Your data

Privacy and your choices

Effective 2 November 2026. Klaar is operated by Oba Labs B.V., KvK 98154710, Eerste Van Swindenstraat 373 A, 1093 GB Amsterdam, Netherlands. We decide how your data is used for this service. Contact admin@contabook.co about privacy or your account.

What we use to help you

We use your sign-in details, documents, the details read from them, your answers and corrections to help you prepare your tax information and save your progress. Documents can contain names, addresses, account details and financial information. Only add information needed for your return and documents you are entitled to share. We keep useful source and page references so you can check a suggested figure.

Choosing files or taking a photo lets you preview them first. Upload starts when you choose Read or Save. You can enter figures yourself instead. Unsaved manual details stay in this tab and clear when it closes or reloads. Saved returns belong to your account. We do not sell your documents, send them to advertisers or use them to train AI.

Where documents are read and saved

Cloudflare delivers this website and handles connection information to load and protect its pages. Account and document requests go directly to the services described below.

Supabase stores saved returns and original files in Ireland. Our Google Cloud service in the Netherlands checks files for harmful content and reads documents. Google Document AI reads scanned pages in its EU location; Gemini proposes details through its EU endpoint. We do not fall back to a Global processing endpoint. Check the proposed details against your originals: automatic reading can make mistakes.

Google says online Document AI processing uses memory rather than saving document contents to disk. Gemini caching is disabled for this project. Google may retain flagged prompts and responses for abuse prevention for up to 90 days in the selected EU area, with authorised review. That is separate from our normal document storage and deletion. Provider account, security and service metadata may have different international processing arrangements under their data-protection terms; EU document routing does not mean every provider operation is EU-only.

Your choices are separate

• Providing the service: we use the information needed to read and save the return you request. This is to perform our agreement with you. We use limited security and error information to protect accounts and keep the service working, based on our legitimate interest in a safe service.
• Optional usage records: only with your permission, we record steps, button actions, broad timing and whether an action succeeded. We do not include document contents, figures, filenames, typed answers or recordings of your financial screens. Declining does not stop you using the service. Change this in Cookie settings or your saved-account choices.
• Advertising measurement: Meta advertising tracking is currently off. If enabled later, it requires a separate choice and would be limited to the public landing page and account-registration measurement. Your financial documents and tax details are excluded.
• Future financial assistant: you can separately allow it to use saved documents, extracted details, sources and corrections to help you. The assistant is not available yet. Permission lasts 6 months, can be withdrawn in your account and does not extend document storage. No model training is allowed.

How long we keep information

Saved returns expire 90 days after their last save. Up to ten saved versions are kept within that period. Document-reading jobs, results and temporary reading records follow the return’s retention and deletion. Temporary worker files are removed after each attempt. Optional usage records expire after 30 days; cookie choices last 6 months. Our Google operational logs are limited to 30 days and exclude document contents. Account sign-in records remain while your account is active, subject to the provider’s security and backup arrangements.

You can delete a return or your account. Access stops immediately and file removal runs in the background, normally starting within 5 minutes. Failed removals retry. Provider security records, the Google abuse-prevention records described above and backups may expire later; deletion cannot recall files you already downloaded or a request already in progress. Contact us for the applicable backup expiry for your request. We do not promise immediate deletion from provider backups.

Who can receive information

Supabase and Google Cloud act as service providers under their applicable processing terms. Access is limited to running, protecting and supporting the service. We may disclose information when legally required. Where provider operations involve international transfers, their applicable contractual safeguards apply. We do not make a final tax assessment or submit your return automatically.

Access, corrections and deletion

Use your saved-return controls to reopen or correct information, download your data and original files, change optional permissions or request deletion. You can also email us to request access, correction, deletion, restriction, portability or to object to processing based on legitimate interests. Withdrawing consent stops future optional use; it does not change processing already lawfully completed. We may need to verify that you own the account. You can complain to the Dutch Data Protection Authority.

If we change how your documents are used or introduce a new optional purpose, we will update this notice and ask for any new permission needed.