Privacy

What we keep

When you use Wasli, the following is stored:

• Your account details, which you enter when signing up (such as email and name), handled by Clerk.
• Your company name and country, which you enter after first sign-in.
• The files you upload (invoices and receipts), the fields read from them, your edits, and the review and approval state.
• Bank statements you upload and their transactions (account number and IBAN are kept masked in the extracted data; the original file stays as uploaded), API keys (only a hash is kept), workspace members and invites, expense claims, trips and exchange rates you enter, and your subscription data.

Who processes your data

Wasli relies on outside services, each with its own terms and policy. Review them before uploading sensitive documents.

• Clerk: sign-up, sign-in, sessions and passwords.
• Convex: the database, file storage and background jobs. Your documents and the extracted data are stored there.
• Anthropic: the documents and bank statements you upload are sent to Anthropic's API so an AI model can read them and extract the fields.
• Stripe: payments, subscriptions and invoices, when you subscribe to a paid plan.

Where data is stored and for how long

We have not yet chosen a hosting region, and we have not set retention periods for documents. Each document has a change history, and there is no workspace-wide audit log. We will write hosting and retention here once they are decided, after legal review of the data-protection laws in the countries we serve.

What you can do

• Only you and the workspace members you invite can see your documents.
• A user with the accountant or owner role can delete a document permanently unless it is being read or is on an expense claim. The file and extracted data are removed from the server, one line (id, action, time) without values stays in the change history, and this cannot be undone.
• A user with the accountant or owner role can export approved documents to Excel or CSV.
• Deleting the whole account is not available in the app yet; the way to request it will be announced on the contact page once there is one.

Reading with AI

An AI model reads your documents, and it can be wrong. That is why every document goes through your review before approval. We have not verified the providers' terms on whether content may be used to train models, so please check them yourself.

What is not written yet

Until legal review, this draft is missing: the name and details of the party responsible for the data, the legal basis for processing, retention periods, the hosting location, your rights and how to use them, and how security incidents are reported. We will not present any of these before they are written and reviewed.