Full transparency

Who has access to your data?

Every outside service that can see your data is listed here — with the reason and location.

Last updated: 30 September 2026

What is a sub-processor?

A sub-processor is an outside service that handles your data on our behalf — like our hosting provider, payment processor or email sender. Almost every online service works with partners like these.

We keep the list as short as possible, preferably within the EU. If anything changes, we let you know in advance.

EU-first

Where possible we choose EU-based services. All core infrastructure is in Germany or the Netherlands.

Minimally necessary

Only services truly needed to run the app. No marketing tracking, no data brokers, no 'handy but optional' third parties.

Announced in advance

New sub-processor? We notify existing users at least 30 days in advance via email plus updates on this page.

Our sub-processors

Complete list — no exceptions

This is ALL third-party services with access to (part of) your data. No 'internal tools' or 'non-critical services' hidden elsewhere. If anything changes, it's here first.

Infrastructure & hosting

Where the app and data physically run

IONOS SE

Hosting provider (virtual server) — Germany

Purpose: The app, the database and our own mail server run on a virtual server at IONOS.
Data they see: All data stored in Okidoky, such as your account, your ledger and log files. IONOS provides and runs the hardware; we manage the server itself (software, database, mail).
Compliance & agreements: European company; the server is in Germany. There is no control panel or other party in between: the server is managed by the maker of Okidoky.

Payments

For processing Premium/Lifetime payments

Mollie B.V.

Payment Service Provider — Amsterdam, NL

Purpose: Processes all Premium and Lifetime payments (iDEAL, credit card, SEPA). We ourselves never see your full card number or IBAN — Mollie handles that.
Data they see: Your name, email, amount, chosen payment method. Card details remain exclusively with Mollie (PCI DSS). We only receive a transaction ID and status.
Compliance & agreements: PSD2 license via De Nederlandsche Bank (DNB). PCI DSS Level 1. GDPR-compliant. Data processed within the Netherlands.

AI features (OpenAI)

Receipt scan and bank-import categories (Premium), plus the summary in the monthly overview sent with the newsletter

OpenAI, L.L.C.

AI model gpt-4o-mini (image and text processing) — United States

Purpose: Three features. (1) Receipt scan: reads the amount, date, shop and product lines from a receipt photo. For Premium, Lifetime, Duo and Family accounts (also during the trial), every scanned photo goes to OpenAI first; if that does not work, Tesseract.js reads the receipt in your browser. Free accounts scan entirely locally. (2) Bank import (Premium): suggests a category for newly imported transactions. (3) Monthly overview: newsletter subscribers (also on a free account) get a personal overview at the start of each month with a short summary written by OpenAI.
Data they see: Receipt scan: the photo (once, in-memory) plus the instruction to extract the data. Bank import: the descriptions of the new transactions (which may contain the name of the other party) and the names of your categories; we do not send amounts. Monthly overview: only your total income and expenses for the month, the difference with the previous month and your three largest spending categories with name and amount — no username, email address or account number (we add the greeting with your name ourselves). OpenAI does not store this permanently.
Compliance & agreements: OpenAI's API tier does not train on input data (stated in their API privacy policy). Processing takes place on US servers; OpenAI offers Standard Contractual Clauses (SCCs) for this in its data processing agreement — we are still checking whether that has been concluded for Okidoky. The receipt scan and the bank-import categories are Premium only; the monthly overview with summary goes to everyone who receives the newsletter, also on a free account. Unsubscribing from the newsletter stops the monthly overview.

Communication

For sending emails (transactional and newsletter)

Own mail server

Email sending — on our own server in Germany

Purpose: Sending registration confirmations, password reset links, payment receipts and (if you subscribe) the newsletter.
Data they see: Recipient email address and mail content (which you receive yourself — we don't send anything to third parties). No separate cloud provider.
Compliance & agreements: Our own mail server on the same server as the app. No external email provider such as SendGrid or Postmark, so no extra party with access to emails. Every email does of course reach the recipient’s own email provider.

Analytics (optional)

Analytics cookies only after your consent

Google Analytics 4Consent required

Web analytics — Google (US)

Purpose: Aggregated visitor statistics (which pages are popular, how many new and returning visitors). Analytics cookies are only set once you accept them in the cookie banner.
Data they see: The Google Analytics script is loaded on the website and in the app. Without your consent it sets no analytics cookies (Consent Mode v2), but Google can still receive technical data such as your IP address and the page address. With consent also: visited pages, browser and device information and session duration. Data from your ledger (amounts, descriptions) never goes to Google.
Compliance & agreements: Standard Contractual Clauses (SCCs) + EU-US Data Privacy Framework (2023). Consent Mode v2 with 'denied' as the default for analytics and advertising cookies.

On pages whose address starts with /coach or /begeleiding (Okidoky Coach), we do not use Google Analytics, show no ads and keep no visitor statistics of our own. The same applies when a coach views a client's ledger: no Google Analytics, no ads and no visitor statistics of our own.

Advertising (free-tier + consent-gated)

Google AdSense for the free plan — the revenue source that makes the free tier possible

Google AdSenseConsent required

Ad network — Google Ireland Ltd (EU HQ) / infrastructure global

IE (EU HQ) / US

Purpose: Displays non-intrusive ads to free-plan users. This is the revenue source that lets us offer a free tier at all. Premium and Lifetime accounts see no AdSense ads.
Data they see: IP address, cookie identifier, visited page, user-agent, coarse interest category for ad matching. Consent Mode v2: without your cookie consent (ad_storage: denied), no tracking cookies are set and ads are shown in non-personalised mode.
Compliance & agreements: Google Ireland Ltd as EU controller. Standard Contractual Clauses (SCCs) for any US transfer. EU-US Data Privacy Framework (2023). Consent Mode v2 ad_storage default denied. Why not hidden: this is a deliberate choice to keep the free plan viable without a subscription or data trade.

External fonts & icon CDN

Stateless content delivery — no cookies, but IP visible to third party

Google Fonts

Webfont CDN — Google LLC (global infrastructure)

Global (Google LLC)

Purpose: Serves the typography (Inter + Poppins) used by the website and marketing pages. Only loaded on the public website; the app itself uses system fonts after login.
Data they see: Visitor IP address, user-agent and Referer with each font request. No cookies, no account linkage — Google Fonts does not set identifiers. Font files themselves are static and contain no code.
Compliance & agreements: Google Fonts Terms of Service + Google privacy policy. Standard Contractual Clauses. The 2022 LG München ruling shows that IP transfer to Google Fonts is a GDPR concern; we plan to migrate to self-hosted fonts to eliminate this. Until then: honestly disclosed, not hidden.

jsDelivr CDN

Open-source CDN — free network (infrastructure via Cloudflare + Fastly)

Global (Cloudflare + Fastly)

Purpose: Serves the Bootstrap Icons font file that renders icons on marketing pages. One small CSS + woff2 file per visitor, heavily cached.
Data they see: Visitor IP address, user-agent, Referer. No cookies, no tracking identifiers. This is technically a stateless file fetch.
Compliance & agreements: jsDelivr is a non-profit project with a public privacy policy (no sale of traffic data). Infrastructure via Cloudflare + Fastly (both GDPR-compliant with SCCs). Same migration consideration: icons can be self-hosted in a future release.

Services we don't use

Common third-party services that don't run on okidoky.nl — for the full picture alongside the sub-processors listed above.

No Meta/Facebook Pixel, no retargeting trackers
No data brokers and no affiliate networks (AdSense for free-tier yes, see above)
No external chat widgets that read conversations (Intercom, Drift, etc.)
No session recording tools (Hotjar, FullStory, LogRocket) — we don't watch what you do
No AI that gives you advice or reads along in your whole ledger. OpenAI only receives what is listed above: receipt photos and descriptions from a bank import (Premium) and the monthly totals for the monthly overview (newsletter). The free scan runs with Tesseract.js in your browser.

How it works if we add or change a sub-processor

Changes in sub-processors aren't silently implemented. This is our procedure:

1
Internal assessment: why this service is needed and which alternatives we considered.
2
This page gets updated with the new sub-processor, at least 30 days before going live.
3
All active users receive an email with the change, reason and link to this page.
4
You have 30 days to object. For fundamental objections you can close your account with full data export.

Objection to a sub-processor?

Disagree with a sub-processor we use? Get in touch — we take every objection seriously and explain why the choice is needed, or work together on a solution (for example free switch to another account).

Send your objection

Transparency isn't a side issue

For more on how we handle your data, read our privacy policy or view our security measures.

Read privacy policy View security