Privacy Policy & Data Protection
Last Updated: 29 October 2026. How SoloTreasury handles personal data under the General Data Protection Regulation (GDPR).
1. Your Workbook Records
Unlike cloud-based accounting platforms that store your client lists, invoices, bank balances, and revenue numbers on third-party multi-tenant databases, SoloTreasury does not store your workbook records on its own servers.
- When you download the Excel file, your data is stored wherever you save that file.
- When you use a Google Sheets copy, your data is stored in your own Google account and processed by Google under your Google terms.
- The bound script downloads public European Central Bank rate files and does not send your records to SoloTreasury. SoloTreasury cannot see your workbook unless you share it with us.
2. Data Controller Identity & Responsibilities
For the purposes of the General Data Protection Regulation (GDPR – Regulation (EU) 2016/679):
- Aspecterra Limited acts as the Data Controller for your product delivery, digital license fulfillment, customer communication, and support inquiries.
- Lemon Squeezy, LLC acts as an independent Data Controller for your checkout billing, payment processing, fraud prevention, and statutory tax invoicing data.
3. Information Collected & GDPR Legal Bases
We process personal data only when an applicable legal ground under Article 6(1) of the General Data Protection Regulation (GDPR) exists. The table below details what we collect, our operational purpose, and the corresponding legal basis:
| Category & Source | Processing Purpose | GDPR Legal Basis |
|---|---|---|
| Name & Email Address Provided at checkout |
Generating and sending your digital spreadsheet copy links, setup guides, and v1.x tax updates. | Art. 6(1)(b) GDPR Performance of a contract |
| Billing Country & VAT ID Collected via Lemon Squeezy |
Calculating EU OSS VAT and issuing statutory tax receipts and accounting records. | Art. 6(1)(c) GDPR Legal / tax compliance |
| Waitlist & Starter Kit Inquiries Entered in profile qualifier or Lite kit form |
Notifying you when support for your country or tax regime is released, and delivering starter kit resources. | Art. 6(1)(a) GDPR Explicit opt-in consent |
| Cyprus Numbers Report & Partner Introduction Entered in the Cyprus numbers calculator (cyprus-at-your-numbers) |
Cyprus numbers report and partner introduction (the calculator on the page cyprus-at-your-numbers). We process your name and email address; the figures you type into the calculator (profit, country, share of profit lost to tax, pay mix, exemption, domicile, residency, fees) and its results; your consent choices with their time; and the page you came from (UTM parameters and click IDs, as for other forms). Recipients and processors: Resend (email delivery and contact storage); Upstash (a counter per email address for one hour, to limit repeated requests). If you ask for an introduction, we send your contact details and report figures to one licensed Cyprus accounting firm or administrative service provider, which processes them as an independent controller and is named to you before it contacts you. We may receive a fee from that firm if you become its client. Retention: as for waitlist and starter kit inquiries; the introduction consent is stored with your contact. | Art. 6(1)(b) GDPR Performance of a contract (sending the report you asked for) / Art. 6(1)(a) GDPR (your separate consent for the introduction to a licensed Cyprus firm and for updates; you can withdraw it at any time) |
| Update-notice Registration Entered in the Register for Updates form |
Update-notice registration: if you register a copy bought on a marketplace (Etsy, Eloquens, Upwork, Fiverr), we store your email, edition, language, the platform and the order number in Upstash Redis (EU) and in Resend so we can confirm the order against the platform's sales report and email you when an update or fix for your edition is released. We keep this until you unsubscribe, or 12 months after the edition is retired. The optional tips-and-offers consent is separate. | Art. 6(1)(b) GDPR Performance of a contract (update notices) / Art. 6(1)(a) GDPR (optional tips and offers) |
| Advertising Click Identifiers & Campaign Attribution URL query parameters (fbclid, gclid, msclkid, UTM tags) stored in browser storage |
Measuring advertising campaign effectiveness, attributing traffic sources, and preserving promotional referral context when submitting waitlist or starter kit forms. | Art. 6(1)(f) GDPR Legitimate interest (ad performance) / Art. 6(1)(a) GDPR (opt-in lead submission) |
| Pseudonymous Analytics Google Analytics 4 client ID |
Measuring site performance and interaction trends. Blocked by default until consent. | Art. 6(1)(a) GDPR Prior consent (TDDDG § 25) |
| Marketing & Conversion Pixel Meta Pixel (Meta Platforms Ireland Ltd.) |
Measuring advertising effectiveness, tracking conversion funnels (checkout starts, purchases, Lite starter kit registrations), and optimizing ad campaigns on Facebook and Instagram. Blocked by default until explicit consent. | Art. 6(1)(a) GDPR Prior consent (TDDDG § 25(1)) |
| Google Advertising Signals Google Consent Mode (Google Ireland Ltd.) |
Measuring which Google ads lead to visits, checkout starts and purchases, and building advertising audiences (remarketing) in Google Ads. Switched on together with the Meta Pixel when you enable Marketing; blocked by default. | Art. 6(1)(a) GDPR Prior consent (TDDDG § 25(1)) |
| Server & Security Logs Cloudflare edge network |
DDoS protection, rate limiting, and blocking malicious traffic. | Art. 6(1)(f) GDPR Legitimate interest (security) |
Checkout reminder emails
When you enter your email address in the order form, we store it together with the product you chose, your tax profile, the page language and the marketing parameters of your visit (UTM values and advertising click IDs) in our email service (Resend) and in our order queue (Upstash Redis). If you tick the reminder box, we send you up to three emails about your unfinished order over the following days. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time through the unsubscribe link in every email. If you do not tick the box, we send nothing: the record is kept only to avoid duplicate entries and is deleted automatically after 30 days unless you complete a purchase. Completing the purchase ends the reminders. Lemon Squeezy, our reseller, receives your email address when the checkout opens so you do not have to type it again.
Payment Security: Payment card numbers and sensitive financial information are handled exclusively by Lemon Squeezy, LLC under PCI-DSS Level 1 compliance. SoloTreasury and Aspecterra Limited never receive, process, or store your card or bank details.
4. Data Retention Schedule
We adhere to strict data minimization principles and retain personal data only for as long as necessary to fulfill the purposes for which it was collected or to comply with statutory legal requirements:
- Commercial & Tax Records (Invoices): Retained by our Merchant of Record for 6 to 10 years in accordance with mandatory statutory tax laws (such as § 147 AO / § 257 HGB in Germany and Cypriot fiscal accounting requirements).
- License Fulfillment & Support Records: Your order identifier and email address are retained for the duration of your perpetual v1.x license to verify purchase eligibility, process support inquiries, and deliver product updates. You may request erasure at any time, which terminates access to future updates.
- Waitlist Subscriptions & Campaign Attribution: Retained until you click "unsubscribe" in any notification or request deletion, after which your email and associated attribution properties are permanently removed within 30 days. Cyprus numbers report leads are kept like waitlist inquiries; the introduction consent and its time are stored with the contact.
- Advertising Click Identifiers & Campaign Parameters: Click identifiers (such as fbclid, gclid, msclkid) and UTM parameters stored in your browser's local/session storage persist until cleared in your browser settings or overwritten. If submitted with a waitlist or starter kit registration, they are retained alongside the contact record until unsubscribed or deleted.
- Google Analytics 4 Data: Pseudonymous user and event data is automatically purged after 2 months (the minimum configurable retention window in GA4).
- Meta Pixel Conversion Data: Pseudonymous event and conversion data transmitted to Meta is retained by Meta Platforms in accordance with their Data Policy, typically up to 180 days for conversion attribution and measurement.
- Google Advertising Data: With Marketing consent, Google may set advertising cookies (such as
_gcl_au, maximum lifetime 90 days) and keeps advertising measurement and audience data under its own retention policies. - Affiliate Referral Cookie: With Marketing consent, Lemon Squeezy may set the cookie
ls_aff_ref(maximum lifetime 60 days) to credit the affiliate whose link brought you here. It is not set if you decline Marketing. - Network & Security Logs (Cloudflare): Temporary IP routing logs are automatically overwritten or deleted within 30 days.
5. International Data Transfers & Sub-Processors
To provide global content delivery, automated order dispatch, and payment processing, certain technical infrastructure is hosted with service providers in third countries outside the European Economic Area (EEA), primarily the United States:
- Cloudflare, Inc. (USA): Reverse proxy, CDN, DNS, and DDoS mitigation. Certified under the EU-U.S. Data Privacy Framework.
- Resend, Inc. (USA): Transactional email dispatch for product download links, waitlist contact records, campaign attribution properties, and checkout reminder emails. Governed by European Commission Standard Contractual Clauses (SCCs).
- Upstash, Inc. (USA): Serverless order and delivery queue, reminder scheduling, waitlist datastore, and a per-address counter for the Cyprus numbers report form. Protected via SCCs and TLS encryption in transit and AES-256 at rest.
- Lemon Squeezy, LLC (USA): Merchant of Record and payment gateway. Governed by their Data Processing Addendum incorporating SCCs. It receives your email address when the checkout opens, so you do not have to type it again.
- Google Ireland Limited / Google LLC (USA): Google Analytics 4 (only activated upon prior affirmative consent) and, only with Marketing consent, Google advertising measurement and audiences in Google Ads. Google LLC is certified under the EU-U.S. Data Privacy Framework.
- Meta Platforms Ireland Limited / Meta Platforms, Inc. (USA): Meta Pixel advertising measurement and conversion attribution (only activated upon prior affirmative consent). Certified under the EU-U.S. Data Privacy Framework.
Where personal data is transferred outside the EEA, transfers are safeguarded under either the European Commission Adequacy Decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR) or standard data protection clauses adopted by the Commission (Standard Contractual Clauses - Art. 46(2)(c) GDPR), supplemented by end-to-end transport layer encryption.
6. Your Statutory Rights Under the GDPR
Under the General Data Protection Regulation (Regulation (EU) 2016/679), you possess the following enforceable statutory rights:
- Right of Access (Art. 15 GDPR): You have the right to obtain confirmation as to whether your personal data is being processed and receive a copy of your transactional records.
- Right to Rectification (Art. 16 GDPR): You have the right to request the correction of inaccurate personal data or update outdated email contact details.
- Right to Erasure / "To Be Forgotten" (Art. 17 GDPR): You may request deletion of your email address and delivery logs, subject to statutory tax retention periods.
- Right to Restriction of Processing (Art. 18 GDPR): You have the right to request restriction of processing while a data contestation or complaint is under review.
- Right to Data Portability (Art. 20 GDPR): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
- Right to Object (Art. 21 GDPR): You may object at any time to processing based on legitimate interests under Art. 6(1)(f) GDPR.
- Right to Withdraw Consent (Art. 7(3) GDPR): Where processing is based on consent (such as cookies or waitlist emails), you may withdraw your consent at any time with immediate effect.
- Right to Lodge a Complaint (Art. 77 GDPR): You have the statutory right to lodge a complaint with a supervisory authority in your EU member state of habitual residence, workplace, or place of the alleged infringement.
To exercise any of these rights, please email our data team at: support@solotreasury.com.
7. Cookie & Tracking Technologies Policy
In compliance with the EU ePrivacy Directive (Directive 2002/58/EC as amended), the General Data Protection Regulation (GDPR), and Section 25 TDDDG (Germany), SoloTreasury uses local storage and cookies strictly in accordance with user consent choices.
Categories of Cookies Used:
Vital for site security, session maintenance, checkout completion, and saving your cookie consent preferences. Under GDPR Art. 6(1)(f) and Section 25(2) TDDDG (Germany), these do not require prior consent because the platform cannot function securely without them.
With your prior affirmative consent (GDPR Art. 6(1)(a) and TDDDG § 25(1)), we use Google Analytics 4 to collect aggregated, pseudonymous metrics on page interactions, session duration, device types, and approximate geographic location. Google Analytics is completely blocked by default and does not load or emit any network requests until you explicitly click "Accept All Cookies" or enable Analytics in the Cookie Preferences panel. If you reject non-essential cookies, no Google Analytics script or network requests will execute. If you grant consent and subsequently complete an order, your pseudonymous client identifier may be passed to Lemon Squeezy to correlate order completion and refund events without sending your name or email.
With your prior affirmative consent (GDPR Art. 6(1)(a) and TDDDG § 25(1)), we use the Meta Pixel (provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) to evaluate the reach of our advertisements, measure conversion actions across our checkout and purchase flow as well as the Lite starter kit registration, and optimize our campaign delivery on Facebook and Instagram. The Meta Pixel is completely blocked by default and does not execute or transmit any data until you explicitly grant consent by clicking "Accept All Cookies" or enabling Marketing in the Cookie Preferences panel. If you reject non-essential cookies, no Meta Pixel script or network requests will execute. Data collected may be processed by Meta Platforms, Inc. in the United States under the EU-U.S. Data Privacy Framework. If you have granted Marketing consent, our server also reports the matching conversion events (a completed purchase or a Lite starter kit registration) to Meta through the Meta Conversions API, using a hashed email address, hashed name, your IP address, browser user agent and, where present, the Meta click identifier. Without Marketing consent, no such server-side event is sent.
The same Marketing consent also covers Google advertising (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When you enable Marketing, we tell Google through Google Consent Mode that advertising cookies and the use of your data for advertising are allowed (ad_storage, ad_user_data and ad_personalization set to "granted"). Google can then use the Google Analytics data from your visit to measure which Google ads led to visits, checkout starts and purchases, and to include you in advertising audiences (remarketing) in Google Ads; Google may set advertising cookies such as _gcl_au. This only applies if you have also enabled Analytics, because the Google tag loads only with Analytics consent. Purchase and refund events that our server sends to Google Analytics carry the same choice. Without Marketing consent these signals stay "denied" and no data is used for Google advertising. Data may be processed by Google LLC in the United States under the EU-U.S. Data Privacy Framework.
Affiliate referrals (Lemon Squeezy): The same Marketing consent also covers our affiliate programme, run through Lemon Squeezy, LLC. If you reach our site through an affiliate's link, a script from Lemon Squeezy sets the cookie ls_aff_ref containing the referring affiliate's identifier, so that a purchase you make within the attribution window (60 days) is credited to that affiliate. The cookie holds no personal data about you and is not set without Marketing consent. When you buy, the identifier is passed to Lemon Squeezy with your order.
When you click an advertisement or promotional link on external platforms such as Meta (Facebook/Instagram), Google, or Microsoft (Bing), the platform may append advertising click identifiers (such as fbclid, gclid, msclkid) and standard campaign tracking parameters (UTM parameters such as utm_source, utm_medium, utm_campaign, utm_creative, utm_term) to the landing page URL. SoloTreasury reads these URL query parameters and temporarily stores them in your browser’s local storage (localStorage) and session storage (sessionStorage) to preserve source attribution across page navigation. If you voluntarily submit a waitlist inquiry or request the starter kit, these parameters are transmitted to attribute your lead source and record marketing performance in Resend without setting third-party cross-site cookies or running invasive ad tracking pixels. You can remove these stored values at any time by clearing your browser cache and local storage.
Managing & Revoking Consent:
You can review, modify, or revoke your cookie choices at any time by clicking the Cookie Preferences link on this page or in the footer. You may also purge stored cookies through your browser settings.