The short version
Invoice data, contract data, and vendor records — because that's what we need to find billing drift. Your account info (name, email, company) to run your account. Usage logs for security and debugging.
We don't collect payment details. We don't collect personal data about your employees unless they're directly linked to a billed seat. We don't track you across other websites.
We use it to find supplier billing discrepancies and generate findings for your review. We don't sell it. We don't use it to train AI models. We don't share it with third parties except our infrastructure providers (listed below), who are all GDPR-compliant EU-hosted services.
Until you ask us to delete it, or until 90 days after your subscription ends — whichever comes first. Some billing records we're legally required to keep for 7 years (Finnish accounting law), but those don't contain your supplier data.
GCP Hamina, Finland (europe-north1). No data leaves the EU. No transfers to the US or any non-EU country. Standard Contractual Clauses in place with all sub-processors.
You can access, correct, export, or delete your data at any time. Email privacy@sopisafe.com. We respond within 30 days. If you're unhappy with how we've handled something, you can complain to the Finnish DPA.
Six things you can ask us to do
You can ask for a copy of all personal data we hold about you. We'll send it within 30 days in a readable format.
If something we hold is wrong, you can ask us to correct it. We'll act within 30 days.
You can ask us to delete your personal data. We'll do it within 30 days. Some data we're legally required to keep for a period (billing records, for instance) — we'll tell you what those are.
You can ask for your data in a machine-readable format (JSON or CSV) so you can move it to another service.
You can object to us processing your data in certain ways, particularly for marketing. If you object, we stop.
If you think we've mishandled your data, you can complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or the data protection authority in your EU country of residence.
To exercise any of these rights, email privacy@sopisafe.com. We respond within 30 days. No fee. No friction.
Two types. No advertising
Keep you logged in while you're using the platform. These are deleted when you close your browser. You can't use the platform without them.
Remember your preferences (display settings, language, last-viewed section). These persist across sessions. Also required for the platform to work properly.
We use Plausible Analytics on the marketing site (sopisafe.com). It doesn't use cookies and doesn't track you across sites. It counts page views in aggregate, nothing personal.
We don't use these. No retargeting pixels, no Meta or Google tracking scripts, no cross-site cookie syncing. If you've come here from an ad, that ad platform stopped seeing you when you clicked.