Legal
GDPR & UK GDPR Rights
This document is provided as-is and is not legal advice. Consult counsel before relying on it.
Last updated 2026-06-14. This supplement describes the rights of EEA and UK data subjects under GDPR and UK GDPR.
Roles
Pocket-CFO acts as a data processor with respect to your company's accounting data that you sync through the service, processing it solely on your instructions to operate the product. Pocket-CFO acts as a data controller with respect to account profile information, authentication data, and billing records, which we collect and use for our own purposes to provide the subscription. Business customers who are controllers of their employees' or clients' data may request a Data Processing Addendum by contacting privacy@rippre.com.
Lawful bases
We process account profile and billing data on the basis of contract performance, as it is necessary to deliver the subscription you have purchased. We process accounting and operational data on the basis of our legitimate interests in operating and improving a reliable finance product, balanced against your interests and rights. We rely on consent for analytics cookies and similar tracking technologies, which you may withdraw at any time. We process security, tax, and billing records on the basis of legal obligation.
Rights of data subjects
If you are located in the EEA or UK, you have the right to access the personal data we hold about you, the right to rectify inaccurate data, the right to erasure in certain circumstances, the right to restriction of processing, the right to data portability in a structured machine-readable format, the right to object to processing based on legitimate interests, and the right to withdraw consent at any time without affecting the lawfulness of prior processing. Submit requests to privacy@rippre.com.
Transfers, retention, and complaints
Personal data may be transferred to and processed in countries outside the EEA or UK where our service providers operate, including the United States. We rely on standard contractual clauses or equivalent safeguards approved by the relevant supervisory authority for such transfers. We retain data for the periods described in our Privacy Policy. You have the right to lodge a complaint with your local supervisory authority, including the UK Information Commissioner's Office, the Irish Data Protection Commission, or the equivalent authority in your country.
