Privacy Policy

Version 1.0 — Last updated: May 2026

1. Data controller

Peil (hereinafter: "we", "us", or "Peil"), accessible via peil.app, is the data controller within the meaning of the General Data Protection Regulation (GDPR) for the processing of your personal data.

Contact details:
Studio Jeroen Kortekaas
The Netherlands
Chamber of Commerce: 93707754
Email: privacy@peil.app

2. What data do we collect?

2.1 Account data

When creating an account we process:

  • name and email address;
  • password (stored encrypted, never in readable form);
  • IP address at login (for security and approximate location estimation for fraud prevention);
  • time and device of login sessions.

When registering via Google OAuth we receive only the data Google passes to us in accordance with your consent: name, email address, and profile photo URL.

2.2 Financial data entered by you

Peil processes the financial data you enter yourself, including:

  • hours worked, rates, and projects;
  • invoice data (invoice numbers, client details, amounts);
  • bank account details (IBAN) you enter for display on your invoices;
  • fixed costs, business expenses, and other cost items;
  • settings such as VAT rate, hourly rate, and business start date;
  • company logos you upload for use on invoices.

This data is provided entirely by you and is processed solely to deliver the service to you. We do not analyse the content of your financial data for commercial purposes.

For personal data you enter relating to your own clients or contacts — such as names, addresses, and email addresses on invoices — Peil acts in principle as a processor on your behalf. In that capacity you are yourself the data controller for that data. If a Data Processing Agreement (DPA) is required, one can be provided on request via privacy@peil.app.

2.3 Usage analytics

We use Plausible Analytics for anonymous website statistics. Plausible is a cookie-free analytics service that collects no personal data and places no tracking cookies. Only aggregated data is recorded (such as page visits and referring websites) that cannot be traced back to individual users. More information: plausible.io/privacy.

2.4 Communications

If you contact us by email, we retain the content of your messages and your email address in order to handle your request.

3. Purposes and legal bases for processing

3.1 Performance of a contract (Article 6(1)(b) GDPR)

Processing of account data and financial data you enter is necessary for performance of the contract you enter into with us when creating an account. Without this processing we cannot deliver the service to you.

3.2 Legitimate interests (Article 6(1)(f) GDPR)

We process IP addresses and session data based on our legitimate interest in securing the Platform and preventing misuse. This interest outweighs your privacy interests, given the minimal impact of this processing.

We also process aggregated, operational usage data — such as the number of clients, projects, time entries and invoices in your account, and the time of your last activity — based on our legitimate interest in operating, improving and supporting the service. In doing so we do not analyse the content of your financial data and we do not track individual click behaviour; this concerns only counts and activity timestamps that already arise from your use of the service.

3.3 Legal obligation (Article 6(1)(c) GDPR)

Where we are legally required to retain or disclose data (for example under tax or bookkeeping legislation), we process your data on that basis.

4. Retention periods

We retain your personal data no longer than necessary for the purposes for which it was collected:

  • Account data and financial input: for as long as your account is active. After a deletion request a 30-day recovery period applies. After this your active account data is permanently deleted, unless a statutory retention obligation applies. Where statutory obligations apply, we retain only the data strictly necessary to comply; other data is deleted.
  • Invoice data: in accordance with the statutory retention obligation for financial records in the Netherlands (7 years after the end of the financial year). We retain only the data necessary to meet this obligation.
  • Session data and IP addresses: maximum 90 days after the relevant session.
  • Support communications: maximum 2 years after closure of the request.
  • Backups: deleted data may appear in encrypted backups for a limited time until these are automatically overwritten.

5. Third parties and sub-processors

We share your personal data with third parties only to the extent necessary for the delivery of our service. We enter into a data processing agreement with all sub-processors.

5.1 Hetzner (hosting)

Our servers are hosted by Hetzner Online GmbH, a German company with data centres within the European Union (Germany and Finland). Your data is processed and stored on European servers, so no transfer takes place to countries outside the EEA in the context of hosting.

5.2 Resend (email delivery)

For sending emails (such as invoices and system notifications) we use Resend. Resend processes only the email addresses and content necessary for delivery. More information: resend.com/legal/privacy-policy.

5.3 Plausible Analytics (web analytics)

We use Plausible Analytics for anonymous visitor statistics. Plausible places no cookies and processes no personal data. Only aggregated, non-traceable statistics are generated. Plausible operates from the EU and is fully GDPR-compliant.

5.4 Mollie (payments)

Payments for paid subscriptions are processed by Mollie B.V., a Dutch payment service provider. Peil does not store payment card data; card processing takes place exclusively via Mollie. More information: mollie.com/en/privacy.

5.5 Sentry (error tracking)

For detecting and diagnosing technical errors we use Sentry. Sentry processes error messages and stack traces that may contain technical context such as user IDs and browser information. This data is used solely to resolve technical issues and is not shared with third parties. More information: sentry.io/privacy. Sentry processes data in compliance with GDPR on the basis of Standard Contractual Clauses (SCCs).

5.6 Cloudflare R2 (backups)

Encrypted daily backups of the database are stored via Cloudflare R2, an object storage service from Cloudflare Inc., using European data centre locations. Backups are encrypted and used solely for recovery in the event of an incident. More information: cloudflare.com/privacypolicy.

5.7 No sale of data

We never sell your personal data to third parties for commercial or marketing purposes.

5.8 Changes to sub-processors

We may from time to time add or replace sub-processors where necessary for delivery of the service. An up-to-date list of sub-processors is always available via this Privacy Policy. Material changes will be announced in advance.

6. Cookies

Peil uses no tracking or advertising cookies. We place only functional cookies strictly necessary for the operation of the Platform, such as session authentication cookies (JWT tokens). No consent is required for these cookies under applicable telecommunications law.

For web analytics we use Plausible, which operates without cookies (see §5.3).

7. Transfers outside the EEA

Peil aims to process your data within the European Economic Area. Resend and Sentry are US-based companies that may process data outside the EEA. Cloudflare R2 stores backup data on European servers. For all transfers outside the EEA we apply the Standard Contractual Clauses (SCCs) approved by the European Commission as an appropriate safeguard.

8. Your rights as a data subject

Under the GDPR you have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR): you have the right to know which personal data we process about you.
  • Right to rectification (Art. 16 GDPR): you can have incorrect or incomplete data corrected. Much of your data can be edited directly in your account settings.
  • Right to erasure (Art. 17 GDPR): you can request deletion of your data, unless we are legally obliged to retain it.
  • Right to restriction of processing (Art. 18 GDPR): in certain cases you can have the processing of your data restricted.
  • Right to data portability (Art. 20 GDPR): you can export your data in structured, commonly used, and machine-readable formats. Peil supports export of contacts and client data, time entries and invoice overviews (CSV/JSON), and invoice PDFs as an archive. These exports are designed to facilitate data portability and enable interoperability with bookkeeping tools and other services. Export is available via your account settings or on request via privacy@peil.app.
  • Right to object (Art. 21 GDPR): you can object to processing based on legitimate interests.
  • Right to withdraw consent: where processing is based on consent, you may withdraw that consent at any time.

You can exercise your rights by sending an email to privacy@peil.app. We will respond within 30 days of your request. We may ask you to verify your identity before processing your request.

9. Security

Peil takes appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. Measures include:

  • encrypted connections (HTTPS/TLS);
  • encrypted storage of passwords (bcrypt);
  • authentication via short-lived JWT tokens with refresh token rotation;
  • access restriction: each user can only access their own data.

In the event of a personal data breach we will act in accordance with the GDPR breach notification obligation, including notifying the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) where required, and informing affected individuals where the breach is likely to result in a high risk to their rights and freedoms.

10. Complaints

If you believe we are not processing your personal data in accordance with the GDPR, we ask you to contact us first via privacy@peil.app. You also have the right to lodge a complaint with the supervisory authority:

Autoriteit Persoonsgegevens (Dutch Data Protection Authority)
Postbus 93374
2509 AJ Den Haag
autoriteitpersoonsgegevens.nl

11. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy. Material changes will be announced at least 14 days in advance by email. The most current version is always available at peil.app/en/privacy. The date at the top of this document indicates when the current version was last updated.