Privacy Policy

The data controller is Invoid Vision B.V., a Belgian limited company registered in the Crossroads Bank for Enterprises (KBO/BCE) under number 0777.887.045, with registered office at Balegemstraat 17/7, 9860 Oosterzele, Belgium.

Privacy contact: support@dokus.tech

Invoid Vision B.V. is the controller for the personal data it collects to operate dokus.tech and your account. For the personal data contained in the financial documents you upload, you (or your company) are the controller and Dokus is the processor acting on your documented instructions. When your account closes, we delete or return customer documents and personal data at your choice, unless Belgian accounting legislation obliges us to retain specific records — the two situations are described separately under "How long we keep data".

A Data Processing Agreement forms part of the Terms of Service and applies to every workspace. It sets out what we process, on whose instructions, and how data is returned or deleted when the relationship ends. A copy you can sign is available on request.

Read the data processing agreement

We only collect personal data we need to run dokus.tech and the Dokus product. The exact data depends on how you use the service:

• Account & contact data: name, email address, company name, role, country, and (for accounting firms) firm details you submit through the apply-accountant form.
• Waitlist & subscriber data: email address, selected plan, language preference, and the source page that led you to sign up.
• Customer-uploaded content: invoices, receipts, bank statements, credit notes and similar financial documents you submit to the product. These can contain personal data about you, your colleagues, your customers, and your suppliers.
• Usage & device data: pages viewed, clicks, referrer, language, approximate location derived from IP, browser and operating system, and timestamps. Collected via PostHog (EU) and Vercel Web Analytics with anonymised IPs.
• Support data: the content of any message you send to support@dokus.tech, via our contact form, or via our WhatsApp and Telegram support chats.
• Company look-ups: the company name or VAT number you type on a Company ID page that has no company (dokus.tech/id/…), the address you arrived at, and the site that referred you. It tells our team which companies are looking for a page; it is not published, and no contact details are asked for.

We use personal data only for clearly defined purposes:

• To provide and operate the Dokus service: account creation, document ingestion, transaction matching, cash-flow overview, Peppol e-invoicing.
• To respond to waitlist sign-ups, accountant applications, contact-form messages, and direct emails.
• To improve the product: understand how features are used, debug issues, and prioritise fixes.
• To communicate with you: service updates, security notices, and (with your consent) product news.
• To comply with our legal obligations under Belgian and EU law, including bookkeeping, tax, and accounting record-keeping rules.

Each processing activity rests on one of these legal bases:

• Performance of a contract: to deliver the Dokus service you signed up for and to handle account-related communication.
• Legitimate interests: to keep the service secure, prevent abuse, measure aggregate usage, and improve the product. We balance these interests against your rights before relying on them.
• Consent: for optional marketing emails and non-essential analytics. You can withdraw consent at any time without affecting prior processing.
• Legal obligation: when EU or Belgian law requires us to retain or disclose specific records (for example, accounting records or lawful authority requests).

We rely on a small number of vetted third-party providers to run the service. Each sub-processor listed in the table below is bound by a data processing agreement and processes personal data only on our instructions. Separately, bank-feed synchronisation is provided by Ponto, a service of Isabel NV/SA (Belgium, enterprise number 0455.530.509), a payment institution authorised by the National Bank of Belgium as an account information service provider (AISP) under PSD2. Isabel NV/SA and the bank you connect act as independent controllers for the account and transaction data you authorise them to share with us: named recipients of your bank data, not sub-processors, so no data processing agreement applies to them. Their own privacy notices govern what they do with it (https://documentation.myponto.com/en/privacy-notice/v5.0). One model provider appears in this list. Documents are read and classified on infrastructure we operate in Belgium, and retrieval runs there too. When cloud document processing is enabled for the service, extraction and classification are performed by Anthropic instead. The optional Ask assistant sends your question, and the records needed to answer it, to Anthropic as well. Both uses are on our instructions, under a data processing agreement, with no training on your content. Our own processing terms for customers, the agreement under which Dokus processes your documents on your instructions, form part of the Terms of Service and apply to every workspace.

The Dokus application, including the documents you upload, is hosted in Belgium. Document reading, classification and retrieval run on infrastructure we operate there, unless cloud document processing is enabled, in which case Anthropic performs extraction and classification. Website and waitlist data, product analytics and Peppol transmission are processed within the European Union. Six sub-processors involve transfers outside the EEA: Slack, which receives the sign-up, contact-form and company look-up details contained in our internal alert notifications; Resend, which delivers our transactional email, including contact-form messages, account-deletion notices and document exports with the attached PDF; Vercel, which serves the dokus.tech website from a global edge network with EU regions; WhatsApp, which carries our support chat for quick questions; Telegram, which does the same; and Anthropic, which runs the models behind Ask and behind document extraction and classification when cloud processing is enabled, and receives your question and the records needed to answer it, plus document text in that case. Documents and client data always go by email, never by chat. All six transfers are covered by Standard Contractual Clauses (SCCs) and the additional safeguards the GDPR requires. We do not sell personal data, and we do not transfer it to advertisers.

We retain personal data only for as long as needed for the purpose it was collected, then delete or anonymise it.

• Waitlist and subscriber emails: until you unsubscribe, or up to 24 months of inactivity, whichever comes first.
• Accountant applications: up to 24 months after the application, or until the firm becomes a Dokus customer.
• Contact-form and support messages: up to 24 months after the conversation closes.
• Account and sign-in information: kept while your account is active, and deleted or anonymised when you close it, except where a legal obligation requires otherwise.
• Customer-uploaded financial documents: while your account is active. On closure, they are deleted or returned at your choice (GDPR Art. 28). Retention after closure happens only where Belgian accounting legislation obliges us to keep them — Belgian guidance indicates retention of up to 10 years for invoices and accounting documents — or where you have given documented instructions to keep them.
• Peppol transmission records: retained for the period required by the applicable invoicing legislation.
• Security logs: kept for a limited period proportionate to their security purpose.
• Backups: held on a regular rotation and deleted in line with the retention of the data they contain.
• Analytics and product-usage data: aggregated and retained for up to 24 months in PostHog and Vercel Analytics.

You can exercise the following rights at any time by emailing support@dokus.tech. We respond within 30 days.

• Right of access: confirm whether we hold your data and request a copy.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure: ask us to delete your personal data where the GDPR allows.
• Right to restriction: ask us to limit processing while a dispute is resolved.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent: for any processing that relies on consent.
• Right to lodge a complaint with a supervisory authority: see below.

We apply the technical and organisational measures appropriate for a financial product: encryption in transit (TLS), encryption at rest, role-based access controls, audit logging on production systems, least-privilege access for employees, and DPA-bound sub-processors. Access to customer-uploaded financial documents is restricted to a small number of authorised personnel, and only when needed for support, security, or compliance.

Dokus uses strictly necessary cookies for authentication and security, and a limited set of analytics cookies (PostHog, Vercel Analytics) to understand how the site is used. We do not use advertising cookies. For full detail and how to manage your preferences, see our Cookie Policy. This covers the public company pages (dokus.tech/id/…) as well, which a visitor may reach from an invoice or a link without seeing any other part of the site.

Cookie Policy

We do not make decisions that have legal or similarly significant effects on you based solely on automated processing. Dokus structures and classifies financial documents automatically, but those outputs are reviewed and validated by you (or your accountant) before being acted on.

Dokus is a business tool intended for adults. We do not knowingly collect data from anyone under 16. If you believe a minor has provided personal data to us, please contact support@dokus.tech and we will delete it.

We may update this policy when our practices change. The "Last updated" date at the top reflects the most recent revision. Material changes will be communicated by email to active users at least 14 days before they take effect.

Questions about this policy or how we handle your data? Email support@dokus.tech. Postal mail can be sent to Invoid Vision B.V., Balegemstraat 17/7, 9860 Oosterzele, Belgium.

If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données).

gegevensbeschermingsautoriteit.be