Privacy Policy

This policy explains what personal data we hold when you use CORA, why we hold it, who else processes it, and what you can ask us to do with it. We have kept it in plain language.

1. Two kinds of data

Your account data. The details of the business that subscribes to CORA and the people who log in: company name and address, registration and tax numbers, names, email addresses, passwords (stored only as an irreversible hash), two-step verification settings, and a record of sign-ins. For this data we are the controller.

Your bookkeeping data. Everything you put into your administration: bank transactions, invoices, receipts, and the details of your customers and suppliers. Some of that is personal data about other people — a customer's name and address, for instance. That data is yours; we process it on your instructions in order to provide the software. For this data you are the controller and we are your processor.

2. Why we hold it

• To provide the service — reading your statements and documents, matching transactions, producing your reports and sending your invoices. This is necessary to perform our agreement with you.
• To bill you — issuing subscription invoices and recording payments.
• To keep the service secure — detecting misuse, limiting sign-in attempts and keeping an audit trail of changes. This is our legitimate interest in running a safe service.
• To support you — answering your questions, which sometimes means looking at your administration when you ask us to.
• To meet legal obligations — keeping our own accounting records.

We do not sell your data. We do not use your bookkeeping data to advertise to you, and we do not use it to train artificial intelligence models.

3. Documents you upload

When you upload an invoice or a receipt, CORA turns it into a bookkeeping entry for you. Part of that work runs at a specialist provider, listed in the table below. That provider sees the document and returns a result; it is not allowed to keep the document for its own purposes and it is not used to train anyone's models. If you would rather type your documents in by hand, ask us and we will switch the automatic handling off for your administration.

4. Bank connections

A bank connection is only ever made with permission you give yourself, through a licensed provider. We receive the transactions on the accounts you select, and nothing else — we never see or store your online banking password. You can withdraw permission at any time, in CORA or at your bank.

United States banks — Plaid. If you connect a US bank account, the connection is made through Plaid Inc. By using this feature you grant CORA and Plaid the right to access and transmit information from your financial institution: account and balance information, account and routing numbers, account holder contact details, transactions, and account statements. We use that information only to keep your bookkeeping up to date, as described in this policy. Plaid's handling of your information is governed by the Plaid End User Privacy Policy. You can see which apps you have connected through Plaid, and disconnect them or ask Plaid to delete your data, at my.plaid.com.

European banks — Ponto. Connections to European banks run through Ponto (Ibanity, part of Isabel Group), a licensed European provider, under the same principle: you choose the accounts, we receive the transactions on those accounts, and you can withdraw the permission at any time.

If you prefer not to connect a bank at all, uploading statements works just as well.

4a. Payment links on your invoices

If you switch payment links on, your invoices carry a link and a QR code that your customer can pay through Sentoo. The agreement with Sentoo is yours, the money goes to your own account, and we never hold it. Per payment we pass on what a payment needs: the amount, the currency, your invoice number and the name of the customer paying it. Sentoo tells us whether the payment succeeded, and CORA marks the invoice as paid.

When you ask us to arrange a Sentoo account for you, the company details and the documents you upload for it are attached to a single email straight to Sentoo, with you as the reply address. We do not keep those documents. They are not stored in our database or our file storage; the moment that email is sent they are gone on our side, and only the file names remain in our audit trail.

4b. Fax for US tax post

Some filings to the IRS still go by fax. If your plan includes it, we send and receive those faxes through a telecom provider on your behalf. What travels is the document being filed and the fax numbers involved.

5. Who else processes your data

We use a small number of providers to run CORA. Each of them is bound to process data only on our instructions and to keep it secure.

We will update this list when it changes. Beyond these providers, we share data only when the law requires it, or when you ask us to — for example when you give your accountant a login.

6. Where your data is kept

Your administration is stored on servers in the United States. If you are in the European Union or another region with data-transfer rules, that means your data leaves your region. Where those rules apply, transfers are made under the European Commission's Standard Contractual Clauses or an equivalent safeguard.

7. How long we keep it

• While you are a customer: for as long as your account is active.
• After you cancel: at least ninety days, so you can still ask for a copy. After that we may delete your administration.
• Our own invoices to you: for as long as tax law requires us to keep our accounts.
• Security logs: up to twelve months.

8. Keeping it safe

• All traffic is encrypted in transit.
• The documents you upload are encrypted before they are stored, and can only be read back through your own login.
• Every upload is scanned for malware before it is accepted.
• Passwords are stored only as an irreversible hash; we cannot read them.
• Bank tokens and other secrets are encrypted before they are stored.
• Each administration is strictly separated from every other one, in the database itself and not only in the software.
• Two-step verification and passkeys are available on every account — and required for anyone on our side who can reach customer data — with every change recorded, who made it and when.

No system is perfect. If a breach occurs that puts your data at risk, we will tell you without undue delay and explain what happened.

9. Your rights

Depending on where you live, you can ask us for a copy of your personal data, to correct it, to delete it, to limit what we do with it, or to object to a particular use. You can also ask for your data in a portable form — most of it you can export from CORA yourself at any time.

Email sales@cora.financial and we will answer within thirty days. If your request concerns bookkeeping data belonging to one of our customers, we will pass it on to them, because that data is theirs and not ours to hand over.

If you are in the European Union and think we have handled your data badly, you may complain to your national data protection authority.

10. Cookies and advertising

Inside the software itself we use only the cookies it needs to work: one to keep you signed in, one to remember which administration you are looking at, one to remember whether you prefer light or dark mode, one to remember your cookie choice, and short-lived ones used during sign-in. There is no advertising or tracking of any kind inside your bookkeeping. What you do with your figures is nobody else's business, and that is not a setting.

On our public website — the pages you can read without signing in — we ask permission for two more things, and neither of them runs until you say yes:

Until you choose, none of these are loaded at all: the scripts are not in the page, so there is nothing to block. You can change your mind at any time with Cookie settings at the bottom of every page, and we ask again after six months. Refusing costs you nothing — the website works exactly the same.

11. Children

CORA is business software and is not intended for anyone under 18.

12. Changes

If we make a material change to this policy we will tell you by email or inside the software before it takes effect. The date at the top always shows the current version.

13. Contact

Questions about your privacy? Email sales@cora.financial, or write to OSM Enterprises LLC, 9501 Satellite Blvd, Suite 105, Orlando, FL 32837, United States. Our Terms of Service explain the rest of the agreement.