Privacy policy

Updated: 18 October 2026

Lue suomeksi · Website privacy and cookies · Delete your account and data

This policy covers the tulos.ai web application, iOS and Android apps, customer relationships and enquiries. It explains what personal data we process, why we use it and how you can exercise your rights.

1. Controller and contact details

Blackreef Oy (Finnish Business ID 3555182-2), the provider of tulos.ai, is referred to as “tulos.ai”, “we” or the “Service Provider”. Our address is Hitsaajankatu 6, 00810 Helsinki, Finland. For privacy questions and requests concerning your rights, contact personal_data@tulos.ai.

2. Our roles in processing personal data

We act as a controller when processing personal data needed for user accounts, contracts, billing, customer relationships, support, security, service administration and the development of our own business.

When a Customer uses tulos.ai to process its accounting, invoicing, payroll, banking or other financial administration records, the Customer or its designated accounting firm is generally the controller and tulos.ai acts as a processor. Separate data processing terms may also apply.

3. Who this policy covers

This policy primarily covers representatives of Customers, prospective Customers and partners; administrators and other users; billing, contract and support contacts; and people who contact us about demonstrations, sales or support.

If your data appears only in a Customer’s accounting records or other material stored in the service, the Customer or its designated accounting firm is generally the controller. Requests concerning your rights should first be directed to that Customer.

Cookies and visitor measurement on our public website are covered by our website privacy policy.

4. Personal data we process

As a controller, we process:

Names, email addresses, telephone numbers, roles, language and other contact details.
Company or organisation names, Business IDs, billing and contract details, and order history.
Account details, login and authentication information, and access roles.
Customer communications, enquiries, support requests and feedback.
Service usage, device information, logs, security events, cookies and other technical identifiers.

On a Customer’s behalf, the service may also process:

Accounting records, supporting documents, receipts, purchase and sales invoices, VAT and tax return information, and reports.
Contact and identification details of customers, suppliers, employees and other business partners, to the extent the Customer stores them in the service.
Payment, account coding, payroll, cost centre and other financial administration data.
Bank account identifiers, balances, transactions, reference numbers, payer and payee details, and technical connection metadata when the Customer enables a banking integration.

Receipt images and other attachments may contain personal data. We process images and files you submit as part of the financial administration records. If you use your mobile device’s camera or select files, device permissions are managed in the operating system settings. Revoking a permission does not delete material already submitted.

5. Sources of personal data

We mainly receive data from the Customer, a user or another authorised representative during registration, ordering, onboarding or the customer relationship; material uploaded to or integrated with the service; banks and account servicing providers when a user authorises a bank connection; public registers, authorities or other reliable sources where needed to provide the service, verify information or meet legal obligations; and usage logs, analytics and security information generated by service use.

6. Purposes and legal bases

Accounts and service delivery: creating accounts, onboarding, managing access and providing the service. Processing is based on a contract or steps before entering into a contract when you are a contracting party. For business Customers’ representatives, it is based on our legitimate interest in delivering the service and managing the relationship.
Customer relationships: support, billing, service communications and contract administration, based on a contract and, where applicable, our legitimate interest in managing customer relationships.
Customer records: processing accounting, banking and other financial administration material on the Customer’s behalf under its instructions, the service agreement and applicable data processing terms. The Customer determines the legal basis as controller.
Bank connections: connecting accounts, retrieving balances and transactions, reconciliation and accounting automation when enabled. This is based on delivering the contracted service and the authorisation and consent required by the bank or connection provider.
Security: logging, preventing misuse and fraud, investigating incidents and maintaining service quality, based on our legitimate interest in protecting the service and, where applicable, legal obligations.
Legal obligations: our own accounting, taxation and responses to legally binding authority requests.
Service development: analysis, testing, statistics and product improvement, based on our legitimate interest in developing the service. We use anonymised or aggregated data where possible.
Direct marketing and newsletters: where permitted, based on consent or legitimate interest depending on the communication and applicable law.

Without information needed for a contract or legal obligation, we may be unable to provide the service. Providing information on the basis of consent is voluntary. Optional analytics and campaign cookies on our public website are based on consent.

7. Bank connections and Enable Banking

When a Customer enables a bank connection, tulos.ai may retrieve selected account balances and transactions through Enable Banking Oy (Finnish Business ID 2988499-7), our technical bank integration provider.

The user authenticates through a process approved by the bank or account servicing provider. Access is limited to the authorisation’s scope. Data is used for importing transactions, reconciliation, accounting automation, reporting and other features enabled by the Customer.

The Customer must ensure that it and its users are authorised to connect the account. A connection can be disconnected or authorisation withdrawn through the bank, service or customer support. Withdrawal prevents future retrieval. Imported data may remain in the Customer’s accounting records and audit trail as required by the agreement and applicable law.

8. Recipients of personal data

Where necessary, we may disclose data or provide access to:

Users, accounting firms and other parties authorised by the Customer.
Technology, hosting, storage, communications, analytics, OCR, AI, support and payment providers, and other subprocessors.
Enable Banking Oy where required for a bank connection.
Authorities, courts, insurers, auditors and advisers where required by law or a legitimate interest.
Parties to a corporate transaction, business sale or financing arrangement, subject to appropriate safeguards.

We do not sell personal data to third parties for their own marketing. Partners acting as our processors may process data only for agreed purposes under our instructions. We require appropriate data protection and security measures in our contracts with them.

9. Transfers outside the EU and EEA

We aim to process personal data primarily within the EU and EEA. Where a provider or technical solution involves transfers outside that area, we use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, or another transfer mechanism required by applicable law. Request further information and a copy of safeguards from personal_data@tulos.ai.

10. Retention

We retain data only as long as needed for the purposes described above. The period depends on the category:

Account, contract and billing data is retained during the customer relationship and afterwards where needed for contractual obligations, complaints, debt collection, accounting or legal obligations.
Support records and logs are retained as needed for support, security, audit trails and investigating misuse.
Accounting records, bank transactions and other financial administration material are retained according to the Customer’s instructions, the service agreement and applicable accounting and tax law.
Marketing data is retained until consent is withdrawn, marketing is objected to or the data is no longer needed.

11. Security

We use appropriate technical and organisational measures, including access management, passwords and strong authentication, logging, backups, protected data transmission and staff guidance. Access is limited to people who need the data for their work.

12. Your rights

Subject to applicable law, you may:

Obtain information about processing and access your data.
Request correction of inaccurate or incomplete information.
Request erasure or restriction of processing where the legal conditions are met.
Object to processing in certain circumstances, including direct marketing at any time.
Receive and transfer your data where data portability applies.
Withdraw consent for future processing where processing is based on consent.
Lodge a complaint with the Office of the Data Protection Ombudsman.

Send requests to personal_data@tulos.ai. We may ask for information needed to verify your identity. We normally respond within one month of receiving a request. If a request is complex or there are several requests, we may extend the deadline as permitted by law and inform you of the extension and reasons within one month.

Withdrawing consent does not affect earlier processing’s lawfulness. Further information about rights and complaints is available from the Office of the Data Protection Ombudsman. For Customer-controlled data, we may forward your request to the Customer or ask you to contact that controller directly.

13. Delete your account and personal data

You can request deletion of your tulos.ai account and associated personal data, including without using the app, by emailing personal_data@tulos.ai. Use the subject tulos.ai – account and data deletion and identify the email address linked to your account. Send the request from that address if possible. Do not send passwords or banking credentials.

Where needed, we verify your identity and authority to make the request. We delete the account and associated data that is no longer needed and has no other lawful basis for retention. Our response explains how deletion will be carried out and any data retained, together with the basis for retention. Response time limits are described in section 12.

Deleting an account does not automatically delete a company’s accounting records or data processed on behalf of another controller. Data needed for accounting, tax and contractual obligations or legal claims may be retained as long as that obligation or basis requires. Deletion of Customer-controlled records follows the controller’s instructions and applicable law.

14. Changes to this policy

We may update this policy as the service, legislation or processing practices change. The updated version is published on this page. We may also communicate material changes through the service or by email.