Privacy Policy

When you book a pilot or contact us, we collect the details you submit: your name, work email, company, company size, and which accounting system you use. We use them only to respond and to discuss a pilot with you, on the basis of our legitimate interest in answering enquiries. Submissions reach us as an email, sent through Brevo (France, EU) to our mailbox, which Google Workspace hosts and stores in the EU, and go nowhere else. We also measure site traffic with Vercel Analytics, which counts page views without cookies or identifiers that follow you across sites, on our legitimate interest in knowing how the site is used.

With your consent we also use Google Analytics, loaded through Google Tag Manager, to see how the site is used. It runs only after you accept on the banner at the foot of the page. It then sets the cookies _ga and _ga_*, which tell one visit from another for up to two years, and sends visit data (the pages seen, the browser, and the IP address the request came from) to Google in the USA. Your answer on the banner is kept in a cookie of our own, mimrix-consent, for six months, and you can change it at any time from “Cookie settings” in the footer. That cookie is strictly necessary, carries no identifier, and needs no consent. The language you read the site in is part of the address, so no cookie is set for it. The product tour on the See it run page is hosted by Supademo (USA) and loads only when you start it; Supademo then receives your IP address and may set cookies of its own for the tour.

To sign you in we keep your name, email address, and either a password (stored only as a hash) or one-time codes we send by email. Each session records its start, expiry, IP address and browser, so that suspicious sign-ins can be spotted and sessions can be revoked. We process your account to perform our contract with you, and the session and IP records on our legitimate interest in keeping the service secure. The product sets strictly necessary cookies for sign-in and session security, and nothing else. We also keep what your organization tells us about itself: its name, country, organization number and the companies (entities) it keeps books for, and which people may open each of them.

When you connect your accounting system (Fortnox), we mirror the parts of it the agents need: the chart of accounts, suppliers and customers, supplier invoices, and the general journal per fiscal year. The mirror is read to answer your questions and to code incoming bills, and it is updated as your books change. We write to your accounting system only when you approve a bill for posting. The access token the system gives us is sealed with AES-256-GCM before it is stored, so a copy of our database cannot open your books.

A document you upload, attach in chat, or that arrives by mail is stored as the file you gave us, in a private bucket in Stockholm that is only ever read through our own access-checked route. We read the text out of it, extract the invoice's fields (supplier, dates, amounts, line items), and keep an index of it so it can be found again by what it says. Each step an agent or a person takes with it is recorded, with who took it and when, because a bookkeeping record has to show its history.

If you connect a Gmail mailbox, we ask Google for read-only access to it (the gmail.readonly scope). We use it for one purpose: to find supplier invoices that arrive by mail and take them into your bookkeeping.

When you ask us to check the mailbox, we read the messages that arrived since the last check and decide, for each, whether it is a supplier delivering a bill. For a message that is, we keep the attachment as a document, together with the sender, the subject, the date, and the opening part of the message text, since a covering note often carries what the invoice does not. For every other message we keep nothing, and nothing is read for any purpose beyond that decision. We never read, send, delete or modify mail, and we never access your contacts, calendar or any other Google data.

Mimrix's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Gmail data for advertising, we do not sell it, we do not let humans read it except with your permission, for security, or as required by law, and we do not use it to train artificial-intelligence models.

You can disconnect the mailbox at any time from the dashboard's settings, which deletes the access token we hold; you can also revoke our access from your Google account's permissions page. Documents already taken into your bookkeeping stay, as bookkeeping records do.

Our agents run on language models we buy from providers; nothing is processed by a model of our own. Mistral AI (France, EU) reads documents (OCR), extracts their fields, codes invoice lines, and indexes documents for search, and stands in for chat when the primary is unavailable. Google (Gemini, USA, through Google's paid API, under terms that exclude training) answers chat with Mimir, is the first to code invoices, and stands in for extraction and for reading documents when Mistral cannot serve the read. Groq (USA) is the last resort behind both. What a model receives is what its task needs: the text of a document, the relevant part of your chart of accounts and supplier list, your chat messages, and the figures required to answer them. The providers process this only to produce the answer we asked for, and on the terms we use them under, do not use it to train their models. The agents propose codings and matches. Nothing is posted, paid or sent without a person approving it, and no decision with legal effect is made automatically.

Our databases and document storage run on Amazon Web Services in Stockholm (eu-north-1). The application runs on Vercel in Stockholm. Background work such as reading an invoice or refreshing a mirror is scheduled through Inngest (USA). Inngest receives the identifiers of the work to run, the counts and outcome each step reports, and the short stage notes the dashboard shows while a run is going, which can quote a line description or an amount. It never receives the document or the books. Sign-in codes and notifications are sent through Brevo (France, EU).

The people your organization has added to an entity can see that entity's books, documents and history. Our own staff can reach customer data through an internal console, only to provide support, operate the service and keep it secure. We do not sell your data and we do not share it with anyone other than the processors named here, except where the law requires it.

The providers that process data on our behalf, what they do for us, and where they are:

• Amazon Web Services (Stockholm, EU): databases and document storage.
• Vercel (a US company): hosting of the application in Stockholm, of this website on its global edge network, and cookieless site analytics, under the EU-US Data Privacy Framework.
• Google (USA): measurement of this website through Google Analytics, only after you accept on the cookie banner.
• Supademo (USA): hosting of the interactive product tour, loaded only when you start it.
• Mistral AI (France, EU): document reading, extraction, coding, search indexing, chat fallback.
• Google (USA): chat, invoice coding, and document reading when Mistral is unavailable, through Gemini.
• Groq (USA): last-resort language-model fallback.
• Langfuse GmbH (Germany, EU): tracing of agent runs, which includes the text sent to and returned by the models, kept for 30 days.
• Inngest (USA): background job scheduling; identifiers, counts, step outcomes and short stage notes.
• Brevo (France, EU): transactional email, including the pilot form's submissions.
• Google Workspace (Google Ireland; stored in the EU): our email, where pilot enquiries land.

Fortnox and your Google account are not our processors: you connect them, and they process your data under their own terms. We tell customers of a new sub-processor at least 30 days before it is used.

Google, Groq and Inngest may process data outside the EU/EEA, and Vercel, which runs the application for us in Stockholm, is a US company and processes this website's requests and analytics under the same safeguards. Where that happens we rely on the EU Standard Contractual Clauses, or on the EU-US Data Privacy Framework where the provider is certified under it, to protect it. A copy of the clauses, or the certification reference, is available from privacy@mimrix.com. Your books, your documents and your account data stay in the EU; what leaves it is what a model needs to answer a question or read an invoice. Site measurement, if you accept it, also sends visit data from this website to Google in the USA, and the product tour, if you start it, is served by Supademo there.

Account data stays while your account does. Documents and the record of what was done with them are bookkeeping records, stored on the customer's behalf: we keep them for seven years after the end of the calendar year in which the fiscal year ended, which is what Swedish bookkeeping law requires, unless the customer exports them and asks us to delete earlier. The mirror of your books is refreshed while the connection exists and removed when it is disconnected. Chat history stays while your account does, and is deleted on request. Traces of agent runs are kept for 30 days. Access tokens are deleted the moment you disconnect a system or a mailbox. Session and IP records are kept for 90 days. Enquiry data from this website is kept for 12 months. When an organization closes its account it can export its books, documents and history; we delete them 90 days after closure unless it asks us to keep them as its archive.

Data is encrypted in transit and at rest. The tokens that open your accounting system and your mailbox are sealed with a key that is never stored beside them. Access to production systems is limited to the people who operate the service, and every action taken on a bookkeeping record is logged with who took it. If a breach affects your data we tell you without undue delay.

Under the GDPR you can request access to, correction of, or deletion of your personal data, object to or restrict its processing, and request a copy of it in a portable form. To exercise any of these, email privacy@mimrix.com. Where the data belongs to a company's books, the company is the one that decides, and we will help it answer you. You also have the right to lodge a complaint with the Swedish data-protection authority, IMY.

When we add a provider or start processing something new, we update this page and the date at the top. A change that affects what we do with your data is also announced in the product.

Questions about this policy or your data: privacy@mimrix.com.