Privacy policy

This policy explains how OrchOps, S.L., the company behind Kobrio, processes personal data when you visit this website, write to us or use the app. We have written it to be easy to understand; if anything is unclear, ask us.

1. Data controller

• Controller: OrchOps, S.L. (Kobrio)
• NIF (tax ID): B93940880
• Address: Calle de Luchana 23, 4.º, 28010 Madrid (España)
• Data protection email: privacidad@kobr.io
• Data Protection Officer: dpo@kobr.io (appointment pending notification to the AEPD, the Spanish Data Protection Agency)

2. Two different roles: controller and processor

As controller, we process the data of people who visit this website, write to us, have a Kobrio account (owners, collaborators and advisers) or take out a subscription.

As processor, we process, on behalf of each business that uses Kobrio (the “issuer”), the data of its clients, suppliers and contacts that appear in its invoices, expenses and payments received. In that case the controller is the issuer, and our role is governed by the data processing agreement the issuer signs in the app before issuing invoices. If you are a client of an issuer and wish to exercise your rights, contact the issuer; if you write to us, we will forward your request to them.

3. What data we process, why and on what legal basis

Contact form

• Data: name, email, phone number (optional), your message and, if you are an adviser, the name, CIF/NIF (tax ID) and province of your firm, the approximate number of clients and the software you use.
• Purpose: to reply to you and, if you are an adviser, to assess a possible collaboration and, if it is a good fit, invite you to Kobrio. To protect it from spam, the form uses Cloudflare Turnstile (see Anti-spam protection for the form).
• Legal basis: taking steps at your request prior to entering into a contract, when you ask us for information in order to subscribe or collaborate (art. 6.1.b GDPR), and our legitimate interest in handling all other enquiries (art. 6.1.f GDPR).
• Retention period: as long as needed to handle your request and, afterwards, a maximum of 12 months from the last time we dealt with it, unless you go on to have a Kobrio account (as a client or adviser): in that case, for as long as you have it.

Account and use of the app

• Data: name, email, profile photo (if you upload one or choose to use the one from your Google or Microsoft account), your sign-in methods and second factor (stored in a form that cannot be read), the identifier of your Google or Microsoft account if you sign in with it, sessions, IP address and browser, and the log of the actions you take in the app.
• Purpose: to create your account by invitation, let you sign in securely, provide the service, give you support and send you service emails (sign-in links, invitations, notices).
• Legal basis: performance of the contract (art. 6.1.b GDPR).
• Retention period: for as long as you have the account. From Profile and security you can download a copy of your data (“Download my data”) and request deletion of your account, which the Kobrio administrator confirms (if you are the only owner of a business, its closure must first be requested or its ownership transferred to someone else). When a person is removed, their account is anonymised immediately and only a record without name or email remains, so that invoices and the audit log still show who did what. If, when you sign up your business, we cannot serve it yet, we keep its details and your email on a waiting list for 12 months in order to notify you.

Security and abuse prevention

• Data: IP address, browser, sign-in attempts and audit log.
• Purpose: to protect accounts, limit abusive attempts, detect unauthorised access and be able to investigate it.
• Legal basis: our legitimate interest in keeping the service secure (art. 6.1.f GDPR).
• Retention period: no longer than strictly necessary for that purpose. The audit log is kept for 6 years as regards invoices (like tax data) and 3 years for everything else (the limitation period for very serious infringements of data protection law); that of a closed business is deleted along with it.

Anti-spam protection for the form (Cloudflare Turnstile)

The contact form uses Cloudflare Turnstile in invisible mode to tell people apart from automated programs. You do not have to solve anything: the check is carried out when you submit the form.

• Data: the IP address of your connection, your browser’s TLS fingerprint, the User-Agent header, and the site key (sitekey) together with the page’s origin.
• Purpose: to detect and block bots and abusive submissions on the form. These signals are not used to identify you.
• Who decides: for this bot detection, OrchOps, S.L. is the data controller and Cloudflare acts as processor. Requests to exercise your rights regarding this processing should be sent to us (privacidad@kobr.io).
• Legal basis: our legitimate interest in protecting the form against spam and abuse (art. 6.1.f GDPR).
• Cloudflare as an independent controller: Cloudflare also uses these signals, as a controller in its own right, to improve its bot detection. That use is governed by its privacy policy and the Turnstile privacy addendum.
• International transfer: Cloudflare, Inc. is based in the United States, so this data may be processed there, with the safeguards for international transfers that Cloudflare describes in its own privacy policy.

As it is strictly necessary to detect and block bots, this check does not depend on what you choose in the cookie notice.

Kobrio subscription and billing

• Data: tax details of the subscribing business, plan, coupons and payments. Card or bank account details are processed by Stripe; we never see them in full.
• Purpose: to charge the subscription, issue our invoices and keep our accounts. If you work with Kobrio as an adviser, to manage that collaboration and its payments.
• Legal basis: performance of the contract (art. 6.1.b GDPR) and compliance with legal tax and commercial obligations (art. 6.1.c GDPR).
• Retention period: the period required by commercial and tax law (generally, six years for accounting records).

Your business data (as processor)

• Data: the data in your invoices, expenses, receipts, clients and suppliers, payments received and, if you enable them, your clients’ consents to receive reminders.
• Purpose: solely to provide the service in accordance with your instructions and the data processing agreement.
• Retention period: for as long as you use Kobrio. If you close your business, its data and documents are kept for 6 years from the end of the year of its last invoice or expense, during which you can view them and download them in full with “Download everything”; we notify you 3 months and 30 days beforehand and then delete them. You can ask us to delete them sooner. How long your business must keep its invoices is determined by the rules that apply to it: download your copy if you need to keep them for longer. The downloads we prepare (quarterly packs and full copies) are deleted after 30 days.

Summary of retention periods

• Closed business: its data and documents, 6 years from the end of the year of its last invoice or expense; then they are deleted, with notices 3 months and 30 days beforehand.
• Prepared downloads (quarterly packs and “Download everything”): 30 days.
• Audit log: 6 years for invoice-related entries; 3 years for everything else.
• Contact form messages: 12 months, unless you go on to have a Kobrio account.
• Sign-up waiting list: 12 months.
• Conversations with the in-app assistant: 12 months.
• Log of notifications sent to other apps (webhooks): 90 days.
• Demo businesses: 30 days.
• Deleted accounts: anonymised immediately.
• Our own accounting and tax records: 6 years.
• Database backups: roll over within about 4 weeks at most, so anything we delete also disappears from them after that period.

Backups to your cloud

• Data: if the owner of a business connects their Google Drive, Dropbox or OneDrive, we store the email or name of the connected account, the access permissions that service gives us (encrypted), the status of the connection and the list of files copied. To that cloud we copy each quarter’s documents: issued invoices, received invoices and expenses, filing receipts for the tax returns (modelos) submitted, invoice books and the quarter summary.
• Purpose: so that you have a copy of your documents in your own cloud, when you close a quarter or when you ask for one.
• Legal basis: performance of the contract (art. 6.1.b GDPR), because it is a feature you turn on yourself. We copy your business documents as processor, following your instructions.
• Retention period: for as long as the cloud is connected. When you disconnect it, we delete the permissions and the list of files; what has already been copied stays in your cloud. Section 4 explains what we receive from each service and how to disconnect it.

Artificial intelligence

The data in the documents you upload or forward (receipts and received invoices, invoices and other documents you import, purchase orders, price lists, POS end-of-day reports, the previous invoice you upload when you sign up and the consent documents you review) is extracted automatically. To do this, we send that document to the AI provider that Kobrio assigns to that task (OpenAI, Anthropic or Google; see section 5) only with what is needed to interpret it, such as your business’s name and NIF and your expense categories, and never with data from other issuers. We do not keep the previous invoice you upload when you sign up: it is discarded as soon as its data has been extracted. The same applies to what you write to the app’s assistant (which only receives your message, the date, your tax territory, the language and your expense categories: we do not send it your client list; instead, Kobrio itself looks up the client by its NIF or name), the description of your business when you sign up and the descriptions you ask to have translated. Under those providers’ API terms (paid terms, in Google’s case), they do not use what we send them to train their models, and we do not use your data to train models. What is extracted is only a suggestion: you review and validate every item before saving it, so no automated decisions with legal effects concerning you are taken.

Visits to this website

This website uses no analytics or advertising. Cloudflare, which serves it, processes your IP address and technical connection data to deliver the pages to you and protect them from attacks, on the basis of our legitimate interest in the website operating securely. What is stored in your browser is described in the cookie policy.

4. Accounts with other services: signing in with Google or Microsoft and backups to your cloud

Kobrio only connects to an account of yours with another service for two features that you turn on yourself: signing in with your Google or Microsoft account, and saving backups to your own cloud (Google Drive, OneDrive or Dropbox). This section applies equally to all those services; anything a particular service requires is set out at the end.

What we receive and why

• Signing in with Google or Microsoft (openid, email and profile permissions; with Microsoft, also User.Read and offline_access): the service provides us with your name, your email, your profile photo and the identifier of your account. We use them only to check that it is you and let you into your Kobrio account. Signing in this way never creates an account: it must already exist, by invitation. Your name and email in Kobrio do not change when you sign in with another account, and its photo only becomes your profile photo if you choose “Use my Google photo” or “Use my Microsoft photo”. With these permissions we do not access any other service of your account.
• Backups to your cloud: if you are the owner of a business and connect your cloud, Kobrio receives the email or name of that account, to show you which one is connected, and a permission limited to its own files: in Google Drive, https://www.googleapis.com/auth/drive.file (only the files Kobrio creates); in OneDrive, Files.ReadWrite.AppFolder (only the “Apps/Kobrio” folder), with User.Read and offline_access; in Dropbox, an app folder (“Apps/Kobrio”). With it, Kobrio creates a folder for each business, year and quarter, where it copies that quarter’s documents. Kobrio only searches your cloud for the folders and files it has created, to put each copy in its place, and only deletes any of them if you turn on deletion at the end of the retention period. Kobrio cannot see, read or modify the rest of your cloud, and it does not download the content of any file in it.
• Legal basis: performance of the contract (art. 6.1.b GDPR), because these are features of the service that you ask for.

How we use this data and who we share it with

• Only to provide you with those two features and show you their status in the app.
• We do not use it for advertising or profiling, and we do not sell it.
• We do not use it to train artificial intelligence models, whether ours or third parties’, and we do not send it to AI providers.
• Nobody at Kobrio looks at it, unless you give us permission (for example, to give you support), when it is necessary for security or when required by law.
• We do not disclose or transfer it to third parties. It is only processed, on our behalf and under a contract that obliges them to protect it, by the providers essential for the service to work, such as the hosting of the app and the database (Railway, in the EU; see the table in section 5), and we would only disclose it to an authority if the law requires us to. Backup files go from Kobrio to your cloud and stay in your account.

How we store and protect it

• It is stored in our database, on servers in the European Union.
• The tokens each service gives us to act with your permission (access and refresh tokens) are stored encrypted. We never receive or store your password for those services.
• Communications with those services are encrypted, and backups are made by the Kobrio server, in the background.

How long we keep it and how to disconnect

• You disconnect it yourself, from Kobrio, whenever you like. The account you sign in with, from Profile and security, under “Google account” or “Microsoft account”; your cloud, from My business › Backups, with “Disconnect”. When you disconnect, we delete the tokens we store for that service (and, for backups, the list of files copied) and, where the service allows it (Google and Dropbox), we ask it to revoke the permission. You keep signing in with the email link and your second factor. If your Kobrio account is deleted, its links are deleted with it.
• Until you disconnect, we keep this data to provide the feature to you. Files already copied stay in your cloud; they are yours and you can delete them whenever you like. While it is connected, Kobrio only deletes backups from your cloud if you turn on deletion at the end of the retention period you choose (from 4 to 10 years), and it notifies you 30 days in advance.
• You can also revoke Kobrio’s permission from your account settings in each service (in Google, at myaccount.google.com/permissions; in Microsoft, at account.live.com/consent/Manage or, with a work or school account, at myapps.microsoft.com; in Dropbox, under Settings › Connected apps). If you revoke your cloud’s permission this way, Kobrio stops copying and notifies you by email that the connection has failed.
• The audit log records when you link or unlink an account for signing in and when your cloud is connected (with the account’s email or name) or disconnected, for the audit log retention period given in section 3.
• You disconnect and delete this data yourself from Kobrio, as explained above. For any other request or question, write to us at privacidad@kobr.io.

Google data: Limited Use

The above applies to the data we receive from Google APIs when you sign in with Google and when you connect Google Drive. Kobrio’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Who we share data with

We do not sell or transfer your data. We only disclose it when required by law (for example, to the Agencia Tributaria, the Spanish Tax Agency) or when you ask us to, such as when you assign an adviser or send an invoice to your client. Issued invoices reach the AEAT (Spanish Tax Agency) through the certified provider, which acts on behalf of the issuer.

To provide the service we use the following providers, which process data on our behalf under a contract that obliges them to protect it:

The backups you save to your Google Drive, Dropbox or OneDrive go to your own account with that service, with which you have your own contract: they are your providers, not Kobrio’s sub-processors. Signing in with Google or Microsoft, saving backups to your cloud, or paying with Stripe means that those services also process your data in accordance with their own policies. Each issuer’s payment links use the issuer’s own Stripe account: the money goes directly to them and Kobrio does not receive it.

6. International transfers

The app, the database and the files are located in the European Union. Some providers (email, AI, Google, Microsoft and, in part, Stripe and the Cloudflare network) may process data outside the European Economic Area, mainly in the United States. For Cloudflare Turnstile, see the previous section. In all other cases the transfer is based on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework, for participating companies) or on standard contractual clauses approved by the Commission. You can ask us for more information about these safeguards.

7. Your rights

You can exercise the following rights at any time, free of charge:

• Access: to know what data about you we process.
• Rectification: to correct any data that is inaccurate.
• Erasure: to ask us to delete it when it is no longer necessary, unless a law requires us to keep it.
• Objection: to object to processing based on our legitimate interest.
• Restriction: to ask us to stop using it while a complaint is being resolved.
• Portability: to receive your data in a commonly used format.
• Withdraw your consent, where it is the basis for the processing, without affecting processing carried out before.

If you have an account, from Profile and security you can download a copy of your data and request deletion of your account. For anything else, write to us at privacidad@kobr.io stating which right you wish to exercise; you can also contact our Data Protection Officer at dpo@kobr.io. If we have reasonable doubts about your identity, we may ask you to prove it. We will reply within one month.

If you believe we have not handled your data properly, you can lodge a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency, www.aepd.es), although we would appreciate it if you told us first so that we can try to resolve it.

8. Security

We apply technical and organisational measures appropriate to the risk: invitation-only access, mandatory second factor, encrypted traffic, encrypted integration credentials, private files with expiring links, servers in the EU and a log of support access. You can read more in Privacy and security.

9. Minors

Kobrio is a service for professionals and businesses. It is not intended for people under 18.

10. Changes to this policy

If we change this policy, we will publish the new version here with its date and, if the change is significant, we will notify you by email or in the app before it applies.