LedgerLink Privacy Notice

Effective date: 19 October 2026

LedgerLink is an AI assistant for business users of Moneybird. This notice explains which personal data we process, for what purposes, with whom data are shared and which rights data subjects have. It applies to ledgerlink.nl, app.ledgerlink.nl and the associated services.

1. Who is responsible?

VoltStation B.V., trading as LedgerLink, Straatweg 29, 8535 WG Follega, the Netherlands, Netherlands Chamber of Commerce number 97250325, VAT number NL867969684B01. For privacy questions and requests: support@ledgerlink.nl.

For registration, account management, security, payments, its own customer relationships and support, VoltStation B.V. generally determines the purposes and means of processing and acts as the controller. For personal data that a business customer instructs LedgerLink to retrieve, analyse or modify from its Moneybird administration, LedgerLink generally acts as a processor on the customer's behalf. The customer is generally the controller for that purpose; where the customer acts on behalf of another controller, the roles within that chain may differ. The Data Processing Agreement (https://ledgerlink.nl/dpa) governs processing on instructions.

2. What data do we process?

Depending on your use of the service, we process the following data:

• Identity and security: account identifiers, (verified) email address, profile name or profile photograph, session information, sign-in security and information about the use of additional authentication factors. Some of these data are managed by our identity provider.
• Collaboration and connections: user and workspace identifiers, roles and access permissions, Moneybird administration name and identifier, granted API permissions and encrypted access tokens.
• Questions and answers: messages, AI responses, conversation titles, relevant conversation history, accounting data retrieved by the service, proposed changes, approvals, execution results and private feedback.
• Financial and accounting-related personal data: for example, customer and supplier names, invoice and transaction details, descriptions and contact information insofar as they appear in a connected administration or your instructions. Information about employees and other natural persons may also be included.
• Subscriptions: Stripe customer and subscription references, payment status, subscription periods, usage meter values and information required for invoicing or tax purposes. Full payment card details are processed by Stripe, not stored as ordinary LedgerLink accounting data.
• Support, notices and security: information you send by email or through an available support feature, delivery status of service messages, timestamps, technical identifiers and security or error categories. Ordinary private feedback within a conversation is not automatically shared with support staff.
• Website and connection data: IP addresses, browser and request data, and necessary session or security information that may be processed by the website, application or their service providers.

The precise data depend on which features are enabled. A feature that has been developed but remains disabled does not automatically process all the data described above.

3. For what purposes and on what legal bases?

Where VoltStation B.V. acts as controller, the following purposes and legal bases apply as appropriate:

For processing based on legitimate interests, we assess necessity and balance those interests against the rights and interests of data subjects. A contract with a company does not automatically provide a legal basis for processing the personal data of that company's employees, customers or suppliers. For accounting data that we process solely on instructions, the customer determines the applicable legal basis, and we use those data only in accordance with the instructions and the Data Processing Agreement (https://ledgerlink.nl/dpa).

We do not base ordinary use of LedgerLink on consent supposedly given by accepting the Terms and Conditions. We request separate consent for non-essential cookies or similar technologies where the law requires it.

4. AI and Moneybird

When the AI assistant is enabled, the current question and relevant, limited information from the connected Moneybird administration may be submitted to a selected model through Amazon Bedrock. Depending on the privacy controls enabled, limited conversation context, model instructions and technical results may also be processed. The intended model route uses an EU inference profile; this does not mean that all ancillary processing or provider access necessarily takes place within the European Economic Area (EEA).

Personal data may occur in descriptions or free text submitted for model processing. The additional safeguards under preparation include task-specific pseudonyms and detection of certain identifying information, with checks before transmission; these techniques do not constitute full anonymisation and do not recognise every possible item of personal data. Processing real customer data with the AI model therefore requires a separate privacy and security assessment and appropriate activation. We do not guarantee that all inputs are anonymous or that the model provider never retains data.

The AI can propose a change but cannot independently approve or execute it. A change requires separate approval validated by the server. An approved set contains no more than ten sequential operations; partly executed changes are not automatically reversed.

When the public-source feature is enabled, LedgerLink makes limited requests to official websites based on controlled public search topics. Private questions and Moneybird content are not sent to those sites as unprocessed search queries; the visited website may nevertheless receive technical request data.

We do not use customer accounting data to train our own AI model or for advertising. The specific provider terms, potential retention, regions, logging and transfer mechanisms are assessed separately before production use.

5. Who receives data?

We use providers for infrastructure, databases, identity management, payments, messaging and support. The parties that process particular data and their respective roles are listed in Sub-processors and Other Recipients (https://ledgerlink.nl/sub-processors).

Depending on the feature, providers include AWS, Neon, Clerk, Vercel, Stripe, Cloudflare, Google and Brevo. Moneybird is the accounting provider selected by the customer; LedgerLink accesses that administration under the customer's authorisation. Service providers may, in addition to acting as processors, act as independent controllers for certain activities, for example where payment or fraud-prevention legislation applies.

Some providers may process personal data outside the European Economic Area (EEA) or make it accessible from outside the EEA. Transfers subject to Chapter V of the GDPR require a valid transfer mechanism, such as an adequacy decision or appropriate standard contractual clauses, together with supplementary safeguards where necessary. You may ask us about the safeguards applicable to your processing at support@ledgerlink.nl. We do not promise that all ancillary processing remains within the EEA.

6. How long do we retain data?

We apply retention periods according to purpose. Below, we distinguish the current technical operation from approved policy objectives that have not yet been activated. A policy objective is not a statement that data are already retained in accordance with that objective. Restrictions, outstanding obligations and statutory exceptions are assessed by data category.

• Conversations, AI responses, titles, task steps and private feedback. Under the current implementation, generally twelve calendar months after the last message. A new message extends that period. Earlier deletion or disconnection may cause earlier erasure, subject to a necessary security hold.
• Accounts and Moneybird connections. For the duration of active use; on deletion or disconnection, the relevant access is revoked and the applicable erasure process follows.
• Evidence of approved changes. Planned, not active: for up to twelve calendar months after account deletion, a separate encrypted evidence record may be retained containing the identity or necessary identifier of the approving User, timestamps, Proposal identifier and digest, the exact Proposal displayed and approved insofar as strictly necessary, and execution results. This does not authorise the retention of entire conversations, administrations or all Moneybird data retrieved. This arrangement will be introduced only after the legal basis, VoltStation's role, necessity, balancing of interests, security and compatibility with the Data Processing Agreement have been established for each data category. Current position: evidence is generally deleted with its source; unresolved outcomes or security holds may require separate handling.
• Contract acceptance records. Planned, not active: only data necessary to identify the contracting party, accepted document versions, timestamps and acceptance, for a maximum of five years after termination of the agreement, provided the legal basis and necessity have been established. This is not a general statutory five-year retention duty. A specific dispute or legal obligation may separately justify further retention.
• Support correspondence. Planned, not yet technically implemented: a request will automatically be considered closed thirty days after the last correspondence, unless it is demonstrably still being handled or relates to an open incident or dispute. Correspondence and necessary attachments will be deleted no later than twelve months after closure, unless a specific other legal basis requires further retention. Correspondence about the same matter received during that retention period reopens the request and restarts the closure clock. Unnecessary attachments will be deleted earlier. The rule must apply to both the internal support feature and the external Gmail mailbox and relevant sending records held by Brevo; fully automatic application has not yet been demonstrated.
• Usage meters and subscriptions. Daily and calendar-month counters have their own cleanup rules; under the current implementation, some paid-period information has no separate expiry beyond account deletion. Outstanding cancellation or payment corrections are not erased while doing so would prevent proper settlement.
• Our own invoices and tax records. Retained in accordance with statutory tax record-keeping obligations; for ordinary invoices generally seven years, subject to statutory exceptions. These are VoltStation B.V.'s own records, not a right to retain a customer's entire Moneybird administration.
• Security records. Standard application logs are generally kept for thirty days and security audit records generally for ninety days; specific incidents, uncertain transactions and provider records may be subject to other justified periods.
• Backups. The recorded recovery history for the core database currently covers seven days. Other provider copies may differ. Following restoration, previous deletion instructions must be re-enforced before the relevant data are made available again.

We do not create a general long-term copy of entire Moneybird administrations. The original administration remains with Moneybird, under the customer's responsibility and the applicable relationship with that accounting provider. A general document library and active chat file uploads are not part of the initial beta.

7. Account deletion and disconnection

When an account is deleted, access to LedgerLink ends immediately and erasure of active service data is initiated. A paid subscription is subject to a separate, durable instruction for immediate termination; temporary unavailability of Stripe may delay technical completion. Incorrect charges are investigated and corrected where required.

The original data and previously approved changes in Moneybird are not deleted as a result. VoltStation's own records that must be retained by law, specific outstanding obligations and limited recovery copies may lawfully remain for longer. An email confirmation of identity deletion, if enabled, does not automatically confirm completion of every provider or payment settlement step.

The planned separate retention of approval evidence and contract acceptance records described in section 6 has not yet been technically activated. Implementation requires prior assessment of the legal basis, necessity, retention periods, data minimisation and the allocation of responsibilities under the GDPR. The customer's statutory instructions and erasure rights concerning data processed on its behalf continue to apply.

8. Your rights

For data for which VoltStation B.V. is the controller, you may request access, rectification, erasure, restriction, portability (where applicable) or object to processing based on legitimate interests. Send your request to support@ledgerlink.nl. We may take appropriate steps to verify your identity before disclosing or amending data. We generally respond within one month and will notify you in time of any extension permitted by law.

If your request concerns information in another company's Moneybird administration, please contact that company as the controller in the first instance; we assist it in facilitating rights under the GDPR.

You may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via https://autoriteitpersoonsgegevens.nl. The service is not intended to make decisions about individuals without meaningful human review where those decisions are based solely on automated processing and produce legal or similarly significant effects.

9. Security and cookies

LedgerLink applies appropriate organisational and technical measures, including separation between Users and administrations, access controls, transport security and encryption of sensitive tokens and certain content fields. Not all technical metadata are encrypted in the same way. Actual security depends on the enabled release and provider configurations.

The website and app may use functional cookies or similar technologies for sessions, security and preferences. Where the law does not require consent, we nevertheless provide information about their use. Non-essential tracking or analytics for which consent is required will not be deployed without valid prior consent. The scripts, cookies and providers actually used must be rechecked when changes are made.

10. Changes and contact

We may amend this notice when processing activities or applicable law change. Material changes will be communicated in an appropriate manner. Where a new version must be acknowledged again to continue using the service, this will be requested in the application. Such acknowledgment does not replace consent that may separately be required.