience measurement, product improvement.

We make no solely automated decision producing legal effects concerning you, and we do not use your data for advertising.

The members of your file, according to the role you granted them. You open and withdraw that access.

Our technical processors, limited to what their function requires: Supabase for hosting the database, authentication and uploaded files; Vercel for hosting the application and measuring audience; Stripe for payment and invoicing.

The language model provider you chose, when you use entry assistance. It receives the sentence you dictate, the file you upload and your chart of accounts, so that a proposed entry can be drafted. If you choose « no assistance », nothing leaves the service.

Our own team, only when you ask for support and only so far as answering requires.

We neither sell nor rent your data, and we do not use it to train models.

The database and the files you upload are hosted by Supabase in the European Union, in Ireland.

The application is served by Vercel from its international network. Payments are handled by Stripe, whose infrastructure sits in the United States and in Europe.

Where a transfer outside the European Economic Area or the United Kingdom is necessary, it relies on the European Commission's standard contractual clauses or on a recognised adequacy mechanism.

Your file data is kept for as long as your account is active.

When a file is closed, it is kept for thirty days so you can export it, then deleted.

Billing data is kept for the period required by the applicable accounting and tax rules, being six years from the end of the financial year concerned.

Technical logs are kept for no more than twelve months. A file's audit trail follows the life of the file.

You have rights of access, rectification, erasure, restriction, objection and portability over your personal data. Portability is immediate and needs no request: your statements and your general ledger are exportable from the service at any time.

To exercise the other rights, write to contact@gjoandpartners.com. We answer within one month.

If our answer does not satisfy you, you may refer the matter to the competent supervisory authority: the Information Commissioner's Office in the United Kingdom, or the data protection authority of your country of residence.

FinOS uses only cookies strictly necessary to its operation: those that keep your session open and those that preserve your language choice. They serve no advertising purpose.

Our audience measurement works without cookies and without a persistent identifier. That is why no consent banner is shown to you.

Exchanges with the service are encrypted in transit. Separation between files is enforced by the database itself, row by row, and not by the application alone.

API keys you entrust to us for entry assistance are encrypted before storage, with a secret that does not live in the database, and are never displayed back to you.

In the event of a data breach likely to create a risk to your rights, we inform the competent authority within seventy-two hours and inform you without undue delay.