Privacy Policy

This Privacy Policy describes how Linkbase AB ("Linkbase", "we", "us", or "our") collects, uses, and shares personal data when you use our application and related services (the "Service"). The Service connects the platforms your business uses — such as e-commerce platforms, payment providers, advertising platforms, and accounting platforms ("Connected Platforms") — and automates bookkeeping and related workflows.

By creating an account or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Service.

This Privacy Policy is drafted in English. Summaries or translations may be provided for convenience; in the event of a conflict, the English text prevails.

Linkbase processes personal data in two distinct roles:

• Linkbase as controller. For personal data about you and your team as users of the Service — account registration and authentication data, billing and subscription data, usage data, support communications, and service-related communications — Linkbase determines the purposes and means of processing and acts as data controller. This Privacy Policy governs that processing.
• Linkbase as processor. For personal data contained in the business records processed through the Service on your behalf — for example your end customers' names, addresses, and order and transaction details retrieved from Connected Platforms — your company is the data controller and Linkbase acts as data processor. That processing is governed by our Data Processing Agreement (DPA), which forms part of the Terms of Service.

Our contact information:

• Company: Linkbase AB
• Country: Sweden
• Email: privacy@linkbase.se
• Website: https://linkbase.se

3.1 Information from Connected Platforms

When you connect a platform to the Service, we retrieve the data needed to provide the integrations and automations you configure, through that platform's APIs. Depending on the platform, this includes:

• Order and transaction information (order details, amounts, currencies, dates, status)
• Payout, fee, refund, and dispute information from payment providers
• Customer information contained in orders (names, addresses, email addresses)
• Product information (product names, SKUs, prices, VAT rates)
• Advertising account and spend information from advertising platforms
• Accounting data (chart of accounts, customer records, invoice and voucher data)
• Store or account settings and configuration

Most of this data is processed on your behalf with Linkbase as processor, as described in Section 2 and the DPA.

3.2 Information You Provide Directly

• Account registration information (name, email, company details)
• Billing information for subscription payments
• Configuration settings for integrations and automations
• Support communications

3.3 Automatically Collected Information

• Usage data and interaction logs
• IP addresses and device information
• Browser type and version
• Error logs and performance data

We use cookies and similar browser storage only for signing in, security, payments, and remembering your preferences — never for analytics or marketing. Our Cookie Policy lists every cookie and storage key we set, with its purpose and lifetime.

We use the information we collect to:

• Provide, maintain, and improve the Service
• Synchronize data between your Connected Platforms
• Create accounting entries, vouchers, reports, and documents in your accounting platform
• Process payments and manage subscriptions
• Provide customer support
• Send service-related communications
• Detect, prevent, and address technical and security issues
• Comply with legal obligations

We may create de-identified, anonymized, or aggregated data from data processed through the Service and use it to develop, test, benchmark, and improve the Service, including training machine-learning models, as described in the Terms of Service (which include an opt-out from model-improvement use). De-identified data does not identify you or any natural person.

Where Linkbase is the controller, we process personal data based on the following legal grounds under the General Data Protection Regulation (GDPR):

• Contract Performance: Processing necessary to provide the Service you have subscribed to (Article 6(1)(b))
• Legitimate Interests: Processing necessary for our legitimate business interests, such as improving our Service and ensuring security (Article 6(1)(f))
• Legal Obligation: Processing necessary to comply with applicable laws, such as tax and accounting regulations (Article 6(1)(c))
• Consent: Where applicable, processing based on your explicit consent (Article 6(1)(a))

Where Linkbase is the processor, the legal basis for processing is determined by your company as controller; we process on your documented instructions under the DPA.

We share personal data with:

• Connected Platforms: Data is exchanged with the platforms you connect (for example your accounting platform receives the accounting entries the Service creates), at your direction and as required to provide the integrations you configure
• Service Providers and Sub-processors: Third-party providers who assist in operating our Service, such as hosting and infrastructure, payment processing, error tracking, AI inference, and email delivery. Providers acting as sub-processors of data we process on your behalf are engaged under written agreements as described in the DPA
• Legal Requirements: When required by law, court order, or governmental authority

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

How long we keep data depends on its category:

• Account data (registration, authentication, billing, support) is retained for as long as your account exists and for a limited period thereafter to handle post-termination matters, unless a longer retention is required by law.
• Business records processed through the Service (orders, transactions, accounting entries, and supporting documents) may need to be retained to satisfy bookkeeping and tax legislation. Under the Swedish Bookkeeping Act, accounting records must be preserved for seven years after the end of the calendar year in which the financial year ended.
• Integration history after disconnect. When you disconnect an integration or uninstall an app, we remove the connection credentials, but we intentionally retain the imported order and transaction history associated with that store or account. This preserves the records underlying accounting entries already created and ensures your history is available if you reconnect the same store or account later.

You may request deletion of your data at any time by contacting privacy@linkbase.se. We will delete or anonymize the data within 30 days of a verified request, except where we are required to retain it for legal or regulatory purposes as described above.

Your data is primarily processed within the European Union (EU) and European Economic Area (EEA). Some of our service providers are established outside the EU/EEA or may process data there. Where data is transferred outside the EU/EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, certification under the EU–U.S. Data Privacy Framework, or transfers to countries with an adequacy decision.

Under GDPR and other applicable privacy laws, you have the following rights:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Restriction: Request restriction of processing
• Portability: Request your data in a portable format
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, contact us at privacy@linkbase.se. We will respond within 30 days. If your request concerns data we process on behalf of a business you are a customer of (for example a store you bought from), we will refer the request to that business, which is the controller of that data.

We implement industry-standard technical and organizational security measures to protect your data, including encryption in transit (TLS/SSL) and at rest, role-based access controls, audit logging of administrative access, and regular security assessments. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Where a Connected Platform operates mandatory data-subject compliance mechanisms — for example Shopify's GDPR webhooks for customer data requests, customer data erasure, and shop data erasure — we receive and honor those requests within the required timeframes and delete the associated personal data from our systems, subject to the legal retention obligations described in Section 7.

Your use of Connected Platforms is subject to their respective privacy policies. We encourage you to review the privacy policy of each platform you connect to the Service; the current list of supported platforms is available on our website and in the app.

Our Service is not directed to children under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new Privacy Policy on our website and, where appropriate, by email. Your continued use of the Service after such changes constitutes acceptance of the updated Privacy Policy.

If you have questions about this Privacy Policy or our data practices, please contact us:

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or your local supervisory authority.