Who is responsible
ekonomimcp has two roles under the General Data Protection Regulation (GDPR), depending on the data:
- Controller for data about you as a user and customer: your account, your sign-in, subscription and billing, support, security logs and the website. This is the processing this policy mainly describes.
- Processor for personal data in your company's Fortnox that we process on the company's behalf when an AI client uses ekonomimcp. There your company is the controller, and the processing is governed by the data processing agreement. If an accounting firm works on behalf of clients, we are a sub-processor to the firm.
The controller is:
- Company
- [Bolagsnamn AB]
- Organisation number
- [Organisationsnummer]
- VAT registration number
- [Momsregistreringsnummer]
- Address
- [Postadress]
- support@ekonomimcp.se
What data we process
| Category | Data | Source |
|---|---|---|
| Account | DataName, e-mail address and Fortnox user ID, which companies you have connected and your choices for each connection. | SourceFortnox, when you sign in, and your choices in the service. |
| Company | DataCompany name, organisation number and Fortnox ID. For a sole trader, the organisation number is your personal identity number. | SourceFortnox. |
| Connections | DataEncrypted Fortnox authorisations, which AI clients you have connected and when they were last used. | SourceThe service. |
| Usage | DataEvent log of tool calls and approvals, with time, company, AI client and result. | SourceThe service. |
| Technical and security | DataIP address, the browser's user agent and technical logs. | SourceYour browser and AI client. |
| Billing | DataInvoice recipient, address, VAT registration number and payment status. Card details are handled only by Stripe. | SourceYou, via Stripe. |
| Support | DataWhat you write to us and our replies. | SourceYou. |
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and administering your account and providing the service | Legal basisContract (Article 6(1)(b)). If you act on behalf of a company: legitimate interest in performing the contract with the company (Article 6(1)(f)). |
| Billing and bookkeeping of our revenue | Legal basisLegal obligation under the Swedish Bookkeeping Act (Article 6(1)(c)). |
| Security, traceability, troubleshooting and preventing abuse | Legal basisLegitimate interest in a secure and working service (Article 6(1)(f)). |
| Support and contact about the service, for example changed terms or service disruptions | Legal basisContract (Article 6(1)(b)) and legitimate interest (Article 6(1)(f)). |
| Establishing and defending legal claims | Legal basisLegitimate interest (Article 6(1)(f)). |
| Contacting people in their professional role about the service (see Contact for marketing purposes) | Legal basisLegitimate interest in marketing the service to businesses (Article 6(1)(f)). |
We do not use personal data for third-party marketing, profiling or automated decisions with legal effects, and we do not sell it.
Data in Fortnox
Your company's bookkeeping contains personal data, for example contact persons at customers and suppliers and text on invoices and vouchers. We process this data only on the company's instructions, that is, when an AI client the company has connected asks for it, and within the permissions that have been chosen.
- We store no copy of the bookkeeping. Data for reports is held in the server's memory for at most two minutes.
- What we keep for traceability is the event log and the record behind each approval, which may contain, for example, customer names and amounts.
- We never ask Fortnox for access to payroll, employees or absence.
- We do not use the data for our own purposes and do not train any AI models on it.
If you want to exercise your rights regarding data in a company's bookkeeping, contact that company. We help the company respond.
Data returned to AI clients
When the AI client uses a tool, ekonomimcp sends the result to the AI client, and thereby to your AI provider. What the result contains depends on the tool and on the connection's permissions. It can include:
- Company details: name, organisation number, address, VAT registration number, bankgiro and plusgiro numbers, contact details and financial years.
- Customers and suppliers: names, contact persons, contact details such as address, e-mail and phone number, organisation numbers, and customer and supplier numbers. For a sole trader, the organisation number is a personal identity number, and it is shown masked (YYMMDD-****).
- The company's own people: names of references and handlers on invoices, orders and offers (such as Our reference), project leaders and project contact persons, and who approved supplier invoices.
- Suppliers' payment details: bankgiro, plusgiro, bank account, IBAN and BIC, and whether they have changed in the last 30 days.
- Invoice and voucher contents, including supplier invoices, orders and offers: rows, articles, accounts, VAT and free text.
- Document numbers, for example invoice, order, offer and voucher numbers.
- Dates and amounts, also compiled in reports such as the income statement, balance sheet, general ledger, VAT report and accounts receivable and payable.
- Approvals: action ID, link to the approval page, when the link expires, the preview, status and outcome.
- Registers: chart of accounts, articles and prices, projects and cost centres.
- The connection: ekonomimcp's ID for each company, access level, which Fortnox permissions the company has given, and the status of the Fortnox connection and of the subscription.
The AI client can also read other data from Fortnox within the connection's permissions, for example contracts, accruals and price lists. Every tool is listed in the tool list (in Swedish). How the AI provider handles the data is governed by your agreement with the provider (see Recipients).
How long we keep data
- Account data: as long as the account exists, and deleted within 30 days after the agreement has ended.
- Event log and approvals: 24 months.
- Sign-in on the website: 30 days after the last visit.
- IP addresses used to limit sign-in attempts: at most one day.
- Invoices and payment details: seven years after the end of the calendar year in which the financial year ended, under the Swedish Bookkeeping Act.
- Support cases: two years after the case was closed.
- Contact details for marketing: six months if you do not reply. If you say no, we keep only what is needed so that we do not contact you again.
More about technical retention periods is on the Security (in Swedish) page.
Contact for marketing purposes
We sometimes contact people at limited companies, trading partnerships and accounting firms about the service, by e-mail, phone or LinkedIn. We have not received that data from you, so we explain here what we do with it (Article 14).
- What data: name, job title, employer, work e-mail address and phone number, and what we have written to each other.
- Source: public sources, for example the company's website, the Swedish Companies Registration Office (Bolagsverket), industry registers and professional profiles on LinkedIn. Where we found your data is stated in the first message.
- Why and on what basis: to offer the service to the company you work for. The legal basis is legitimate interest (Article 6(1)(f)). We do not contact sole traders by e-mail.
- How long: six months if you do not reply, otherwise as long as we are in contact about the service.
- You can always say no: reply "no thanks" or write to us, and we stop immediately (Article 21). We then keep only your address on a suppression list so that you are not contacted again.
- Recipients: our e-mail and customer relationship service, which processes the data on our behalf. We do not sell or disclose it.
Recipients
- Sub-processors that run the service for us, for example hosting, database and payments. They may only process the data according to our instructions. They are listed in annex 2 of the data processing agreement and on the Sub-processors (in Swedish) page.
- Fortnox AB, when an AI client creates or changes something in your company's Fortnox. Fortnox is your company's supplier.
- Your AI provider, when the AI client reads data via ekonomimcp. This happens on your instructions and under your agreement with the provider, for example Anthropic, OpenAI, Microsoft or Google. The provider is not our sub-processor.
- Stripe, which is an independent controller for, among other things, fraud prevention and anti-money laundering checks.
- Authorities, when we are required to by law.
Transfers outside the EU/EEA
Our servers and database are in the EU (Frankfurt). Some of our sub-processors belong to groups with companies in the USA and may need to access data from there, for example for support and operations. Such transfers are protected by the European Commission's standard contractual clauses and, where applicable, the EU–US Data Privacy Framework.
Cookies
We only use cookies that are needed for the service to work, so we do not ask for consent to them:
- a sign-in cookie that keeps you signed in for up to 30 days,
- a short-lived cookie that ties the sign-in with Fortnox to your browser, so that no one else can complete it.
We do not use cookies for analytics or marketing. The payment page is run by Stripe, which may set its own cookies to prevent fraud.
Your rights
You have the right to:
- find out what data we hold about you and get a copy (access),
- have inaccurate data corrected,
- have data erased, unless we are required by law to keep it,
- ask for processing to be restricted,
- object to processing based on legitimate interest,
- receive data you have provided in a machine-readable format (data portability).
E-mail support@ekonomimcp.se. We reply within one month. We may need to confirm your identity before we disclose any data.
Complaints
If you are unhappy with how we process your personal data, contact us first. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, Sweden, imy.se.
Changes
We update the policy when the service or the law changes. We announce material changes by e-mail before they take effect. The date at the top shows when the policy was last changed.
Contact
Send questions about personal data to support@ekonomimcp.se. Send security questions and vulnerability reports to security@ekonomimcp.se. More ways to get help are on the Support page.