PRIVACY POLICY

Aourly AB | Last updated: 2026-03-17

1. Data Controller

Aourly AB ("Aourly", "we", "us") operates the Aourly platform for time tracking, expense management, invoicing and financial administration aimed at consultants and consulting companies. This privacy policy describes how we collect, use, store and protect your personal data in accordance with the EU General Data Protection Regulation (GDPR, Regulation 2016/679) and supplementary Swedish legislation, including the Swedish Data Protection Act (2018:218).

2. Roles: Data Controller and Data Processor

Responsibility for your personal data varies depending on your relationship with Aourly:

Aourly as Data Controller: We act as the data controller when we determine the purpose of the processing. This applies, for example:

• When you register as a solo consultant and use Aourly for your own business.
• When we process your data for invoicing, payment, customer service or marketing of our services.
• When we collect website statistics via Google Analytics (with your consent).
• When we manage your account information and authentication.

Aourly as Data Processor: We act as a data processor when we process personal data on behalf of our customers (consulting companies). The consulting company is then the data controller and is responsible for having a lawful basis for the processing of its consultants' data. We process such data in accordance with the instructions in our Data Processing Agreement (DPA) with the consulting company.

3. Personal Data We Process

3.1 Account information

• First and last name, email address, date of birth
• Password (stored in hashed form, never in plain text)
• Onboarding data (completed steps during registration)

3.2 Swedish identity data

• National identity number (personnummer), collected via BankID authentication
• The data is stored with soft deletion for traceability

3.3 Company information

• Company name, organisation number, VAT registration number
• Email address, telephone number
• Address, postal code, city, country code
• Company logo

3.4 Client and customer data

• Contact details: name, email address, invoice email, telephone number
• Company details: organisation number, customer number, VAT registration number
• Address, postal code, city, country code
• Contact person

3.5 CV data

• Title, summary
• Work experience (title, company, start/end dates)
• Education (institution, field of study, dates)
• Skills, languages, locations

3.6 Bank account details

• IBAN, BIC, Bankgiro, Swish number (at company level)
• Account number and clearing number (encrypted, for Worknode users)

3.7 Time tracking and expenses

• Time entries with hours, hourly rate, comments and approvals
• Expenses with category, amount and participants
• Receipts (file uploads with metadata: file name, size, MIME type)

3.8 Invoicing and bookkeeping

• Invoices, payments, bookkeeping vouchers
• Payment terms and invoicing history
• SIE4 export data

3.9 Mobile devices

• Device ID (uniquely generated per device)
• Push tokens (Firebase Cloud Messaging and Expo)
• Device information (platform, version, model)
• Timestamp for most recent activity

3.10 Notification preferences

• Notification settings per user and company
• Timestamps for activation and deactivation, and method
• Record of who changed the setting

3.11 Activity and audit data

• Activity logs recording changes to client, assignment, expense and notification data (who changed what and when)

3.12 Authentication data

• Session cookies and tokens
• BankID authentication data
• API tokens (Sanctum) for the mobile app
• One-time codes for mobile login

3.13 Company documents

• Liability insurance and general terms and conditions (PDF uploads)
• Document metadata: file name, size, MIME type, activation status

4. Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR Article 6(1):

Where we rely on legitimate interest (Art. 6(1)(f)), we have carried out balancing assessments to ensure that our interests do not override your fundamental rights and freedoms. You may request information about these assessments by contacting our Data Protection Officer.

5. Third-Party Providers (Sub-processors)

We use the following third-party providers (data processors) to operate the platform. All processors are bound by data processing agreements in accordance with GDPR Article 28.

When transferring personal data to countries outside the EU/EEA (primarily the USA), we rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses (SCCs) adopted by the European Commission, in accordance with GDPR Articles 44–49.

6. Cookies and Session Data

6.1 Cookies

Aourly uses necessary cookies as well as statistics cookies that require consent.

Session data is stored in the database (not in the cookie). Cookie consent is managed via a banner with the option to accept all, reject all, or manage settings per service.

6.2 Local Data Storage in the Mobile App

Aourly's mobile app (React Native/Expo) stores the following data locally on your device via encrypted storage (expo-secure-store):

This data remains on your device and is not shared with third parties. It is cleared when you log out.

7. Retention Periods

We retain personal data only for as long as necessary for the purposes for which it was collected, or for as long as required by law:

Once the retention period has expired, data is deleted or anonymised. Certain data may be retained in anonymised form for statistical purposes.

8. Mobile App

Aourly's mobile app is a React Native/Expo application that primarily functions as a WebView wrapper for the web platform.

Data collected by the mobile app:

• Device ID (generated locally, stored encrypted on the device)
• Push notification tokens (Firebase Cloud Messaging) — transmitted to the server upon registration
• Device information (platform, model, version) — sent during push token registration

Error tracking:

• Sentry is used for crash reporting with an EU data centre (ingest.de.sentry.io)
• No personally identifiable information (PII) is sent by default
• Session recording with masking of images and visible text (for debugging)
• Performance monitoring with 10% sampling in production

Device permissions:

The mobile app does not request access to the camera, microphone, GPS or contacts. You can revoke the push notification permission via your device settings.

9. Your Rights as a Data Subject

Under GDPR Articles 15–22, you have the following rights regarding your personal data:

9.1 Right of access (Art. 15)

You have the right to request a copy of the personal data we hold about you, together with information about how it is processed.

9.2 Right to rectification (Art. 16)

You have the right to request correction of inaccurate or incomplete personal data. You can update most account details directly in the platform.

9.3 Right to erasure (Art. 17)

You have the right to request deletion of your personal data, subject to statutory archiving requirements (e.g. bookkeeping records that must be retained for 7 years).

9.4 Right to restriction of processing (Art. 18)

You have the right to request restriction of processing under certain circumstances, for example when you contest the accuracy of the data.

9.5 Right to data portability (Art. 20)

You have the right to receive your personal data in a structured, commonly used and machine-readable format. Bookkeeping data can be exported in SIE4 format via the platform. Other data portability requests are handled by our Data Protection Officer — contact support@aourly.com.

9.6 Right to object (Art. 21)

You have the right to object to processing based on legitimate interest (Art. 6(1)(f)). We will cease the processing unless we can demonstrate compelling legitimate grounds.

9.7 Right to withdraw consent (Art. 7(3))

If our processing is based on your consent, you have the right to withdraw it at any time. This does not affect the lawfulness of processing carried out before the consent was withdrawn. You can, for example, withdraw cookie consent via the settings in the cookie banner.

9.8 Right not to be subject to automated decision-making (Art. 22)

Aourly does not use automated decision-making or profiling that produces legal effects or similarly significantly affects you. CV parsing with AI is solely a tool and does not result in automated decisions.

How to exercise your rights

Contact our Data Protection Officer:

• Email: support@aourly.com
• Telephone: +46 70 740 07 54
• Post: Aourly AB, Attn: Data Protection Officer, Frejgatan 4 bv, 114 20 Stockholm, Sweden

We will respond to your request within 30 days. If we need more time (up to an additional 60 days for complex requests), we will inform you within the initial 30-day period.

Supervisory authority

If you are not satisfied with our response, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY):

• Website: https://www.imy.se
• Email: imy@imy.se
• Address: Integritetsskyddsmyndigheten, Box 8114, 104 20 Stockholm, Sweden

10. Security Measures

We take appropriate technical and organisational measures to protect your personal data in accordance with GDPR Article 32:

• Password security: Bcrypt hashing algorithm (12 rounds)
• Encryption of sensitive data: Bank account details are encrypted at rest
• Transport encryption: All data is transmitted via HTTPS/TLS
• Session security: HttpOnly cookies with SameSite=lax, database-stored sessions
• CSRF protection: Token-based protection against cross-site request forgery
• Identity data: National identity numbers are deleted upon account removal (soft deletion for traceability)
• Access control: Role-based access control per company (multi-tenancy with global scope isolation)
• Backups: Encrypted backups to AWS S3 (EU region) with separate short-term and long-term schedules
• Audit logs: Spatie Activity Log tracks changes to critical data models
• Error tracking: Sentry configured without PII by default; EU data centre

11. Changes to This Policy

We may update this privacy policy. Material changes will be notified at least 30 days in advance via email or a notification in the Service. The "Last updated" date at the top of this document indicates when the policy was last revised.

12. Contact Details

For questions about this privacy policy or our processing of personal data, contact:

Aourly AB Attn: Data Protection Officer (Tommie Lagerroos) Frejgatan 4 bv, 114 20 Stockholm, Sweden Email: support@aourly.com Telephone: +46 70 740 07 54 Organisation number: 559515-8774

TERMS OF SERVICE

Aourly AB | Effective from: 2026-03-17

1. Parties

These Terms of Service ("the Terms") are entered into between:

• Aourly AB, organisation number 559515-8774, with address Frejgatan 4 bv, 114 20 Stockholm, Sweden (hereinafter "Aourly", "we", "us" or "our"), and
• you as the user (hereinafter "the User", "the Customer" or "you").

By registering for, logging in to, or otherwise using Aourly's services, you accept these Terms.

2. Definitions

3. About the Service

Aourly provides a platform for consultants and consulting companies with the following core features:

• Time tracking — recording and managing time entries per assignment
• Expense management — recording expenses with receipts and approval workflows
• Invoicing — generating and managing invoices based on time reports and expenses
• Client management — managing client registers and contact persons
• Assignment management — creating and managing assignments with tasks and work items
• Bookkeeping — integration with accounting systems (Fortnox, Visma eAccounting), voucher management and SIE4 export
• CV management — creating and managing competency-based CVs with the option of AI-assisted parsing
• Company verification — verification of company and identity information via Roaring and BankID
• Open banking — bank account aggregation via Enable Banking
• Notifications — email and push notifications via the mobile app
• Worknode — umbrella company model (see section 11)

4. Registration and User Account

4.1. To use the Service, you must register an Account and provide correct and complete information. Registration is done with email and password, and can be supplemented with BankID verification for identity confirmation.

4.2. You are responsible for ensuring that your login credentials (password, BankID or API tokens) are kept secure and not shared with unauthorised persons. You are solely responsible for all activity that occurs under your Account.

4.3. The Service uses a multi-tenancy system where Users can belong to one or more companies with assigned roles (administrator or user). Company administrators are responsible for managing their users' access.

4.4. You must be at least 18 years of age to register an Account and use the Service.

4.5. Aourly reserves the right to refuse registration or suspend Accounts in the event of suspected fraud, breach of these Terms or other unauthorised use.

5. Use of the Service

5.1. You may only use the Service for its intended purposes and in accordance with these Terms and applicable law.

5.2. You may not use the Service in a manner that:

• a) Is unlawful, fraudulent or misleading.
• b) Infringes the intellectual property rights or privacy of others.
• c) Contains malicious code (viruses, trojans, etc.).
• d) Disrupts the functionality or security of the Service, or overloads our systems.
• e) Uses the Service to send unsolicited email (spam) or similar communications.
• f) Attempts to circumvent the Service's access controls or data isolation systems.

5.3. You are responsible for ensuring that Content you upload to the Service is lawful, accurate and that you have the right to process it.

6. Licences and Pricing

6.1. Aourly offers various licence models with different features and pricing, including the option for custom logos and CV functionality depending on the licence level. Licences are assigned per company with a certain number of seats. Current prices and terms are available on Aourly's website.

6.2. Prices are stated in Swedish kronor (SEK) excluding VAT, unless otherwise indicated.

6.3. Trial periods may be offered. During the trial period, you have access to the Service's features according to the chosen licence model. After the trial period ends, an active subscription is required for continued access.

6.4. Aourly reserves the right to change prices and licence models. Notice of price changes will be given at least 30 days before the changes take effect. If you do not accept the price change, you have the right to terminate your Account in accordance with section 15.

7. Payment Terms

7.1. Primary payment method: Payment is made via Stripe. By accepting these Terms, you also accept Stripe's terms of service. Payment data (e.g. card numbers) is handled directly by Stripe and is never stored by Aourly.

7.2. Alternative payment method — Invoice via Fortnox:

• a) For certain licence models or by special arrangement, payment may be made via invoice handled through Fortnox.
• b) Invoicing takes place in advance for the chosen licence period and the invoice is sent to the email address provided during registration.
• c) Payment terms for invoices are 10 days from the invoice date, unless otherwise agreed in writing.
• d) In the event of late payment, default interest and reminder fees will be charged in accordance with law. Aourly reserves the right to suspend or restrict access to the Service in the event of non-payment.
• e) Aourly may carry out a credit check before invoice payment is approved.

7.3. Advance payment: Aourly reserves the right, in individual cases or for specific licence models, to require full or partial advance payment. Information about any advance payment will be clearly communicated before the relevant service is activated.

7.4. Aourly reserves the right to choose the available payment methods.

8. Intellectual Property Rights

8.1. All copyright, patents, trademarks, trade secrets and other intellectual property rights in the Service belong to Aourly AB or its licensors. You may not copy, modify, distribute, sell or otherwise exploit any part of the Service without Aourly's written consent.

8.2. The User retains ownership of Content that they upload to the Service. By using the Service, you grant Aourly a worldwide, royalty-free, non-exclusive licence to use, store, process and display your Content to the extent necessary to provide the Service to you and in accordance with these Terms and our Privacy Policy.

8.3. When using AI-powered CV parsing (via OpenAI), this is solely a tool. Aourly makes no claims to the generated content and you are responsible for reviewing and approving the result.

9. Personal Data Processing (GDPR)

9.1. Aourly processes Personal Data in accordance with our Privacy Policy. The Privacy Policy describes how we collect, use, store and share your Personal Data and your rights under the GDPR.

9.2. Aourly's role as Data Controller or Data Processor:

• a) When you as a Consulting company use the Service to manage your consultants, you are the Data Controller and Aourly is the Data Processor. A Data Processing Agreement (DPA) is included in your agreement with Aourly.
• b) When you as a Solo consultant use the Service to manage your clients and your own business, you are the Data Controller for the data you upload about your clients, and Aourly acts as Data Processor on your behalf.
• c) For certain processing of Personal Data (e.g. invoicing you as a User, account administration and web analytics), Aourly is the Data Controller.

9.3. You are responsible for having a lawful basis for all Personal Data processing that you initiate via the Service, including informing data subjects and, where necessary, obtaining consent.

9.4. Cookie consent: The Service uses a cookie consent banner that gives you the option to accept or reject statistics cookies (Google Analytics). Necessary cookies (session, CSRF protection) do not require consent.

10. Third-Party Service Integrations

The Service integrates with the following third-party services. These services have their own terms of service and privacy policies.

10.1. Connection to third-party services (e.g. Fortnox, Visma) is made via OAuth authorisation that you actively initiate. You can disconnect an integration at any time.

10.2. When disconnecting a bookkeeping integration, you may choose to export your data in SIE4 format before data is cleared.

10.3. Aourly is not responsible for the functionality, security or personal data processing of these third-party services. Your use of third-party services is at your own risk.

11. Worknode-Specific Terms

The following terms apply specifically to Users who utilise Aourly's Worknode service (umbrella company model).

11.1 Description

Worknode is an umbrella company model where consultants carry out assignments under a parent company that is administered via Aourly's platform. The Worknode company invoices clients and handles salary, tax and pension for the consultant.

11.2 Application and approval

Applications to join Worknode undergo an approval process. Aourly reserves the right to approve, reject or discontinue a Worknode connection based on an assessment of the consultant's profile and the nature of the assignment. Possible statuses include pending, approved, rejected and suspended.

11.3 Financial terms

• a) Worknode plans include settings for income tax and pension contributions.
• b) An invoicing fee is applied in accordance with the current Worknode plan.
• c) Revenue sharing is documented via the platform.
• d) The payout method (e.g. salary or invoice) is configured per consultant.

11.4 Personal data

Worknode users provide additional personal data beyond that of standard users, including:

• Bank account number and clearing number (stored encrypted)
• Personal address, postal code and city
• Income tax rate and pension percentage
• Payout method

11.5 Terms acceptance

Worknode users must accept specific Worknode terms. The time of acceptance and terms version are recorded in the system. Updated terms may require renewed acceptance.

11.6 Support tickets and communication

Communication between Worknode users and administrators takes place via an integrated ticket system with messaging and the ability to attach files.

11.7 Change requests

Changes to Worknode settings (e.g. tax rate, pension, payout method) are made via a formal change request that is reviewed and approved by administrators.

11.8 Suspension

Aourly reserves the right to suspend a Worknode connection, stating the reason. Upon suspension, the User is informed and any ongoing matters are handled in accordance with the applicable agreement.

12. User's Responsibilities

12.1. You are responsible for the accuracy and completeness of all information you provide to Aourly or upload to the Service.

12.2. You shall comply with all applicable laws and regulations when using the Service.

12.3. You are responsible for notifying Aourly immediately if you suspect unauthorised access to your Account.

12.4. As a Consulting company, you are responsible for having a lawful basis for the processing of your consultants' personal data in the Service and for informing them in accordance with the GDPR.

12.5. You are responsible for any company documents (liability insurance, general terms and conditions) that you upload to the Service and for ensuring that these are current and accurate.

13. Aourly's Liability and Limitation of Liability

13.1. Aourly endeavours to ensure that the Service is available and functions correctly, but does not guarantee uninterrupted or error-free operation. Planned downtime for maintenance will be notified in advance.

13.2. Aourly is not liable for damage arising from:

• a) Incorrect use of the Service by the User.
• b) Unauthorised access to the Account due to the User's negligence.
• c) Third-party service functionality or errors (see section 10).
• d) Loss of data due to force majeure.
• e) Inaccuracies in data obtained from third parties (e.g. Roaring, BankID, accounting systems).

13.3. Aourly's total liability for damage arising under this agreement shall, unless otherwise required by mandatory law, be limited to the amount the User has paid for the Service during the preceding twelve (12) months.

13.4. Aourly is not liable for indirect damages, consequential damages, lost profits or lost data, unless otherwise required by mandatory law.

14. Changes to the Service and the Terms

14.1. Aourly reserves the right to modify or update the Service and its features at any time.

14.2. Aourly reserves the right to amend these Terms. In the event of material changes, you will be notified at least 30 days in advance via email or a notification in the Service. If you do not accept the new Terms, you have the right to terminate your Account in accordance with section 15.

14.3. Your continued use of the Service after the changes have taken effect constitutes acceptance of the amended Terms.

15. Termination and Suspension

15.1. Termination by the User: You may terminate your Account by contacting Aourly's support (support@aourly.com), in accordance with the applicable notice periods for your licence model. Paid fees are normally non-refundable.

15.2. Termination or suspension by Aourly: Aourly reserves the right to terminate or temporarily suspend your Account in the event of:

• a) Breach of these Terms.
• b) Non-payment.
• c) Suspected fraud or unlawful activity.
• d) Technical problems or security reasons.

15.3. Data upon termination: Upon termination of the Account, Aourly will process your Content and Personal Data in accordance with our Privacy Policy and applicable legislation:

• Bookkeeping records are retained for 7 years under the Swedish Bookkeeping Act.
• Other data is deleted within 30 days of the account being closed.
• You are responsible for exporting your Content (e.g. SIE4 export of bookkeeping data) before termination.

16. Governing Law and Dispute Resolution

16.1. These Terms shall be interpreted in accordance with Swedish law.

16.2. Disputes arising from these Terms shall in the first instance be resolved through negotiations between the parties. If a resolution cannot be reached, the dispute shall be settled by the general courts of Sweden, with Stockholm District Court as the court of first instance.

17. Contact Details

If you have questions about these Terms or the Service, contact:

Aourly AB Frejgatan 4 bv, 114 20 Stockholm, Sweden Email: support@aourly.com Telephone: +46 70 740 07 54 Organisation number: 559515-8774