Privacy policy

Who is responsible

Martin Tomov operates Renkonta and this website as an individual developer based in Bulgaria. He is the data controller for account and service administration. Contact: hello@renkonta.com.

For personal data in your client records, invoices and imported statements, you decide why the data is used and which records to enter, share, export or delete. We process those records on your instructions to provide the app. If you act for another business, you must have its authority to give those instructions. Our account-administration role does not make us the controller of your clients’ records.

What we collect

Account data: your email address and password (stored as a salted hash by our authentication provider), your phone number if you sign in with a text-message code, or, if you use Sign in with Apple, a stable Apple user ID and the email address Apple shares with us (which may be a private relay address).

Business data you enter: your company profile (name, address, email, phone, tax and bank details such as your IBAN, and a logo if you add one), your clients, invoices and any notes, imported payment statements and matching decisions. This is your data — we store it so the app can work; we do not sell it or use it for advertising.

Subscription data: whether your subscription is active and which plan you have. Apple processes the payment; we never see your card details.

Crash and error reports: technical details of what went wrong, such as the app version, device model and operating system. We configure reporting to limit personal and business data; the reporting provider also handles connection data when receiving reports.

Push notifications: if you enable notifications, we register a device push token linked to your account and platform. Expo and Apple deliver notifications and receive the token and notification content, which can include a client name or payment notice.

Device-local preferences (language, reminders, onboarding answers) stay on your device.

We run no advertising and no tracking across apps or websites. RevenueCat uses subscription purchase records for entitlement checks and subscription reporting, including purchase analytics. The website sets no advertising or analytics cookies: it counts visits with Cloudflare Web Analytics, which uses no cookies and does not track individual visitors (see Service providers).

Why we process it

To administer your account and provide the service to you (contract). For personal data in your business records, we store invoices, match payments and produce exports on your instructions; you are responsible for the lawful basis for processing those records.

Legitimate interest: crash and error reports, so we can find and fix faults.

With your consent, where required (e.g. reminders/notifications on your device).

Where it lives

Your primary account and business data is stored with Supabase in Zurich, Switzerland. The European Commission recognises Switzerland as providing an adequate level of data protection. This is a storage location, not a promise that every processing operation occurs in Switzerland. Shared documents, server functions, service providers and restricted operational backups are also involved in providing the service.

Some service providers below handle specific data in other countries, as listed. Switzerland’s adequacy decision does not cover those other countries or every service provider. Contact us for information about a provider’s processing locations and the safeguards applicable to its transfers.

Service providers

Supabase — database, sign-in, file storage (your logo) and server functions. Primary project data is stored in Zurich, Switzerland; server functions may execute in other regions.

Apple — App Store subscriptions (Apple processes the payment under its own terms and privacy policy; we never see your card details) and Sign in with Apple.

RevenueCat (USA) — verifies subscription entitlements and provides subscription reporting and purchase analytics. It receives a randomly assigned, pseudonymous app user ID and the App Store purchase records for your subscription. The app does not send RevenueCat your name or email address.

Sentry (USA) — technical crash and error reports, stored in Sentry’s EU data region in Germany. Reports can include a pseudonymous installation identifier and device context. We disable default personal identifiers and sanitize app context, but do not describe these device-associated reports as anonymous. Sentry also handles connection data when receiving reports.

Resend (USA) — delivers the emails the app sends: invoices and exports you email to clients or your accountant (recipient address, message and attached file), your payment and reminder notifications, and account emails such as sign-up confirmation or password reset.

Resend (Plus Five Five, Inc.) stores messages, attachments, delivery logs and account records in the United States. Our Ireland sending region does not change that storage location. Its processing agreement incorporates the EU Standard Contractual Clauses for these transfers, including provisions for Switzerland.

Expo — delivers remote push notifications after you enable them. Receives device push tokens and notification content; Apple delivers the notification to your iOS device.

Vonage — sends the one-time sign-in code by text message if you sign in with your phone number; it receives your phone number and the code.

Stripe — only for optional card-payment links on your invoices, once that feature is enabled; it is not available in the app yet.

Cloudflare (USA) — hosts this website and delivers the accountant report links opened at renkonta.com, which means it handles connection data such as IP addresses.

Cloudflare Web Analytics — on this website only: counts visits and pages viewed. It sets no cookies and does not track individual visitors. App subscription reporting is described under RevenueCat above.

We add processors only when a feature needs them, and update this page when we do.

Retention

Account and business records remain in the active service until you delete them or your account. Account deletion removes your login, company records, invoices, transactions and uploaded logos from the active service. It does not create a statutory archive of your invoices. Export and keep the records you need to meet your own accounting and tax obligations before deleting them.

Deletion from the active service does not instantly erase copies in restricted operational backups or records held by other service providers. Backup copies remain until the applicable backups rotate out; provider records follow their retention policies. Files already downloaded or emailed to you or your chosen recipients remain with those recipients.

Resend retains email content and delivery logs for 30 days on our current plan; its backups persist for 7 days. Its deletion period of up to 90 days starts when Renkonta terminates its Resend account, not when you delete your app account. For a request to remove a message earlier, contact hello@renkonta.com; provider assistance is required.

Website waitlist

If you join the website waitlist, we store your email address, language, any country and payment-method preferences you provide, and an invite reference if present. We use these to send you one email when Renkonta launches on the App Store and understand demand for countries and payment methods. Waitlist data is stored in the same Supabase project in Zurich, Switzerland.

You can withdraw your request for the launch email or ask us to remove your waitlist entry by emailing hello@renkonta.com. Deleting an app account does not automatically remove a separately submitted waitlist entry.

Your rights

Access and portability: Settings → Export my data gives you a complete JSON export, self-serve.

Erasure: Settings → Delete all my data removes your company, invoices and transactions from the active service. The backup, provider and recipient-copy limits above also apply.

Account deletion: Settings → Delete account (also offered on the subscription screen) deletes your account, everything in it and your login. If you signed in with Apple, we also ask Apple to revoke the app’s access to your Apple ID.

You can also contact us to exercise any GDPR right, and you may lodge a complaint with your supervisory authority.

Changes

We will update this policy as the product evolves (e.g. when payments or bank connections go live) and mark the date above.