Privacy Policy

1. Who We Are

Accordez is a personal finance tracking application operated from Brussels, Belgium. When we say "we," "us," or "our," we mean the Accordez service and its operators.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights under the General Data Protection Regulation (GDPR).

2. Data We Collect

We collect only what is necessary to provide the service:

• Account data — your name, email address, and optionally a profile photo, phone number, language and time zone
• Agreement and bill data — amounts, schedules, dates, notes and payment records you create, together with the versioned history of any terms the two of you later change, and any late fees applied under terms you both accepted
• Messages — the written messages and voice notes you exchange with the other party inside an agreement, and when each of you last opened a conversation. That last item is what produces read receipts, and you can switch them off in Settings
• Contacts you save — the name, email address and optionally the phone number, relationship and notes for people you add to your contacts. Accordez never reads your phone’s address book; everything here is typed in by you
• Device and security data — your IP address, a device fingerprint, your browser or app user agent, and the tokens that keep you signed in and deliver push notifications. We use these to keep your account secure, to recognise devices you have used before, and to send you notices
• Document uploads — files you attach to agreements, stored securely in encrypted cloud storage. If you use Smart Capture to scan a bill, that image or PDF is also sent to AI providers to extract its details (see "Smart Capture & AI processing" below)
• Billing data — your subscription status and payment method details (handled directly by our payment processors, depending on where you subscribe — we never store card numbers)
• Usage and error data — which features are used, performance samples, and automatic error reports when something breaks
• Communications — messages you send via the in-app contact form

Biometrics never reach us. If you turn on the biometric app lock, your fingerprint or face is checked by your phone’s own secure hardware, which tells Accordez only whether the check passed. No biometric data is sent to us, and none is stored on our systems.

3. People You Record Agreements With

Accordez works between two people, so using it usually means giving us someone else’s details.

When you create an agreement or save a contact, you provide that person’s name, email address and sometimes their phone number. We use it to invite them, to identify them within the agreement, and to send them notices about it. We do not use it to market to anyone and we do not add anyone to a mailing list.

If they accept, they become a user in their own right, with their own account and every right described in section 7. If they never accept, we keep what you entered for as long as the agreement exists, so that the record remains intelligible.

Two things follow from this. You should have a genuine reason to give us someone’s details — in practice, an agreement you are actually making with them. And once you are both part of an agreement, neither of you can unilaterally erase it: section 6 explains what that means in practice.

4. Why We Process Your Data

We process your personal data on the following legal bases:

• Contract performance — to provide you with the Accordez service you signed up for
• Legitimate interest — to improve the product, to keep accounts secure, to recognise your devices and detect abuse, and to prevent fraud
• Legal obligation — to comply with applicable laws and regulations
• Consent — for optional features like push notifications (you can withdraw consent at any time)

5. Third-Party Services

We use trusted third-party providers to run Accordez. Each receives only the data necessary for their function:

All providers processing data outside the EU are bound by Standard Contractual Clauses (SCCs) ensuring GDPR-equivalent protections.

Smart Capture & AI processing

When you use Smart Capture to scan a bill, the image or PDF you provide is sent to third-party AI providers to extract its details — such as the amount, due dates, payment plan, beneficiary and reference. The document is transmitted securely and used only to return the extracted fields to you. Your documents are not used to train AI models. You can always enter bill details manually instead of using Smart Capture.

6. Data Retention

We retain your data for as long as your account is active. If you delete your account, your personal data is permanently deleted within 30 days, except where retention is required by law (e.g. billing records for tax purposes, retained for 7 years under Belgian law).

Agreements are shared records. Where you and another person are both party to an agreement, deleting your account does not delete their copy of it. We remove your profile and your personal details, but the agreement itself, its payment history, its version history and the messages within it remain available to the other party, shown against your name as it stood at the time.

This is deliberate. Those records are that person’s evidence as much as yours, and erasing them would take away something that was never only yours to remove.

7. Your Rights

Under the GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your data ("right to be forgotten"), subject to the shared-record limits described in section 6
• Portability — receive your data in a structured, machine-readable format. You can request this free of charge; paid plans also include a one-tap export in the app
• Restriction — request that we limit how we process your data
• Objection — object to processing based on legitimate interest
• Withdraw consent — for consent-based processing (e.g. push notifications), at any time

To exercise any of these rights, use the in-app contact form or email us at support@accordez.com. We will respond within 30 days.

8. Cookies & Local Storage

Accordez uses minimal cookies for essential functions only:

• Authentication session (required for login)
• Language preference
• Theme preference (light/dark)
• Whether you have chosen to hide your balance

The app also stores a small amount of data on your own device — including when you were last active, so the app lock knows whether to ask for your fingerprint when you return. This never leaves your device.

We do not use advertising cookies or third-party tracking cookies.

9. Security

We take security seriously. All data is encrypted in transit (TLS) and at rest. Access to production systems is restricted and audited. Payment data is handled exclusively by our payment providers and never passes through our servers.

You can add a biometric lock so that Accordez asks for your fingerprint before opening. As described in section 2, the check happens inside your phone’s secure hardware and no biometric data reaches us.

10. Children

Accordez is not intended for children under 18. We do not knowingly collect personal data from minors. If you believe a minor has created an account, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notice at least 14 days before they take effect.

12. Complaints

If you believe your data rights have been violated, you have the right to lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit) at www.dataprotectionauthority.be.

13. Contact

For any privacy-related questions or requests, contact us through the in-app contact form or at support@accordez.com.