Privacy policy
Last updated:
This policy explains what personal data we process on the conta.finance website, in the help center (help.conta.finance), on the accounts platform (accounts.conta.finance) and in the application of each organization. It says why we use the data, on which legal basis, with which providers and for how long, and how you can use your rights.
Data controller
Stakely, S.L., tax ID (CIF) B72551682, with its address at C/ Ferraz 2, 2º Izq, 28008 Madrid, España, provides Conta Finance. For any question about privacy, email us at [email protected].
The data of your organization
An organization that contracts Conta Finance loads or connects its accounting data: its own accounts and their addresses, its transactions, its contacts and counterparties, its categories, rules, notes and comments, the files that it imports, and what comes from its exchanges and its ERP. That data can include personal data, for example the name of a contact, or the bank account and the beneficiary of a withdrawal from an exchange.
For that data, the organization is the controller and Stakely is the processor (article 28 of the GDPR). We process it only to provide the service, on the instructions of the organization and as the contract and the terms of use say. If your data is in the records of an organization, ask that organization to use your rights. If you write to us, we send your request to it. The rest of this policy is about the data for which Stakely is the controller. The list of providers also names the providers that take part when we provide the service to the organization.
What data we process and why
When you write to us from the website
- Data. What you type in the contact form: your name, your work email and, if you choose to give them, your company, type of organization, transaction volume, main sources and your message. In the newsletter form, your email and your request. Also the language of the page.
- Purpose. To answer your request and, if you ask for it, to prepare the call. If you ask for the newsletter, the team handles your subscription by hand: the form does not subscribe you. A contact request does not add you to any mailing list.
- Legal basis. Your consent, which you give when you check the box before you send the form. You can withdraw it at any time by writing to us.
- Where it goes. The form sends an email to our mailbox, and a confirmation to the address that you typed, which repeats neither your message nor your name. It stores nothing in any database. Cloudflare sends both emails and forwards ours to the mailbox of the team, which Microsoft (Outlook) keeps. Both act as our processors. To stop abuse, the server counts the requests of each IP address for ten minutes, in memory, without storing them.
- How long. We keep the message for as long as the conversation lasts and for the applicable legal period, and then we delete it. We keep a newsletter request until you ask us to remove you.
When you visit the website or the help center
The help center uses no analytics or advertising cookies. Cloudflare provides the delivery network and the security of the website and of the help center. It processes the IP address and the technical data of each request (browser, page and time) to serve the pages and to protect them from attacks. Legal basis: our legitimate interest in websites that work and are protected.
In the help center you can ask Ask ContaGPT how the product works. Your question and the conversation go to Anthropic, which provides the language model as our processor, so that it answers from the help articles. These questions need no personal or accounting data: do not include any. The server stores no question. The conversations stay only in your browser (the newest 20), and you can delete each one from the help center. To stop abuse, the server counts the questions of each IP address for one hour, in memory. Legal basis: our legitimate interest in answering questions about the product.
Your account on the platform
To give you access to Conta Finance, the accounts platform processes:
- your email, your name, your photo if you upload one, and your preferred language;
- the teams and the organizations that you belong to, your role and your access level;
- the methods that you sign in with: the code by email and, if you connect them, your Google or Microsoft account (we keep the identifier that the provider gives us);
- two-step verification, if you turn it on: the secret of your authenticator app, encrypted, and your recovery codes, kept as hashes that cannot be read back;
- your sessions: the browser and the system that you use (the user agent), when each session started and when you last used it;
- the date and the method of your last sign-in, whether it used the second factor, and your last activity in each organization;
- the invitations that you send or receive (email, team, role and dates), and the offers between teams;
- an audit log of the changes of access and of security: who invited whom, who changed a permission, the refused sign-ins (with the email that was tried) or the connection of an AI client.
The people of your team see your name, your email, your photo and your role. The owners and the administrators also see your last sign-in, whether you use the second factor and your last activity. The application of each organization keeps a copy of your name, your email and the link to your photo, to show who made each change. Your photo and the logo of an organization are served at a random address, which anyone who knows it can open.
- Where it comes from. You give it to us. When somebody invites you to a team, or hands an organization over to you, that person gives us your email first, and the invitation email tells you who it was.
- Purpose. To give you access, to manage the teams and the permissions, to protect the accounts from access without permission, and to show who made each change of access.
- Legal basis. The performance of the contract with your organization, and our legitimate interest in providing the service that your organization contracted in a secure way (article 6.1.b and 6.1.f of the GDPR). You cannot have an account without an email.
- How long. For as long as your account exists. A session ends after 12 hours without use and after 30 days at most. An invitation expires after 7 days. A request for a code by email is deleted one hour after it expires. We keep the history of sessions and of invitations for as long as the account or the team exists. We keep the audit log for as long as the organization exists and, after that, for the time necessary to deal with possible claims.
Sign-in and the emails of the service
- Code by email. To sign in, we send you a code of 8 digits. It expires after 10 minutes and works only in the browser that asked for it. We send it only to an address that has access or an invitation.
- Google and Microsoft. They are optional, and you choose them. If you sign in with one of them, we ask for your identifier, your email (and whether it is verified) and your name, and we receive technical data of the sign-in, such as the organization of your account and when you authenticated. We keep the identifier of your account and, when we create your account, your name and your email. We keep neither your photo nor the credentials of the provider. Google and Microsoft process your sign-in under their own privacy policies.
- Emails of the service. Cloudflare sends, as our processor, the codes to sign in and to confirm your identity, the invitations, the notice that an organization is handed over to a client and the offers to link teams. The platform sends no advertising.
Security, support and technical logs
- To stop abuse, the servers limit the attempts, for example the codes by email that one email address or one IP address can ask for. These counters stay in memory for some minutes and are not stored.
- The servers write a technical log line when they refuse a request or when a process fails. That line can hold an email, an IP address, the identifier of a person or the public address of an account of the organization. We keep these logs in our own systems for 30 days, to investigate errors and incidents.
- If your organization gives access to our support team, that access lasts the period that the organization chooses (24, 72 or 168 hours), and the application records each request that the support team makes.
To find and fix failures, the application of each organization sends error reports to Sentry, as our processor. Before a report leaves, we remove the content of the requests, the cookies, the credentials, the parameters of the addresses and the data of the person. A report carries the error, the page (by its name, not by its address), the organization, the access level, the language and the browser, and it can hold the public address of an account of the organization when the error is about it. Sentry receives the IP address from which the browser sends a report. Legal basis of this section: our legitimate interest in the security of the platform and of the data of the clients, and in a service that works without errors.
Analytics on the website
The website measures its visits with Matomo, which runs on our own servers in the European Union. On the website Matomo sets no cookie and uses no browser storage. Your browser sends the measurement directly to Matomo, and Matomo counts each page view without linking your visits to each other. The measurement carries the address and the title of the page, the page that sent you, your IP address (Matomo keeps it shortened) and the technical data of your browser (browser, system, language and screen size). It carries no name, no email and nothing that you type in the forms. Matomo keeps the data on our servers for 25 months at most. Legal basis: our legitimate interest in knowing how the website is used and in improving it. You can object: write to us at the address of this policy. Some browsers and blockers stop this measurement, and then nothing is counted.
When we switch it on, Google Analytics measures the website only if you accept. A banner asks for your choice, with Accept and Reject. Google Analytics does not load and receives nothing until you accept: no request goes to Google before that, and a Reject or no choice keeps it that way. If you accept, it sets the cookies _ga and _ga_<id> in your browser and receives the address and the title of each page, your IP address and the technical data of your browser. We use it with Google signals and advertising off. Google Analytics keeps the data for 14 months and can process it in the United States. Legal basis: your consent. Your browser keeps your choice in local storage, under conta.landing.analytics, with the value accepted or rejected and no end date. You can change it at any time in Privacy choices, in the footer of the website. If you reject after you accepted, we delete the cookies of Google Analytics from your browser.
Product analytics in the application and on the accounts platform
We measure how people use the application of each organization and the accounts platform, to find problems and to decide what to improve. We use Matomo, which runs on our own servers in the European Union, and, only if you accept, Google Analytics. The measurement never sends the content of your records: no account address, transaction hash, amount, name that a person typed, message to ContaGPT or file name. A page is sent by its name (for example, https://app.conta.finance/t/transactions), never by its real address, and counts are sent in ranges.
- With no choice, or if you reject. Matomo counts the visits and the use of the features anonymously, with no cookie and without linking your visits to each other. Legal basis: our legitimate interest in improving the product. You can object: turn off Anonymous statistics.
- If you accept. Matomo sets cookies in your browser, links your visits to a pseudonymous code and measures the time on each page. Our server calculates that code from your identifier with a secret key: it is not your name or your email. When it is set up, Google Analytics also loads. It receives the same pseudonymous code, a pseudonymous code of the organization, your access level, your language and some settings of the organization (reporting currency, cost basis method, number format and whether the team is the owner). Google Analytics does not load and receives nothing until you accept, and we use it with Google signals and advertising off. Legal basis: your consent.
- Signals of your browser. If your browser sends Global Privacy Control or Do Not Track and you have not chosen, we treat the signal as a Reject: Matomo counts anonymously, and Google Analytics does not load. A choice that you make wins over the signal. If you turn off Anonymous statistics, we measure nothing.
Your choice belongs to your account: it applies in every organization and on every device where you sign in. If you choose before you sign in, your browser keeps the choice, and we save it to your account when you sign in, unless your account already has one. The choice lasts 13 months, and then we ask you again. We keep a record of each change of your choice (the day and the time, the value before and after, the app where you made it and the version of the text that you saw), because the law asks us to be able to prove your consent (article 7.1 of the GDPR). We keep that record for as long as your account exists and, after that, for the time necessary to deal with possible claims. You can change your choice at any time: in your profile on the accounts platform (the Privacy section), or in Privacy choices, in the menu of your photo. If you withdraw your consent, we delete the analytics cookies from your browser.
Depending on the configuration, your browser sends the measurement directly to Matomo, or to the address of the application or of the accounts platform, and our server forwards it to Matomo with your IP address. Matomo keeps the data on our servers, with the IP address shortened, for 25 months at most. Like any web request, a request to Google carries your IP address and the technical data of your browser, and it can show the name of the server of your organization (for example, company.conta.finance). Google Analytics keeps the data for 14 months and can process it in the United States.
ContaGPT
ContaGPT is the assistant of the application. It is optional: each person decides whether to use it and what to ask, and accepts a notice before the first question. We keep that acceptance with its version and its date. When you ask, your questions, the earlier messages of the same conversation, the data that ContaGPT reads to answer (for example balances, transactions, addresses, names of contacts or comments) and some settings of the organization (such as its reporting currency and its categories) go to Anthropic, which provides the language model as our processor. We do not send your name, your email or the name of your organization. Anthropic does not use this data to train its models and deletes it within 30 days, except content that its safety systems flag, which it can keep for longer. See the privacy policy of Anthropic.
Your conversations are stored in the database of your organization, and only you can read them. They stay until you delete them. When you delete a conversation, what ContaGPT read for it is deleted too. If you do not use ContaGPT, nothing is sent. Legal basis: the provision of the service that your organization contracted, which you use when you ask for it.
AI clients (MCP)
A person with full access can let the users of the organization connect their own AI client (for example, Claude or ChatGPT) through MCP. It is off by default. To connect a client, you authorize it on the accounts platform. The client receives a token with your email, your name, your photo, your team, your organization and your access level, and it reads the data that it asks for, for example accounts and their addresses, contacts, transactions with their comments, rules or the cost basis. It can prepare changes, which run only if you confirm them in Conta Finance.
You choose the provider of that AI client, not us. It processes the data under its own terms and it is not our processor. We keep the connection (client, permissions and dates) and a record of each query of the client (tool, parameters and a summary of the result), which we delete after 90 days. A connection lasts 90 days at most, and it ends sooner if nobody uses it for 30 days. You can disconnect it in your profile, under Security. Legal basis: the provision of the service, at your request.
The integrations that your organization connects
- Exchanges (KuCoin, Kraken, Bit2Me, Bitvavo and Binance). The organization gives us a key of its account, which we keep encrypted. Our servers read the history and the balances of that account with it, and they send the key only to its own exchange. What comes back can include data of third parties, such as the bank account or the beneficiary of a withdrawal.
- ERP (QuickBooks Online of Intuit, and Holded). When the organization synchronizes, we send journal entries with dates, amounts, ledger accounts, the names of accounts and contacts, the hash of the transaction and, if the organization turns it on, the newest note of the team. We keep the credentials of the ERP encrypted. With QuickBooks, each person connects their own Intuit user, and their browser goes through the page of Intuit.
- Imported files. We keep the rows that a file holds, not the file.
The organization chooses these services. They process the data under their own terms with the organization, and they are not our processors.
Blockchain data, positions and prices
To build the records, our servers ask for public blockchain data about the addresses of the organization: the addresses that it follows, an address that a person pastes when they add an account, and, once a day, the same EVM addresses on the other EVM blockchains, to report activity that the organization does not follow. These providers receive the public address (or a value made from it), the hashes of transactions and the IP address of our servers, never your name, your email or other data of a person:
- history and balances: Etherscan, Alchemy, Mintscan (Cosmostation), Trillium, Aptos Labs, FastNEAR, the NEAR Foundation, the Sui Foundation, public Solana nodes, public Electrum servers of Bitcoin, the Cosmos nodes of Polkachu and Archway, and nodes that Stakely runs;
- DeFi positions: DeBank, Jupiter and Rhea Finance.
We ask for prices, exchange rates and the public data of tokens and blockchains (DefiLlama, CoinGecko, Frankfurter and public chain registries) by token, by blockchain or by date, with no address of an account. Some of these providers are outside the European Economic Area. Legal basis: the provision of the service that the organization contracted.
Some images of the application load from servers of third parties: the logos of DeFi protocols (DeBank or Jupiter gives them), and the logo of a blockchain when the organization takes it from CoinGecko, from the Cosmos registry or from another address. Those servers receive your IP address and the name of the server of your organization.
Social networks
We have profiles on LinkedIn and X. If you interact with them, those networks process your data under their own policies. We use what you send us there only to answer you.
Cookies and browser storage
The website and the help center set no cookies of their own, and the Matomo measurement of the website sets none. The cookies and the browser storage that the service needs to work do not need your consent (article 22.2 of the Spanish LSSI). The analytics cookies do: they are set only if you accept.
| Name | Where | Purpose | Duration |
|---|---|---|---|
__Host-conta_session | Accounts platform | Keep your session open | 30 days at most; it ends after 12 hours without use |
__Host-conta_email_code | Accounts platform | Bind the code by email to the browser that asked for it | 10 minutes |
__Host-conta_provider_flow | Accounts platform | Complete a sign-in with Google or Microsoft | 10 minutes |
__Host-conta_org | Application of your organization | Give you access to your organization | 30 minutes, renewed while you use it |
conta.analytics.consent | Application and accounts platform (local storage) | Remember the analytics choice that you make before you sign in | 13 months, or until you sign in: then we save it to your account |
conta.analytics.person.<id> | Application and accounts platform (local storage) | Keep a copy of the analytics choice of your account | Until you sign out |
conta.analytics.subject | Application and accounts platform (local storage) | Remember the pseudonymous code of the last person who used this browser, to delete the analytics cookies of that person when another one signs in | No end date; it changes when another person signs in |
conta.analytics.matomo | Application and accounts platform (local storage) | Remember that you turned off Anonymous statistics | No end date, until you turn them on again |
conta.landing.analytics | Website (local storage) | Remember whether you accepted or rejected Google Analytics | No end date, until you change it |
| Preferences and drafts | Application and accounts platform (local and session storage) | Remember the view of a table and your last team, and pass a question to ContaGPT | Until you delete them; a question, 60 seconds |
conta-help:conversations | Help center (local storage) | Keep your conversations with Ask ContaGPT | Until you delete them |
| Name | Who sets it | Purpose | Duration |
|---|---|---|---|
_pk_id | Conta Finance (Matomo) | Tell the visits of the same browser apart | 13 months |
_pk_ses | Conta Finance (Matomo) | Join the pages of one visit | 30 minutes |
_pk_ref | Conta Finance (Matomo) | Remember where a visit came from, when Matomo sets it | 6 months |
_ga, _ga_<id> | Google Analytics | Tell the visits of the same browser apart | 13 months |
conta.analytics.first | Conta Finance (local storage) | Know when you did something for the first time, for example your first rule | Until you withdraw your consent |
Cloudflare can set a technical cookie on our websites to protect them from automated traffic (for example __cf_bm, for 30 minutes). You can also delete cookies and browser storage in the settings of your browser.
Providers that process data for us
These providers act as our processors, under a contract that obliges them to use the data only for the service that they give us:
| Provider | What for | Where | Safeguard |
|---|---|---|---|
| DigitalOcean, LLC (United States) | Servers, databases and encrypted copies of the platform | European Union | EU-US Data Privacy Framework and standard contractual clauses |
| Cloudflare, Inc. (United States) | DNS, delivery and security of the websites; sending and forwarding of emails | Worldwide network | EU-US Data Privacy Framework and standard contractual clauses |
| Microsoft Ireland Operations Limited (Ireland) | The mailbox of the team (Outlook), where the contact emails arrive | European Union | EU-US Data Privacy Framework and standard contractual clauses |
| Anthropic, PBC (United States) | Language model of ContaGPT and of Ask ContaGPT | United States | Standard contractual clauses |
| Google Ireland Limited and Google LLC | Google Analytics, only if you accept | United States and other countries | EU-US Data Privacy Framework |
| Functional Software, Inc., Sentry (United States) | Error reports | European Union (Germany) | EU-US Data Privacy Framework and standard contractual clauses |
Other recipients act on their own account, under their own terms: Google and Microsoft when you sign in with them; the exchanges, the ERPs and the AI clients that the organization or a person connects; the blockchain data, positions and price providers of this policy; and the public authorities, when the law requires it.
International transfers
The platform is hosted in the European Union. Some providers are in the United States, or process data outside the European Economic Area. In those cases the transfer has a safeguard of the GDPR: the EU-US Data Privacy Framework when the provider takes part in it, or the standard contractual clauses of the European Commission. You can ask us for a copy of these safeguards.
How long we keep the data
Each section above gives its period. When we no longer need a piece of data, we delete it. When the law requires us to keep it (for example, to deal with claims or with requests of an authority), we block it for that period and use it for nothing else.
Security
Each organization has its own database and its own application server. The databases are encrypted at rest, and the connections are encrypted (HTTPS). We also encrypt with AES-256-GCM the exchange keys, the credentials of the ERP, the secrets of two-step verification, and the copies of the state and of the closed reports. Sessions, tokens and recovery codes are kept as hashes. Access is by invitation, each team can require two-step verification, and our support team enters an organization only if the organization lets it, for a limited period, with a record of each request and with no access to the credentials of exchanges or of the ERP.
Your rights
You can ask us for access to your data, its rectification or its erasure, the restriction of its processing and its portability. You can object to the processing, and you can withdraw your consent at any time, with no effect on the processing before that.
- You change your name, your photo and your language yourself, in your profile. You see and close your sessions and your connected AI clients under Security.
- You change the analytics in Privacy choices.
- To delete your account, or for any other request, write to [email protected] from the email of your account. If you are the only owner of a team, transfer the ownership first. We can ask you to confirm your identity. We answer within one month.
- For the data in the records of an organization, ask that organization.
We make no automated decision that has legal effects on you, and no profile for that purpose. If you believe that we have not handled your request properly, you can file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).
Minors
Our services are for companies and professionals. They are not for minors, and we do not knowingly process their data.
Changes to this policy
If we change this policy, we publish the new version on this page with its date. If the change is important, we tell you on the platform or by email. When what we ask you to accept changes, we ask you again.