Privacy Policy

Welcome to Okidoky. We attach great importance to the protection of your personal data. In this privacy policy, we transparently explain which data we collect, for what purpose, how we protect it, and what rights you have under the General Data Protection Regulation (GDPR).

We do not process your data because you use Okidoky or read this policy, but only where the GDPR provides a legal basis: to perform our agreement with you (your account, your ledger and payments), because the law requires us to (for example, keeping invoices), because we have a legitimate interest (such as security, preventing misuse and service messages), or because you give consent (such as for analytics and advertising cookies). Section 4 lists the legal basis for each purpose. Where we ask for consent, we do so separately; you can withdraw it at any time, and anything that happened before remains lawful.

We only collect data that is necessary for providing our Service:

Your data is processed based on the following legal bases and purposes:

We only share data with the following parties, insofar as necessary:

• Mollie B.V. — payment processing (only for paid subscriptions)
• Hosting provider — IONOS SE (Germany): the server that runs the app, the database and our own mail server
• Email — we send email through our own mail server on that server, not through an external email service. An email to you does, of course, pass through your own email provider.
• OpenAI (US) — we use OpenAI’s gpt-4o-mini AI model for three things. (1) If you have Premium and scan a receipt, the photo first goes to OpenAI to read the amount, date, shop and product lines; with a free account the receipt is read in your browser. (2) With a Premium CSV bank import, the descriptions of the newly imported transactions (which may contain the name of the other party) and the names of your categories go to OpenAI so Okidoky can suggest a category. (3) If you receive the newsletter, also with a free account, you get a personal monthly overview at the start of each month; for this, only your total income and expenses for that month, the difference with the previous month and your three largest spending categories (name and amount) go to OpenAI, which writes a short summary. Your name, email address and account number are not sent; we add the greeting with your name ourselves. Unsubscribing from the newsletter stops that overview.
• Authorities — only if we are legally obligated to do so

Parties that process personal data on our behalf should have a data processing agreement with us. For our hosting provider IONOS, according to IONOS this agreement is part of its general terms and conditions (since July 2022); we are still checking that this also applies to our contract. With the other parties, we are still reviewing and formalising these arrangements. Once that is done, we will update this text.

We take appropriate technical and organizational measures to protect your data:

We do not retain your personal data longer than necessary:

• Active account: data is retained as long as you have an active account
• After account deletion: all data is permanently deleted within 30 days
• Registration logs: IP addresses are retained for a maximum of 30 days
• Statistics: our own statistics (page views, events and visits, including the IP address) are deleted after 90 days, session summaries after 180 days; statistics for ads on the site (impressions and clicks, including the IP address to prevent double counting) after 365 days
• Backups: automatic backups follow a Grandfather-Father-Son rotation: 14 daily + 8 weekly + 12 monthly backups are kept. After account deletion your data disappears from the backups once the last backup containing it has been replaced; with this rotation that takes about 12 months.
• Legal obligation: if legally required, certain data may be retained longer

Under the General Data Protection Regulation (GDPR), you have the following rights:

To exercise these rights, send an email to info@okidoky.nl. We will respond to your request within 30 days.

In addition, you have the right to file a complaint with the Dutch Data Protection Authority ( www.autoriteitpersoonsgegevens.nl).

Okidoky uses cookies for the functioning of the application and, with your consent, for analytical purposes. You can adjust your cookie preferences at any time via the cookie banner.

On pages whose address starts with /coach or /begeleiding (Okidoky Coach), we do not use Google Analytics, show no ads and keep no visitor statistics of our own. The same applies when a coach views a client's ledger: no Google Analytics, no ads and no visitor statistics of our own.

For detailed information about which cookies we use and how you can manage them, please refer to our cookie policy.

Okidoky is intended only for people aged 16 and over; this applies to every part of Okidoky. When you create an account, you confirm that you are 16 or older. We do not ask for proof of identity, so we do not check your age ourselves. If we find that an account belongs to someone under 16, we delete that account and the data that belongs to it.

As a parent or guardian, you can contact us at info@okidoky.nl if you suspect that your child is under 16 and has an account anyway.

RULIDO reserves the right to amend this privacy policy from time to time. The most recent version is always available on this page.

In the event of substantial changes, we will notify you by email. An updated privacy policy is not consent: if a change requires your consent, we will ask for it separately.

Okidoky offers an advertising platform where businesses can place advertisements. This section describes how we handle advertiser data and how advertisements work on our platform.

12.1 Advertiser data

When you register as an advertiser, we collect the following data:

• Business details (name, Chamber of Commerce number, VAT number)
• Contact details (name, email address, phone number)
• Address details
• Payment details (via Mollie, we do not store payment details)
• Uploaded advertising material (images)

12.2 Purpose of processing

Advertiser data is processed for: account management, review and approval of advertisements, invoicing and payment processing, communication about campaigns, and generating performance statistics.

12.3 Advertisement tracking

To measure advertisement performance, we record:

• Impressions (when an advertisement is displayed)
• Clicks (when an advertisement is clicked)
• IP address (anonymized, for deduplication and fraud prevention)

Important: Our own advertising platform (direct banners sold to advertisers with an account with us) does not use third-party tracking cookies. We do not track users ourselves across other websites. Separately, we use Google AdSense as a fallback for free-tier users (when no direct-sold banner is available) — that IS a third-party ad network with its own tracking, consent-gated via Consent Mode v2. See our /sub-verwerkers page for the full story.

12.4 Retention periods

Detailed impression and click data is retained for 90 days, after which only aggregated statistics are retained. Advertiser accounts and associated data are retained as long as the account is active. After termination, data is deleted within 30 days, with the exception of invoice data (7-year legal retention obligation).

12.5 Advertiser rights

As an advertiser, you have the same GDPR rights as regular users: the right to access, rectification, erasure and portability of your data. Contact us at info@okidoky.nl to exercise these rights.

With Okidoky Coach, a coach such as a budget coach, debt counsellor or social worker can follow along in your Okidoky with your permission. This only happens if you give permission yourself: through your coach’s invitation, or by entering your coach’s link code yourself, after which your coach confirms your request. Your coach can only look, never change anything, and never sees your receipts. Below you can read what then happens to your data, who is responsible for what, and what your rights are.

Who is responsible?

RULIDO (Okidoky) is responsible for your Okidoky account and ledger, for recording your permission, for showing your data to your coach as you chose, and for the access log.

Your coach, or the organisation your coach works for, is responsible for the coaching itself and for what your coach does with the information, including outside Okidoky. You can see who your coach is and which organisation they work for in the invitation and in your Profile, under Coaching. Okidoky does not verify the identity of coaches.

For the notes, agreements and labels your coach keeps in Okidoky, Okidoky works on behalf of your coach or their organisation, which is responsible for them. Okidoky stores them encrypted and does not use them for anything else.

What does your coach see?

• With a summary (the default): how much money comes in and goes out in the current period and what is left; whether any income is late and whether any bills are outstanding (the number and the total amount); the number of open fixed costs; how many budgets you have and the name of any budget that goes over its limit; when you last did something in Okidoky; and a traffic light. No individual income or expense items and no descriptions.
• With full access (read-only): everything in the summary, plus all your income and expenses with amount, date, description and category, your budgets, savings goals, insights and annual overview. Descriptions may contain sensitive information, for example about your health, your religion or a membership. Only choose full access if you are comfortable with that.
• Your coach never sees your receipts, bank details, exports, settings or profile, nor who entered something in a shared ledger. Your coach cannot change, add or delete anything.
• Your coach also sees the email address the invitation was sent to (or, if you entered the link code yourself, your username and email address) and the label your coach chose.

What do we process?

• About the coach: name, organisation and (if filled in) Chamber of Commerce number, as provided by the coach. Okidoky does not verify the identity of coaches.
• About the invitation or request: the email address the coach sent the invitation to, an optional label chosen by the coach (for example your name), and when the invitation or request was made and when it expires.
• About the link: your choice (summary or full access, read-only), when you gave permission, which version of the explanation you saw, and when you changed your choice or ended the link.
• An access log: when your coach looked and at what (overview, summary, full ledger or own notes). For each type of access we record at most one entry per quarter of an hour.
• Notes and agreements your coach makes, possibly with a date. These are stored encrypted, are not part of your ledger and are not visible to you in Okidoky.
• The traffic light and the other figures in your coach’s overview are recalculated from your ledger each time and are not stored separately.

Why is this allowed?

Okidoky only shows your data to your coach if you give permission (Article 6(1)(a) GDPR). If you choose full access, you also explicitly consent to sensitive information that may appear in descriptions (Article 9(2)(a) GDPR). Giving permission is voluntary: your help must never depend on it, and saying no has no consequences for your use of Okidoky. You can always withdraw or reduce your permission; it takes effect right away. Anything that happened before you withdrew remains lawful.

We record your permission and the access log because we must be able to show that you gave permission, and so that you can see who looked. Security measures, such as limits on invitations and refusing citizen service numbers (BSN) in notes, protect you and others against misuse. The legal basis for this is our legitimate interest (Article 6(1)(f) GDPR).

Free Premium through your coach and the emails about your link are part of the service you use (performance of a contract, Article 6(1)(b) GDPR).

For the notes and for what your coach does outside Okidoky, your coach or their organisation needs its own legal basis. If your coach works for a municipality or in debt counselling, this is often a statutory task. Ask your coach about it.

The traffic light

The traffic light is a simple signal based on fixed rules. It is not a judgement about you and not a decision. Red: income is more than 3 days late, a bill is still outstanding after its date, or more money goes out than comes in this period. Orange: a budget goes over its limit, less than 10% of your income is left, or you have not done anything in Okidoky for 14 days or more. Grey: there is nothing in this period yet. Otherwise green. Okidoky makes no decisions about you based on it. The traffic light is meant as a reason for a conversation with your coach, not as a basis for a decision about you.

Who receives your data?

Only the coach you gave permission to, and only as described above. Okidoky runs on its own server at the hosting company IONOS in Germany, and we send emails through our own mail server. Your coaching data does not go to countries outside the European Economic Area. We do not sell anything and do not share anything for advertising. On pages whose address starts with /coach or /begeleiding, we do not use Google Analytics, show no ads and keep no visitor statistics of our own. This also applies while your coach is viewing your ledger.

How long do we keep this?

• Your coach’s notes and agreements: until 30 days after the link has ended. If you delete your account, they are deleted immediately.
• Access log (who looked and when): 13 months, so you can still check later who looked. In your Profile you see the last 90 days; an export of your data contains the whole log.
• Invitations, requests and ended links (with the email address, the label and the time of your permission): 90 days after they end. An invitation you do not accept expires after 14 days.
• Backups: deleted data may remain in backups until they are replaced on schedule (see Retention period). We only use backups to restore after a failure.

Your rights

You can see your links and the access log in your Profile, under Coaching. There you can also stop or change your choice (on the website; not possible in the app yet). If that does not work, email info@okidoky.nl. An export of your data also contains your coaching data.

Want to see your coach’s notes, or have them corrected or deleted? Ask your coach or their organisation, which is responsible for them. If you email us, we forward your request to your coach and let you know.

You also have the rights listed under ‘Your rights under the GDPR’, and you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Invited, but no account (yet)?

If a coach has invited you, we received your email address and the label the coach chose from that coach. We only use them to send you the invitation and to prevent you from being invited too often (at most 3 times per 30 days per coach). You can decline the invitation without an account via the link in the email; your coach does not receive an email about it, but does see that the invitation was not accepted (not whether you declined or it expired). 90 days after the invitation has expired or been declined, we delete your email address and the label. If you want this sooner, email info@okidoky.nl.

Do you share your ledger with someone?

If you share your ledger with someone, such as your partner, and you choose full access, your coach also sees what that person enters in your ledger, but not who entered it. That person has not given permission for this themselves. So talk it over together before you choose full access. If someone enters things in a ledger a coach follows and objects to this, they can email info@okidoky.nl. Someone you already share a ledger with, such as your partner or a housemate, cannot also be linked to you as your coach.

Data about coaches

If you use Okidoky Coach as a coach, we process: your name, organisation, company name, Chamber of Commerce and VAT number, billing address and billing email address (as you enter them), your link code, whether two-factor authentication is on, your trial, subscription and payments, when you accepted which version of the terms for coaches, and — should it ever be necessary — a block and its reason.

We do this to provide and charge for Okidoky Coach (performance of a contract), to issue and keep invoices (legal obligation) and to prevent misuse (legitimate interest). People you invite or who enter your link code see your name, organisation and Chamber of Commerce number. Payments are handled by Mollie; RULIDO issues invoices in its own administration.

We keep this as long as your account exists. If you delete your account, we delete your Coach data, links and notes immediately. We keep payments and invoices for 7 years because tax law requires it.

You or your organisation are responsible for your clients’ data in your workspace, such as labels, notes and agreements. Okidoky processes it only on your behalf and does not use it for anything else.

Age

Okidoky, including Okidoky Coach, is intended only for people aged 16 and over. When you create an account, including through an invitation from a coach, you confirm that you are 16 or older. Are you a coach? Then invite only clients aged 16 or over.

Do you have questions about this privacy policy, would you like to exercise your rights, or do you have a complaint? Please contact us:

We aim to handle your request or complaint within 30 days. If you are not satisfied with our handling, you can file a complaint with the Dutch Data Protection Authority.