PRIVACY POLICY

Aourly AB | Last updated: 2026-03-17

1. Data Controller

Aourly AB ("Aourly," "we," "us") operates the Aourly platform for time reporting, expense management, invoicing, and financial administration aimed at consultants and consulting firms. This privacy policy describes how we collect, use, store, and protect your personal data in accordance with the EU General Data Protection Regulation (GDPR, Regulation 2016/679) and supplementary Swedish legislation, including the Swedish Data Protection Act (2018:218).

2. Roles: Data Controller and Data Processor

Responsibility for your personal data varies depending on your relationship with Aourly:

Aourly as Data Controller: We are the data controller when we determine the purpose of the processing. This applies, for example:

• When you register as a Solo Consultant and use Aourly for your own business.

• When we process your data for invoicing, payment, customer service, or marketing of our services.

• When we collect website statistics via Google Analytics (with your consent).

• When we manage your account information and authentication.

Aourly as Data Processor: We act as a data processor when we process personal data on behalf of our customers (the consulting firms). The consulting firm is then the data controller and is responsible for having a lawful basis for the processing of its consultants' data. We process this data according to the instructions in our Data Processing Agreement (DPA) with the consulting firm.

3. Personal Data We Process

3.1 Account Information

• First and last name, email address, date of birth

• Password (stored in hashed form, never in plain text)

• Onboarding data (steps completed during registration)

3.2 Swedish Identity Data

• Personal identity number (personnummer), collected via BankID authentication

• Data is stored with soft deletion for traceability

3.3 Company Information

• Company name, organization number, VAT registration number

• Email address, phone number

• Address, postal code, city, country code

• Company logo

3.4 Client and Customer Data

• Contact details: name, email address, invoice email, phone number

• Company details: organization number, customer number, VAT registration number

• Address, postal code, city, country code

• Contact person

3.5 CV Data

• Title, summary

• Work experience (title, company, start/end dates)

• Education (school, field of study, dates)

• Skills, languages, locations

3.6 Bank Account Information

• IBAN, BIC, bankgiro, Swish number (company level)

• Account number and clearing number (encrypted, for Worknode users)

3.7 Time Reporting and Expenses

• Time entries with hours, hourly rate, comments, and approvals

• Expenses with category, amount, and participants

• Receipts (file uploads with metadata: file name, size, MIME type)

3.8 Invoicing and Bookkeeping

• Invoices, payments, accounting vouchers

• Payment terms and invoicing history

• SIE4 export data

3.9 Mobile Devices

• Device ID (uniquely generated per device)

• Push tokens (Firebase Cloud Messaging and Expo)

• Device information (platform, version, model)

• Timestamp of last activity

3.10 Notification Preferences

• Notification settings per user and company

• Timestamps for activation and deactivation, and method

• Record of who changed the setting

3.11 Activity and Audit Data

• Activity logs recording changes to client, assignment, expense, and notification data (who changed what, and when)

3.12 Authentication Data

• Session cookies and tokens

• BankID authentication data

• API tokens (Sanctum) for the mobile app

• One-time codes for mobile login

3.13 Company Documents

• Liability insurance and general terms and conditions (PDF uploads)

• Document metadata: file name, size, MIME type, activation status

4. Legal Basis for Processing

We process your personal data based on the following legal bases under GDPR Article 6.1:

Where we rely on legitimate interest (Art. 6.1(f)), we have conducted balancing tests to ensure our interests do not override your fundamental rights and freedoms. You may request information about these assessments by contacting our Data Protection Officer.

5. Third-Party Providers (Sub-processors)

We use the following third-party providers (data processors) to operate the platform. All processors are bound by data processing agreements in accordance with GDPR Article 28.

For transfers of personal data to countries outside the EU/EEA (primarily the USA), we rely on the EU-US Data Privacy Framework and/or standard contractual clauses (SCCs) adopted by the European Commission, in accordance with GDPR Articles 44–49.

6. Cookies and Session Data

6.1 Cookies

Aourly uses necessary cookies as well as statistics cookies that require consent.

Session data is stored in the database (not in the cookie). Cookie consent is managed via a banner with the option to accept all, decline all, or manage settings per service.

6.2 Local Data Storage in the Mobile App

Aourly's mobile app (React Native/Expo) stores the following data locally on your device via encrypted storage (expo-secure-store):

This data remains on your device and is not shared with third parties. It is cleared when you log out.

7. Retention Periods

We retain personal data only for as long as necessary for the purposes for which it was collected, or as long as required by law:

Once the retention period has expired, the data is deleted or anonymized. Some data may be retained in anonymized form for statistical purposes.

8. The Mobile App

Aourly's mobile app is a React Native/Expo application that primarily functions as a WebView wrapper for the web platform.

Data collected by the mobile app:

• Device ID (generated locally, stored encrypted on the device)

• Push notification tokens (Firebase Cloud Messaging) — transmitted to the server upon registration

• Device information (platform, model, version) — sent upon push token registration

Error tracking:

• Sentry is used for crash reporting with an EU data center (ingest.de.sentry.io)

• No personally identifiable information (PII) is sent by default

• Session recording with masking of images and visible text (for troubleshooting)

• Performance monitoring with 10% sampling in production

Device permissions:

The mobile app does not request access to camera, microphone, GPS, or contacts. You can revoke the push notification permission via your device settings.

9. Your Rights as a Data Subject

Under GDPR Articles 15–22, you have the following rights regarding your personal data:

9.1 Right of access (Art. 15)

You have the right to request a copy of the personal data we hold about you, along with information about how it is processed.

9.2 Right to rectification (Art. 16)

You have the right to request correction of inaccurate or incomplete personal data. You can update most account information directly in the platform.

9.3 Right to erasure (Art. 17)

You have the right to request deletion of your personal data, subject to statutory retention requirements (e.g., bookkeeping records that must be kept for 7 years).

9.4 Right to restriction of processing (Art. 18)

You have the right to request restriction of processing under certain circumstances, for example when you dispute the accuracy of the data.

9.5 Right to data portability (Art. 20)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format. Bookkeeping data can be exported in SIE4 format via the platform. Other data portability requests are handled by our Data Protection Officer — contact support@aourly.com.

9.6 Right to object (Art. 21)

You have the right to object to processing based on legitimate interest (Art. 6.1(f)). We will cease processing unless we can demonstrate compelling legitimate grounds.

9.7 Right to withdraw consent (Art. 7.3)

Where our processing is based on your consent, you have the right to withdraw it at any time. This does not affect the lawfulness of processing carried out before the consent was withdrawn. For example, you can withdraw cookie consent via the settings in the cookie banner.

9.8 Right not to be subject to automated decision-making (Art. 22)

Aourly does not use automated decision-making or profiling that produces legal effects or similarly significantly affects you. AI-based CV parsing is used solely as an aid and does not result in automated decisions.

How to exercise your rights

Contact our Data Protection Officer:

• Email: support@aourly.com

• Phone: +46 70 740 07 54

• Post: Aourly AB, Attn: Data Protection Officer, Frejgatan 4 bv, 114 20 Stockholm

We respond to your request within 30 days. If we need more time (up to an additional 60 days for complex requests), we will inform you within the initial 30-day period.

Supervisory authority

If you are not satisfied with our response, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY):

• Website: https://www.imy.se

• Email: imy@imy.se

• Address: Integritetsskyddsmyndigheten, Box 8114, 104 20 Stockholm

10. Security Measures

We take appropriate technical and organizational measures to protect your personal data in accordance with GDPR Article 32:

• Password security: Bcrypt hashing algorithm (12 rounds)

• Encryption of sensitive data: Bank account information is encrypted at rest

• Transport encryption: All data is transmitted via HTTPS/TLS

• Session security: HttpOnly cookies with SameSite=lax, database-stored sessions

• CSRF protection: Token-based protection against cross-site request forgery

• Identity data: Personal identity numbers are deleted upon account deletion (soft deletion for traceability)

• Access control: Role-based access control per company (multi-tenancy with global scope isolation)

• Backups: Encrypted backups to AWS S3 (EU region) with separate short- and long-term schedules

• Change logs: Spatie Activity Log tracks changes to critical data models

• Error tracking: Sentry configured without PII by default; EU data center

11. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated at least 30 days in advance via email or notice in the Service. The "Last updated" date at the top of this document indicates when the policy was last revised.

12. Contact Information

For questions about this privacy policy or our processing of personal data, contact:

Aourly AB Attn: Data Protection Officer (Tommie Lagerroos) Frejgatan 4 bv, 114 20 Stockholm Email: support@aourly.com Phone: +46 70 740 07 54 Organization number: 559515-8774