Privacy Policy
Version 1, in force from 2026-10-03
The Swedish version governs if the two differ.
Diffa is provided by Sliti & Klay Group AB, reg. no. 559524-2891, Remigatan 41, SE-261 45 Landskrona, Sweden. In this policy Sliti & Klay Group AB is “Diffa” or “we”. Questions about personal data go to support@diffa.se.
The policy applies to you who use Diffa, you who visit diffa.se and you who register interest. It also describes how we handle data found in the bookkeeping data we process for our customers.
1. As little as possible
Diffa stores as little as possible. Two things decide: what the bookkeeping needs and what your account needs.
About your customers we store nothing personal. When a payout or an order arrives from a platform we remove names, addresses, e-mail, phone and card details before anything is stored. What remains is what the bookkeeping needs: the platform’s ids, amounts, currency, country and VAT. That applies to Stripe, PayPal, Shopify and Paddle. Klarna and Kustom deliver nothing personal at all.
About you as a user of Diffa we store only what the account needs:
- your e-mail address
- the name your sign-in provides (Google, Microsoft or Fortnox), which you can change or remove
- a technical sign-in id
- your company’s registration number, which for a sole trader is a personal identity number
- if you come through Fortnox: your Fortnox user id and the e-mail address Fortnox states
- what you write to support yourself
- technical logs with time and IP address, cleared after at most twelve months
- the log of our own support access (section 6), kept for twelve months.
For billing we process company name, registration number, VAT number, billing address, e-mail address for invoices and payment history. We never see card details. They exist only at Stripe. If you buy Diffa through Fortnox or Shopify, the platform bills you. We then receive only the company’s id, registration number and which plan was bought. Invoice records are kept for seven years under the Swedish Bookkeeping Act, since they are our own accounting records.
2. We do not sell your data
We never sell, rent out or share personal data or customer data for anyone else’s purposes. We do not use them for advertising. We profile no one.
The only ones that receive data from us are subprocessors that process it on our behalf, the platforms or accounting systems you connected yourself and authorities when the law requires it.
3. When Diffa is the controller
For the data about you as a user of Diffa, for billing and for diffa.se we decide ourselves how the data is processed. Then we are the controller.
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| Account and sign-in | e-mail, name, sign-in id, role in the company | the agreement with your company | 90 days after the agreement ended |
| Billing | company name, registration number, VAT number, address, e-mail for invoices, payment history | the agreement, the Bookkeeping Act | seven years after the end of the financial year |
| Support | what you write to us, your e-mail | legitimate interest in helping you | 24 months after the case |
| Invitations | the e-mail address invited | the agreement with the inviting company | until the invitation is used or expires |
| Registration of interest on diffa.se | e-mail, which page, time | your consent, which you withdraw with an e-mail | until we have opened and e-mailed you, at most twelve months |
| Technical logs | time, IP address, which page or function | legitimate interest in security and troubleshooting | at most twelve months |
| Support access log | who at Diffa, when, which company | legitimate interest in traceability | twelve months |
| E-mail from the service | recipient, subject, delivery status | the agreement | 30 days at the provider |
4. When Diffa is the processor
Your bookkeeping data we process only on your instructions. Then your company is the controller and Diffa the processor. What we may do is in the data processing agreement, which applies as part of the agreement with you.
After the minimisation in section 1, the bookkeeping data in practice holds only company data: the platforms’ ids, amounts, country, VAT and the accounting system’s vouchers. If you sell to sole traders or private individuals, an id or a country can still be personal data. That is why the data processing agreement applies to everything.
If you are an accounting firm, we process the client companies’ data on the firm’s instructions. The client company is the controller, the firm the processor and Diffa the subprocessor.
5. Ask Diffa
Ask Diffa is an optional help function. If you use it, your question is sent to OpenAI in the USA to get an answer.
What is sent is the status of the checks you are working on, Diffa’s own account suggestions, the VAT code catalogue and the accounts you chose per source. What is never sent is names, registration numbers, amounts or keys. No history is kept: every question stands alone. The transfer to the USA is made under the EU Commission’s standard contractual clauses.
If you do not use the function, nothing is sent to OpenAI.
6. Sign in as customer
We may need to see your company’s view in Diffa to help you. We do that only in a support case or at your request. The access is logged with who, when and which company. It is visible in the service while it lasts. We change nothing in your books that way.
7. Sign-in through Fortnox and requests from Shopify
If you come through Fortnox we read your personal Fortnox consent once. It tells us who you are, which company it concerns and whether you may work with the bookkeeping there. The access key is not stored. What is stored is your Fortnox user id, name and e-mail, so that we recognise you next time.
Shopify may send us requests about a customer’s data or about deletion. We answer them automatically: we hold no personal data about the store’s customers to hand out or delete. The request is logged without personal data.
8. Where your data lives
Bookkeeping data and material are stored in Sweden, at Google Cloud in Stockholm.
- E-mail from the service is sent through Resend from Ireland.
- Sign-in is handled by Google (Firebase). Account data such as e-mail and name may be stored outside the EU.
- Ask Diffa uses OpenAI in the USA, as described in section 5.
- diffa.se is delivered by Cloudflare, with nodes in the EU for visitors in the EU.
Transfers outside the EU are made under the EU Commission’s standard contractual clauses. The full list with function, location and transfer basis is on the page Subprocessors. Changes are announced 30 days in advance.
9. How long
Account data is deleted 90 days after the agreement ended. Material behind vouchers is kept until 31 December of the eighth year after the voucher’s year, so that you can meet your archiving duty also after you stop using Diffa. Other periods are in the table in section 3.
10. Your rights
You have the right to know which data we hold about you, to have it corrected, deleted or moved, to restrict the processing and to object to it. Write to support@diffa.se and we answer within a month.
If the question concerns bookkeeping data we process for a company, we refer you to that company, which is responsible for it.
We make no automated decisions about you. If you are unhappy with how we process your data, you can complain to the Swedish Authority for Privacy Protection (IMY).
11. If Diffa changes owner
If the Diffa business is taken over by another company, the personal data follows to the new controller, on the same terms as here. We inform you before such a business transfer takes effect.
12. Changes and contact
If we change the policy in a way that affects you, we announce it in the service or by e-mail. The current version is always on diffa.se with version and date.
The controller is Sliti & Klay Group AB, reg. no. 559524-2891, Remigatan 41, SE-261 45 Landskrona, Sweden. Contact: support@diffa.se.