Privacy policy

Syllevo is operated by Businice S.R.L., a Romanian limited liability company, tax identification number (CUI) 47561697, Trade Registry number J40/1905/2023, VAT number RO47561697, registered office at Str. Fetești nr. 52, tronson 3, parter, camera 2, ap. 3, sector 3, București, România. In this policy, "we" and "us" mean Businice S.R.L..

For anything about personal data, write to legal@syllevo.com. For security reports, write to security@syllevo.com. A person reads both mailboxes.

We have not appointed a data protection officer. Our core activity is processing accounting documents on behalf of customers at a scale that does not require one under Article 37 GDPR; we review that assessment yearly and will name one here if it changes. Until then, the legal@syllevo.com mailbox is where data protection questions go, and it is answered by the people who run the service.

Data protection law separates the party that decides why and how personal data is processed (the controller) from the party that processes it on that party's instructions (the processor). Syllevo is both, for different data, and it matters which is which.

We are the controller for data about you as our customer: your account, the people you invite, billing, support conversations, the audit trail of what your users did, security logs, and visits to syllevo.com. We are also the controller for data about the people in our referral program, including their payout details. We decide why that data is processed, and this policy is our notice to you under Articles 13 and 14 GDPR.

We are the processor for everything inside your profiles: the documents that arrive, the fields read from them, the supplier records, the invoices a business issued and the buyers named on them, what we send to SPV for a business and ANAF's answers, the addresses you ask us to email invoices to, the client contacts you enter, the reminders sent, and the replies captured. You (or your client) decide what goes in and why; we process it only to run the service for you, under the data processing section of our terms, and we act on your instructions. Requests from people whose data appears in those documents go to you, and we help you answer them.

When an accounting firm connects its clients, the firm is normally a processor for those clients, who are the controllers of their own accounting records. Syllevo then acts as the firm's sub-processor. The firm confirms in our terms that it holds the mandate to bring its clients' data into Syllevo, and, before it sends a client's invoices to SPV or emails them to buyers, that the client authorized it to. The firm's engagement with each client is where that client learns about it.

Our data processing agreement under Article 28 GDPR is a section of our terms, "Processing personal data for you", and every organization accepts it with the terms; there is nothing separate to sign. It covers your instructions, confidentiality, our security measures, sub-processors, help with requests and breaches, audits, and what happens at the end of the contract. Where it conflicts with this policy about processor matters, the terms win.

If you are a client of an accounting firm that uses Syllevo and you have a question about your data, ask your firm first: they can see, correct, export, or delete it. If they cannot help, or if you believe we are processing your data outside their instructions, write to legal@syllevo.com and we will look into it directly.

People who receive reminders (your clients' staff), people who receive an invoice you asked us to email, people whose names appear on invoices (suppliers, buyers, their employees, sole traders), and people who send email to an ingestion address are not our customers. We process their data as your processor, on your instructions. Telling them, where the law requires it, is your responsibility as controller or as the firm acting for the controller; this policy is public so you can point them to it.

Here is every category, where it comes from, and why we have it.

• Account data: your name, email address, the organization you belong to, your role, the profiles you can see, your language and time zone, an avatar if you upload one, and the identity provider you used to sign in. It comes from you or from the person who invited you. We use it to sign you in, show you the right data, and send you the emails the service needs to send (invitations, digests, alerts). Legal basis: performance of our contract with your organization; for our security logging of sign-ins, our legitimate interest in keeping the service safe.
• Billing data: your organization's legal name, tax number, billing address, VAT number, the package you chose, invoices, payment status, and refund requests. Card and bank details are entered on Stripe's pages and stored by Stripe; we hold only a reference to them. We use billing data to charge you, issue invoices, calculate VAT, and keep the records tax law requires. Legal basis: contract, and our legal obligation to keep accounting records.
• Documents: the original files that arrive through your sources (PDF, XML, images, email attachments), the fields we read from them (supplier, invoice number, dates, amounts, VAT, currency, bank account), the confidence of each reading, and the review decisions your users make. Invoices contain the names, addresses, tax numbers, and sometimes bank accounts and signatures of suppliers and of individuals. We process them only to collect, file, show, and export them for you. Legal basis: your instructions as controller; we are the processor.
• Ingestion data: for every email that reaches an ingestion address, the sender, recipient, subject, date, message headers, authentication results (SPF, DKIM, DMARC), and the body. We keep the original message with the documents it delivered, so we can always answer "where did this document come from". When a supplier emails a link to its invoice instead of attaching it, and we recognize the provider behind the link (today, invoices hosted by Stripe), we download the invoice from that link, but only when the email passed DMARC. Emails that carry nothing we can file are held in a quarantine you can inspect, then deleted. Legal basis: your instructions as controller.
• Reminder data: the contacts you enter for each client (name, email, role, language), the reminders sent to them, delivery outcomes, their replies including attachments, the tokens behind upload links, and uploads made through those links. Escalation contacts, if you set them, receive a note that documents are late, never the list of documents. Legal basis: your instructions as controller; you are responsible for having a lawful basis to contact the people you enter.
• e-Factura data: the authorization you grant us in ANAF's SPV (an access token and refresh token, encrypted), the tax identification numbers of the companies you enrolled, the message list ANAF returns for each of them, the invoices downloaded from SPV, and the list of invoices each company sent through SPV together with the XML of each, which we file as that company's issued invoices. We also look up tax numbers in ANAF's public registry to check whether a company is enrolled in e-Factura and registered for VAT, and EU VAT numbers in the European Commission's VIES service to confirm a foreign supplier exists. Legal basis: your instructions as controller; the registry lookups also serve our legitimate interest in filing documents to the right company.
• Issued invoices: the invoices a business issued, as the XML and PDF it imported or as we found them on its list of sent invoices in SPV, and what we read from them: the buyer's name, tax identification number, and country, and the invoice's number, dates, and amounts. When the buyer is a person, the tax identification number can be their personal numeric code (CNP). We store them to show, export, and, when you ask, send them. Legal basis: your instructions as controller.
• Sending to SPV: whether sending is on for each business, and who turned it on or off and when. For every invoice we were asked to send, we record who asked, a fingerprint of the exact file we sent, the upload number ANAF gave it, ANAF's answer, and the signed archive ANAF returns. Legal basis: your instructions as controller.
• Invoices emailed to buyers: the email addresses you ask us to send an invoice to, who asked, when it went out, and whether delivery failed. We keep the addresses with the invoice as a record of what was sent, and we never use them for anything else. Legal basis: your instructions as controller.
• Supplier portal data: the access keys or authorizations a supported supplier portal issued you (the portals are listed on the sources page), encrypted with a key we hold, the invoices fetched with them, and a log of every fetch. We use them only to fetch the profile's own invoices. Legal basis: your instructions as controller.
• Google Drive copies: if your organization connects Google Drive, we write a copy of each invoice into the folder you picked in your own Google account, named the way you chose. We see only that folder and the files we put there, never the rest of your Drive. When you pick the folder, Google's own folder picker opens in your browser and loads from Google. The copies are yours: Google holds them under your own agreement with Google, not as our sub-processor, and we never delete them. When you trash an invoice here you choose what happens to its copy, and invoices we remove under your retention settings stay in Drive. Legal basis: your instructions as controller.
• Manual uploads: files a user drags into the app, with who uploaded them and when. Same treatment as any other document.
• Technical data: IP address, browser and device type, the pages and API endpoints called, timings, and error reports. We keep it in server logs and in our error tracking to keep the service running and to investigate abuse. Each log line records what happened in words, and some of those lines name a company's tax identification number (for a sole trader, that can be a personal numeric code), an attachment's file name, or an IP address. They never contain passwords, tokens, keys, or the contents of a document or an email. Error reports carry the log lines that led up to the error, and they are scrubbed of request bodies, cookies, and authorization headers before they leave our servers. Legal basis: our legitimate interest in security and reliability.
• Audit trail: who did what to which document, profile, or setting, and when, including the IP address and request identifier of the action. It exists so a questioned document can be traced. The IP address and request identifier are removed after twelve months by default; if your organization needs them for longer, write to us and we'll set a longer period. Legal basis: our legitimate interest and yours in accountability, and the legal requirements on accounting records.
• Support and correspondence: what you write to us, by email or through the app, and what we answer. Legal basis: contract, and our legitimate interest in keeping a record of what was agreed.
• Referral program: if you join, your name and email address from your sign-in, your referral code, the version of the terms you accepted and when, and the commissions your referrals earned you. To pay you, we also hold your legal name, country, address, tax identification number, and IBAN, whether you are paid as a person or a company, and whether you are registered for VAT. We encrypt the tax identification number and the IBAN with a key we hold and only ever show them masked. Our bank sees your name and IBAN when we pay you. For this data we are the controller. Legal basis: our contract with you for the program, and our legal obligation to keep accounting and tax records of what we paid and any tax we withheld.
• Website visits: syllevo.com runs no analytics and no advertising trackers. Our hosting provider sees the requests a browser makes to serve the page, as any web server does, and keeps short-lived access logs for security. If you followed a referral link and accepted the cookie, we record the referral code so the referrer can be credited when you subscribe. Legal basis: legitimate interest for the server logs; consent for the referral cookie.

Each processing above rests on one of these grounds under Article 6 GDPR.

• Performing our contract with your organization (Article 6(1)(b)): everything needed to give you the service you subscribed to, from signing you in to sending your invoice.
• Your instructions as controller, under the data processing section of our terms (Article 28): everything inside your profiles. Here the lawful basis is yours to hold, and we process on it.
• Our legal obligations (Article 6(1)(c)): keeping billing and accounting records under Romanian accounting and tax law, answering lawful requests from authorities, and keeping the security measures data protection law requires.
• Our legitimate interests (Article 6(1)(f)): keeping the service secure and reliable, preventing abuse, tracing actions in the audit trail, improving the product from aggregate use, and defending legal claims. We have weighed each against your interests and do not rely on this ground where you would not reasonably expect the processing.
• Your consent (Article 6(1)(a)): only for the referral cookie on syllevo.com. You can withdraw it from the footer link at any time, and declining it changes nothing about how the site works.

We use few cookies, and none for advertising or analytics. Under Romanian Law 506/2004 and the ePrivacy rules, cookies that are strictly necessary need no consent; the one that is not, we ask about.

• syllevo_cookie_consent on syllevo.com remembers whether you accepted or declined the optional cookie, so we do not ask again. It holds one word, lasts 180 days, and is strictly necessary because without it the choice bar would reappear on every page.
• syllevo_ref on syllevo.com and its subdomains records the referral code from a link you followed, so the person who referred you can be credited if you subscribe. It is set only if you accept it in the cookie bar, lasts 60 days, and the first code you arrived with stays; a later link does not overwrite it. Declining deletes it. You can change your mind from the "Cookie choices" link in the footer.
• A language cookie on both sites remembers whether you chose English or Romanian. It lasts for the browser session and is strictly necessary for showing you the language you picked.
• Session cookies on app.syllevo.com, set by our authentication provider WorkOS, keep you signed in. wos-session holds your encrypted session. Your browser keeps it for up to 400 days, or until you sign out, which deletes it. Keeping the cookie doesn't keep you signed in forever: WorkOS ends the session on its own schedule, and then you sign in again. wos-auth-verifier protects the sign-in step and lasts ten minutes. Both are strictly necessary.
• The app also keeps a few things in your browser's local storage rather than in cookies: your light or dark theme, which organization and client you last had open (their ids and names), your filters, your column and panel layout, and your user id. The user id is there so that when somebody else signs in on the same browser, the app first clears what you had open. While you sign in to e-Factura or a supplier, the tab also remembers, in session storage, to bring you back to setup afterwards. The app reads all of this to put you back where you were. None of it is used to track you, and signing out clears the parts that say what you had open.
• There is no analytics script, no advertising pixel, no social media widget, no session recording, and no fingerprinting on syllevo.com or app.syllevo.com. If we ever add a measurement tool, it will be one that runs without cookies or we will ask first, and this section will say so before it goes live.

Documents, database, backups, and the servers that run the service are in the European Union. Files are stored in Cloudflare R2 with the EU jurisdiction setting, which keeps the objects on EU infrastructure. The application servers are operated by us on infrastructure rented from OVH SAS in data centers in France and Germany. The web front ends run on Vercel in its Frankfurt region.

Some of our providers are US companies with EU infrastructure. Where a provider processes personal data in the EU but its parent company is in the United States, US authorities could in theory compel access. We reduce that by choosing EU regions, encrypting secrets and credentials with keys we hold, and sending providers only what they need. The table of sub-processors below says, for each, where the data is and what the transfer mechanism is.

Where personal data does leave the EU, we rely on the transfer tools in Chapter V GDPR: the EU-US Data Privacy Framework for providers certified under it, and the European Commission's standard contractual clauses (Decision 2021/914) with a transfer impact assessment for the rest. You can ask for a copy of the clauses at legal@syllevo.com. We do not transfer your documents outside the EU for extraction; the models we use run in Google Cloud's EU multi-region.

These are the companies we use to run Syllevo and what each one processes. We tell every organization by email at least thirty days before adding or replacing a sub-processor that will process data from your profiles; you can object under our terms, and if we cannot resolve the objection you can end the contract and export everything.

• WorkOS, Inc. (United States): authentication. Sees your name, email address, sign-in method, session, and organization membership. Data is processed in the United States under the EU-US Data Privacy Framework, with standard contractual clauses as the fallback. It does not see documents.
• Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (United States): payments, invoicing, and VAT calculation. Sees billing details, payment method, invoices, and refund status. Stripe is an independent controller for the payment data it needs for its own legal obligations, and transfers within the Stripe group rely on the Data Privacy Framework and standard contractual clauses. It does not see documents.
• Cloudflare, Inc. (United States): file storage (R2, EU jurisdiction), DNS, TLS termination, and the email routing that receives mail sent to syllevo.com: messages to ingestion addresses, and mail to our own addresses such as legal@ and security@, which it forwards to our mailbox. It handles incoming mail only, never the mail we send. Sees documents at rest (encrypted) and incoming email in transit. Data stays in the EU by configuration; Cloudflare is certified under the Data Privacy Framework and provides standard contractual clauses for any incidental transfer.
• Vercel, Inc. (United States): hosting for syllevo.com and the app front end, Frankfurt region. Sees request logs (IP address, path, timing) and serves the pages; it does not store documents. Transfers rely on the Data Privacy Framework and standard contractual clauses.
• Google Cloud EMEA Limited (Ireland): the machine-learning models that read documents which cannot be read from structured data or the PDF text layer. Runs in Vertex AI's EU multi-region. Receives the document content and returns the fields read. Under Google Cloud's terms, prompts and responses are not used to train models and are not retained after the request. It never receives your account or billing data.
• Functional Software, Inc. (Sentry, United States): error tracking, EU data region. Receives error reports from the app and the servers with the technical context needed to fix them. That includes the log lines that led up to each error, which can name a tax identification number or a file name. Reports are scrubbed of request bodies, cookies, and authorization headers before sending. Transfers rely on the Data Privacy Framework and standard contractual clauses.
• OVH SAS (France): rents us the servers that run the API, the background workers, the database, and the queues, in data centers in France and Germany. Has physical and network custody of encrypted disks; does not have application access.
• AC PM LLC (Postmark, United States): the email delivery service that sends the reminders, digests, invitations, and alerts we send, and the invoices you ask us to email to buyers, with the invoice attached. Sees recipient addresses and message content, and keeps its own delivery logs. It never reads documents from our storage; it only carries what we send. Transfers rely on the EU-US Data Privacy Framework, with standard contractual clauses as the fallback.
• ANAF (the Romanian tax authority) and the European Commission's VIES service are public authorities we exchange data with on your instruction or to check a tax number. That includes the invoices we send to SPV for a business when you ask. They are not our sub-processors; they process what they receive under their own legal mandate.

Nothing is kept forever, and nothing that matters is deleted quietly. The numbers below are the defaults; an organization can set several of them longer, never shorter than the legal minimum.

• Documents and their data, including the invoices a business issued and the records of sending them to SPV or emailing them to buyers: for as long as your organization is a customer, plus the export period after the subscription ends. Deleting a document moves it to the trash, where it stays recoverable for 60 days and then is purged; a document that arrives again from a source while its copy is in the trash is restored, not duplicated. An issued invoice that ANAF accepted, or that is on its way to SPV, can't be deleted, because ANAF holds it too.
• Quarantined email (messages that reached an ingestion address but carried nothing we could file, or failed authentication): 30 days, then deleted.
• Reminder replies we could not attach to a profile (for instance, a reply from an address nobody listed): 30 days, then deleted.
• e-Factura message lists fetched from ANAF, including ANAF's answers to the invoices we sent: kept with the organization's documents, because they record where each e-Factura document came from and what ANAF said about it.
• Repeat-request records: when the API is asked to import, send, or email an invoice, it keeps the answer it gave for 30 days. That way, a request repeated by mistake gets the same answer instead of doing the work twice. The answer can include a buyer's name and tax identification number, or the addresses an invoice was emailed to. After 30 days it is deleted.
• Audit trail entries: for as long as the organization exists. The IP address and request identifier on each entry are cleared after 12 months. If your organization needs them for longer, up to 10 years, write to us and we'll set it.
• Server and error logs: our servers keep a fixed amount of recent logs for each service and overwrite the oldest lines as new ones arrive, so how long a line lasts depends on how busy the service is. Error reports are kept by our error tracking provider for the retention period of our plan, then deleted.
• Database backups: rolling daily, weekly, and monthly copies, the oldest of which is 12 months old, kept encrypted in EU storage and restored on a schedule to prove they work. A deleted organization disappears from backups as they age out, which means at most 12 months after deletion.
• Billing and accounting records about your organization: 5 years from July 1 of the year after the financial year ends, as Romanian accounting law requires. Stripe keeps its own records for as long as the law that applies to it requires.
• Referral program details: while you are in the program. When an organization that created a referral link is deleted, the link is retired. We erase the IBAN once no commission on it is still owed, and keep the legal name, country, and tax identification number with the payment records for the accounting period. Records of what we paid you, including the details we paid against and any tax we withheld, stay for 5 years from July 1 of the year after the financial year ends, as Romanian accounting law requires. To leave the program and have the rest deleted, write to legal@syllevo.com.
• Cookies: 180 days for the consent choice, 60 days for the referral code, the browser session for the language cookie, up to 400 days for the sign-in cookie unless you sign out first, and ten minutes for the sign-in check. Local storage stays in your browser until you clear it; signing out clears part of it, as described above.
• When you close your organization, when the export period after your subscription ends runs out, or when an organization that never subscribed reaches twelve months since it was created, we delete documents, extracted data, contacts, reminders, tokens, and credentials, hard delete, on a schedule we email the Owner in advance. That includes the members who belong to no other organization and hold no referral link; a member who belongs to another organization, or holds one, keeps their account. We keep the billing records the law requires and a minimal record that the organization existed and was deleted: its internal id, the dates, the reason, and how many items of each kind were deleted, with no names and no content. Backups follow within 12 months. Stripe keeps its own billing records as an independent controller. The sign-in identity at our identity provider, WorkOS, is not deleted automatically; write to legal@syllevo.com to have it deleted.

Romanian accounting law (Law 82/1991) requires companies to keep accounting registers and supporting documents from 2023 on for 5 years from July 1 of the year after the financial year ends, and documents from before 2023 for 10 years. That duty sits with the company, or with the firm under its engagement, not with us. Syllevo keeps documents while you are a customer and for the export period after; export what you must keep, and treat Syllevo as where documents arrive rather than as your archive.

Syllevo reads document fields automatically and sorts documents into profiles and periods. Low-confidence readings go to a person for review before they are filed. We make no decision about any individual that produces legal effects or similarly significant effects in the sense of Article 22 GDPR: nobody is scored, refused, or priced by an algorithm. Reminders are sent on a schedule you set, to contacts you chose, about documents that are missing; the only automated part is the calendar.

Under GDPR you can ask us to tell you what personal data we hold about you, to give you a copy, to correct it, to delete it, to restrict or object to its processing, and to hand it over in a portable format. Where we rely on consent you can withdraw it at any time, without affecting what happened before. Where we rely on legitimate interest you can object, and we will stop unless we can show a compelling reason.

Write to legal@syllevo.com. Tell us who you are and what you want; we may ask you to confirm your identity in a way that does not require more data than we already hold. We answer within one month, extendable by two more months for complex requests, and we tell you if we need the extension. Requests are free unless they are clearly unfounded or repetitive.

If your data is inside a customer's profile (you are a supplier, a buyer, a client's employee, or a reminder recipient), the customer is the controller and the request belongs to them. Send it to them; if you don't know who they are, write to us and we will pass it on and help them answer. Account holders can do most of this themselves: your profile page edits your details, the export page hands over everything, and the Owner can ask us to close the organization. If you're in the referral program, your Referrals page shows and changes your payout details.

You can complain to a supervisory authority. Ours is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), Bulevardul General Gheorghe Magheru 28-30, Sector 1, Bucharest, anspdcp@dataprotection.ro, www.dataprotection.ro. If you live in another EU country you can complain to your own authority instead. We would appreciate the chance to fix the problem first, but you do not have to give us one.

Syllevo is a business tool. We do not knowingly process data about anyone under 16 as a user, and the service is not directed at them. If a child's data appears in a document (a scholarship invoice, say), it is there because a customer's business put it there, and the customer is the controller.

Data is encrypted in transit and at rest. Credentials and tokens are encrypted with a separate key we hold, not the storage provider. Access inside our team is limited to the people who operate the service, logged, and reviewed. Every action on a document is in the audit trail. Backups are encrypted and tested. Extraction providers receive document content only, in the EU, with training and retention turned off. The full list of measures, the way we handle vulnerability reports, and our incident process are on the security page.

Read the security page

If a personal data breach affects data we process for you, we tell the Owner of every affected organization without undue delay and no later than 72 hours after we become aware of it, with what we know, what we are doing, and what you may need to do. As controller, you decide whether to notify the supervisory authority and the people affected; we give you the facts to decide and help with the notification. For data where we are the controller, we notify ANSPDCP ourselves within 72 hours where the law requires it.

We update this policy when the service, our providers, or the law change. The effective date at the top moves with each version. For changes that matter to you, such as a new sub-processor, a new category of data, or a new purpose, we email the Owner at least thirty days before the change takes effect. Earlier versions are available on request.

Data protection questions and requests: legal@syllevo.com. Security reports: security@syllevo.com. By phone: +40 728 608 910. By post: Businice S.R.L., Str. Fetești nr. 52, tronson 3, parter, camera 2, ap. 3, sector 3, București, România. We answer in English or Romanian, whichever you write in.