Privacy statement
Katsjing is about your bookkeeping, and that holds data about you and about your customers. Below you can read what we record, what for, who we bring in to help and how long we keep it. In plain language.
Last updated on 8 August 2026
Who to contact
Katsjing is a product of Whisper of Coding. For everything described below, Whisper of Coding is the party you can address.
- Company
- Whisper of Coding
- Product
- Katsjing
- Chamber of Commerce number
- 77565061
- Address
- Charlotte van Pallandtrade 15, 2907 MP Capelle aan den IJssel
- privacy@katsjing.nl
Two roles, and that difference shapes the rest
In accounting software two kinds of data sit side by side, and the law treats them differently.
For your account and your subscription we decide what happens: your name, your email address, your company details and your payments to us. For those we are the data controller, and this statement is the full explanation.
For everything you put into your bookkeeping, you decide what happens: your customer list, your invoices, your quotes, your receipts, your bank transactions. We store and process that data only because you use us for it. There we are the processor and you are the controller. For that role we enter into a data processing agreement with you.
What that means in practice: we do not look inside your bookkeeping, we use your data for nothing other than making Katsjing work, and we sell it to no one.
What data we process
Your account
Your name, your email address, your language preference and the moment you last signed in. You have no password with us: you sign in with a one-time code we send to your email address. So there is no password to leak either.
Your company details
The name, trade name, Chamber of Commerce number, VAT identification number, IBAN, address, phone number, website and logo you enter. If you enter a Chamber of Commerce number, we retrieve the matching company details and legal form from the Dutch Chamber of Commerce. That legal form determines whether you qualify for the sole trader rate.
What you put into your bookkeeping
Your contacts, invoices, quotes, products, purchase invoices and receipts, imported bank transactions, trips and assets. This also contains data about your own customers, such as their name, address and email address. For all of this we are the processor and you are the controller.
Your payment to us
The subscription runs through payment provider Mollie. You enter your bank or card number at Mollie and it never reaches our systems: we see the amount, the status and at most the last digits of your account number. For our own bookkeeping we record which subscription you had when, and what you paid for it.
Support and contact
If you send a support message, it lands together with your name and email address in a closed ticket system at GitHub, where we answer it. Attachments you send come along. If you use the contact form on the site, we receive your name, email address and message by email.
Technical data
To keep Katsjing running and to prevent abuse we process data such as your IP address, your browser type and error messages. One place deliberately records more: when someone accepts a quote through the link you emailed, we store the signer's name, timestamp, IP address and browser. That is the evidence of the agreement.
What we use it for, and why we may
Every processing operation has a purpose and a legal basis under the GDPR. We use these four.
To be able to deliver Katsjing
Creating your account, keeping your bookkeeping, sending invoices and quotes, sending reminders, processing payments. Without this data there is no service. Legal basis: performance of the contract.
Because the law requires it
We have to keep our own sales records for seven years, under article 52 of the Dutch General Tax Act. That is why exactly one line survives a deleted administration: which subscription was taken and what was paid for it. Legal basis: legal obligation.
To keep the service safe and working
Troubleshooting, security, preventing abuse and spam, and contacting you about an outage or an important change. Legal basis: legitimate interest, using as little data as possible each time.
With your consent
Statistics on the use of the public website, and integrations with other services that you switch on yourself. You can withdraw that consent at any time. Legal basis: consent.
What we do not do
We do not build profiles of you, sell your data to anyone, show advertisements or rent out your email address. Nor are decisions taken about you based solely on automated processing that produce legal effects for you.
Who we bring in
Katsjing does not run in a vacuum. These parties process data for us, and no more than what they were brought in for. We have a data processing agreement with each of them.
| Party | What for | Processed in |
|---|---|---|
| Supabase | Database, sign-in and file storage: this is where your bookkeeping lives. | Germany |
| Vercel | Hosting: serving the website and the app. | EU, company in the US |
| Resend | Sending and receiving email: sign-in codes, invoices, reminders and forwarded supplier invoices. | EU and US |
| Mollie | Your subscription payment, plus online payment and direct debit for your own customers if you switch that on. | Netherlands |
| Microsoft Azure | Reading the receipts and purchase invoices you upload or forward. | EU |
| GitHub | Support messages in a closed, non-public environment. | US |
| Google Analytics | Visitor statistics on the public website. | US |
| Kamer van Koophandel | Looking up company details and legal form for a Chamber of Commerce number. | Netherlands |
| PDOK | Address suggestions in the mileage log. | Netherlands |
| OpenRouteService | Calculating the distance between two addresses. | Germany |
| Storecove | Sending e-invoices over the Peppol network, if you use it. | Netherlands |
Transfers outside the European Union
Your bookkeeping is stored in Germany and does not leave the EU. A few of the parties above are American. For those transfers we rely on the EU-US Data Privacy Framework and, where that does not apply, on the European Commission's standard contractual clauses.
How long we keep it
Your account
For as long as you have an account. If you cancel and ask for deletion, we delete it.
Your bookkeeping
You delete it yourself, in the settings. It is locked immediately and a 30-day grace period follows in which you can still undo it. After that everything is erased irreversibly: invoices, contacts, files. We have no button to bring it back.
Our own sales record
Exactly one line survives a deleted administration: which subscription was taken and what was paid for it. That is our own bookkeeping and we have to keep it for seven years.
Support and contact
We keep support messages for as long as they are still useful in helping you further, and no more than two years after that. Messages sent through the contact form we keep for at most a year.
Technical logs
A few months at most, and only for troubleshooting and security.
Mind your own retention obligation
Your bookkeeping carries a retention obligation of seven years, and ten years for data on immovable property. We keep nothing for you after deletion. So first download the full export waiting on that same page: a ZIP with all your data and files.
How we secure it
Security is not a layer on top here but part of the design itself.
- Every administration is shielded from other administrations in the database itself, not only in the application code. A mistake in one layer therefore does not immediately expose data from another administration.
- The customer portal has its own, independent shielding: a customer of yours can only reach their own documents.
- All traffic is encrypted, and the data is stored encrypted at rest.
- Keys for connected services, such as your Mollie connection, are stored separately encrypted and are tied to your administration.
- You sign in without a password, with a one-time code by email.
- A log entry remains for every financial action and every send, so that afterwards it can be traced what happened.
Complete certainty does not exist. If you suspect a leak or see something that is not right, report it through the contact form. We take that seriously, and we are grateful for it.
Your rights
Under the GDPR you have a number of rights. For the data we are responsible for, you can exercise them with us.
- Access
- You may know what data we hold about you and receive a copy of it.
- Rectification
- If something is wrong, you correct it. Most of it you already do yourself in your profile and your settings.
- Erasure
- You delete your bookkeeping yourself. For your account you can ask us to do it, except where the law obliges us to keep something.
- Restriction and objection
- You can object to processing based on legitimate interest, or ask us to pause the processing temporarily.
- Portability
- You do not even have to ask: under Settings an export of your entire bookkeeping is waiting, as a ZIP with readable files. That is yours to take to another package.
- Withdrawing consent
- Consent you have given, you withdraw again at any moment. What happened before that remains lawful.
Send your request through the contact form, or through the support page if you are signed in. We respond within a month. To avoid handing data to the wrong person, we may ask for an extra confirmation.
Is your question about data held in a business owner's bookkeeping, for example because you received an invoice from someone who uses Katsjing? Then contact that business owner. There we are the processor and we may not intervene in their bookkeeping on our own initiative.
Not satisfied?
If you think we handle your data carelessly, tell us first. We would rather solve it together. If we cannot work it out, you can file a complaint with the Dutch Data Protection Authority.
Changes
When Katsjing changes, this statement changes along. The date at the top says when we last updated it. For a significant change we let you know in the app or by email.