Privacy policy
Last updated: 3 November 2026
This policy explains how Siffer Systemer AS processes personal data when you visit siffer.no, use the Siffer app, connect Siffer to an AI tool through MCP, or use the Siffer API. It covers all of these parts of the service.
Who is responsible
Siffer Systemer AS (org. no. 923 344 101), Stortingsgata 28, 0161 Oslo, Norway, is the controller for the data described in this policy. Send questions about privacy to kontakt@siffer.no.
Two roles: controller and processor
Siffer has two different roles, depending on the data:
- Siffer is the controller for data about you as a user and contact person: your user account, sign-in, the customer relationship, billing for the subscription, support, visits to the website and messages to us.
- Siffer is a processor for the accounting data our customers enter or import into Siffer, such as vouchers, bank transactions, customers and suppliers, employees and payroll. For that data, the company that owns the accounts is the controller. We process it only to deliver the service on the customer’s instructions, as described in the data processing agreement (in Norwegian). If you have questions about data about you in a company’s accounts, for example as an employee or supplier, contact that company.
What we process, and why
| What | Examples | Purpose | Legal basis |
|---|---|---|---|
| User account | Name, email, phone, password (stored as a one-way hash, never in plain text), two-factor settings, roles and which companies you can access | Give you access to the service and control who sees what | Contract (GDPR Art. 6(1)(b)) |
| Customer relationship and billing | Company, billing address, contact person, subscription, payment status, card payments through a payment provider | Deliver and bill the subscription and follow up payments | Contract and legal obligation under the Norwegian Bookkeeping Act (Art. 6(1)(b) and (c)) |
| Usage and security logs | IP address, time, sign-in attempts, which features and MCP or API tools were used, error reports from the app | Operations, troubleshooting, security and abuse prevention | Legitimate interest in a secure and stable service (Art. 6(1)(f)) |
| Messages | What you write in the contact form, chat and email | Answer you and follow up | Legitimate interest, or contract when you are a customer (Art. 6(1)(f) and (b)) |
| Website visits | Cookies and technical information from your browser | Make the website and chat work | Legitimate interest, and consent where the law requires it (Art. 6(1)(f) and (a)) |
| Updates from us | Email about the service, new features and guides | Help you use Siffer | Legitimate interest towards existing customers. You can unsubscribe at any time |
We do not sell personal data, and we do not use it for advertising aimed at you.
Automatic reading of vouchers
When a voucher is uploaded or sent to the company’s inbox, Siffer reads it automatically to suggest a posting. This uses text recognition and language models in Amazon Web Services in the EU. The model providers do not get access to the documents, and the documents are not used to train models. A suggestion only becomes a posting when a user approves it.
AI tools through MCP and API
You can connect Siffer to an AI tool you choose, such as Claude from Anthropic or ChatGPT from OpenAI, or to another system through the Siffer API. The tool then reads data from Siffer with the same access as your user, and only when you ask it to.
- Siffer never sends anything to an AI tool on its own.
- What you bring into the AI tool is processed there under the terms of the provider you chose. That provider is not Siffer’s processor. Check that this use fits your data processing agreements and duty of confidentiality.
- You sign in with your Siffer user, and your password never reaches the AI tool. The sign-in lasts up to 30 days. If you lose access to a company in Siffer, the AI tool loses it too.
- Siffer logs which tools are used, for which company and when, but not your conversation with the AI tool.
Who we share data with
We use these providers to run the service. They process data on our behalf under a data processing agreement.
| Provider | What they do for us | Where |
|---|---|---|
| Amazon Web Services | Servers, database, file storage, incoming and outgoing email, text recognition and reading of vouchers | EU (Stockholm and Ireland) |
| Netlify | Hosting of the siffer.no website and its contact form | USA |
| HubSpot | Chat on the website and customer support | USA |
| TrackJS | Error reports from the app | USA |
| Stripe | Card payment for the subscription | EU (Ireland) and USA |
| Email and internal spreadsheets for following up customers and subscriptions | EU and USA | |
| Slack | Internal alerts about new customers and payments | USA |
When data is transferred to countries outside the EU/EEA, we rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
When the customer asks for it, Siffer also exchanges data with services the customer connects. These include banks (through Enable Banking and Aiia), Folio, eFaktura and EHF, and public bodies such as the Norwegian Tax Administration and Altinn for VAT returns, payroll reporting and year-end filings. That data belongs to the customer’s accounts, and Siffer acts on the customer’s behalf.
We may also disclose data when the law requires it.
How long we keep data
- User account and customer relationship: as long as the account or agreement lasts. After the agreement ends, we delete or anonymise the data, except what we must keep under the Bookkeeping Act, such as invoices to you (five years).
- Accounting data: as long as the customer has an agreement with us. When the customer deletes data, we may keep a copy for up to one year to prevent accidental loss, as the terms describe. The customer can ask for permanent deletion before then.
- Logs: up to 30 days.
- Sign-in for MCP and API: up to 30 days after the last renewal.
Security
Data is always sent encrypted and stored with Amazon Web Services in the EU. Passwords are never stored in plain text. Access to each company is checked on every request, including requests from AI tools and the API. You can turn on two-factor sign-in. Only the people at Siffer who need it to run the service or help you have access.
Your rights
You have the right to access the data we hold about you and to have errors corrected. You can ask for deletion, restriction or data portability, and you can object to processing based on legitimate interest. If you have given consent, you can withdraw it. Email kontakt@siffer.no and we will answer within one month.
If it concerns data in a company’s accounts, we forward your request to that company, which is the controller.
If you believe we process data in breach of the rules, you can complain to the Norwegian Data Protection Authority, Datatilsynet.
Cookies
Read more about cookies in the cookie policy.
Changes
We update this policy when the service or our providers change. The date at the top shows the latest change. We notify customers by email of significant changes.