Terms and Conditions and Privacy Policy

Ombora Terms and Conditions

Version 1.0 · October 27, 2026

1. About Ombora

Ombora is a service provided by Kobalt Ventures B.V., based in Amsterdam, Dutch Chamber of Commerce (KvK) registration number 42027392. Mailing address: Herengracht 551, 1017 BW Amsterdam, the Netherlands. Contact: [email protected].

These terms apply to business use of Ombora. Separate written agreements take precedence over these terms.

2. Our agreement

The agreed services, pricing, payment terms, duration, and termination terms are set out in the offer or agreement you accept. We perform the agreed work with due care. Information or outputs provided by the service do not guarantee any particular result.

3. Your responsibilities

You provide accurate and complete information on time and review anything we submit for your approval. You remain responsible for your legal obligations. This does not affect our responsibility for the agreed work. You use Ombora lawfully, protect your account, and provide only data you are authorized to share.

4. Data and rights

You retain the rights to your own data and documents. We use them to provide the agreed services. Rights to our software remain with us or our licensors. Our Privacy Policy explains how we process personal data. For personal data we process on your behalf, we enter into a data processing agreement as part of the customer agreement before that processing begins.

Upon termination, we cooperate in an orderly transfer of your data and documents. You are responsible for keeping them available for the retention periods required by law that apply to you.

5. Errors and disputes

Report errors or complaints to [email protected] as soon as reasonably possible. Give us a reasonable opportunity to remedy a failure to meet our obligations, unless a remedy is not possible. Liability is governed by applicable statutory rules.

Our agreement is governed by Dutch law. Disputes will be submitted to the court with jurisdiction under applicable law.

Ombora Privacy Policy

Version 1.0 · October 27, 2026

1. Who is responsible

Ombora is a service provided by Kobalt Ventures B.V., Dutch Chamber of Commerce (KvK) registration number 42027392. Mailing address: Herengracht 551, 1017 BW Amsterdam, the Netherlands. Privacy questions: [email protected].

We are the data controller when we process personal data for our own purposes, such as account management and billing. When we process data on behalf of your business and according to your instructions, you are the data controller and we are the data processor. We remain responsible for our own obligations, including security and confidentiality.

Before that processing begins, we enter into a data processing agreement as part of your customer agreement. It covers data use, security, service providers, data breaches, privacy requests, and deletion.

2. What data we use and why

Data	Purpose and legal basis for processing for our own purposes
Name, email address, account and business details, such as address, Chamber of Commerce registration number, and tax information needed for the service	Managing your account and providing the agreed service: performance of our contract with you. For business customers’ contact persons: our legitimate interest in managing the customer relationship.
Questions, messages, and correspondence with us	Responding to your request and providing support: performance of the contract or our legitimate interest in handling questions and complaints with due care.
Billing and payment details for your subscription	Billing: performance of the contract. Retaining our financial records: a legal obligation.
Technical usage and security data, such as IP address, timestamps, session data, and error messages	Operating and securing the service and investigating problems: our legitimate interest in a secure, reliable service. We limit this to what is necessary for those purposes.

For your bookkeeping, we process documents, banking and transaction data, customer and supplier information, tax information, accounting entries, and conversations with the assistant. For processing on your behalf, your business is responsible for establishing a valid legal basis; we act within your instructions.

Data comes from you, your users, and enabled integrations, and may also relate to other people. Without necessary data, the relevant feature will not function fully. Do not share unnecessary Dutch citizen service numbers (BSNs) or sensitive personal information.

3. Gmail and Outlook

If you enable an available email integration, we read messages and attachments to import bookkeeping documents. We process your email address, access tokens, message metadata, senders, receipt dates, and attachments. Imported documents may be processed using AI, as described below.

Access extends beyond invoices. The Gmail integration can retrieve complete messages, including messages in Spam and Trash, from the selected start date onward. Personal information may therefore also be processed. We recommend connecting a business mailbox. The Gmail integration is read-only and does not send or delete emails.

Disconnect the integration in Ombora or revoke access through your provider. For Google, go to connected apps, select Ombora, and revoke access. For Microsoft, use app permissions (personal accounts) or My Apps (work or school accounts), with your administrator’s assistance if needed. Synchronization will then stop. Imported data is not automatically deleted; request deletion at [email protected]. The retention periods and exceptions below continue to apply.

Our use and transfer of Google data comply with the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data for advertising or to train general-purpose AI models. Human access occurs only within the permitted exceptions, such as with your explicit consent for specific data, for security purposes, or as required by law.

4. AI and other service providers

We use the following categories of IT service providers to deliver our services:

Cloud hosting and storage: to operate the application and store data and documents.
Authentication and account management: to support sign-in and manage and secure accounts.
AI service providers: for document processing and the assistant. Relevant document content, transactions, and conversations are processed for these purposes.

5. How long we retain data

Data	Retention period
Account data and customer bookkeeping records we store on your behalf	For the duration of the agreement; after termination, 30 days for transfer, followed by deletion within 30 days. Earlier return or deletion upon instruction where agreed and legally permitted.
Remaining backups of deleted data	No later than 90 days after deletion from active systems; used only for recovery, with prior deletions reapplied afterward.
Support correspondence	Up to 2 years after resolution.
Technical security logs	Up to 90 days, or longer if necessary for a specific incident.
Our own invoices and tax records	7 years under the applicable tax record retention requirement, or longer if a specific statutory period requires it.

In the event of an ongoing dispute or a legal retention requirement, we retain only the data needed for that purpose, for as long as necessary. Your tax record retention obligations do not automatically require Ombora to retain all your data after termination. You should therefore arrange a complete transfer and retain your own records.

6. Cookies and security

Ombora uses technical storage for purposes including sign-in and preferences.

We take appropriate technical and organizational measures to protect personal data. These include access restrictions, secure connections, and protection of stored data.

7. Your rights

You may request access, correction, deletion, restriction of processing, or data portability, and object to processing based on a legitimate interest. You may withdraw consent at any time, without affecting the lawfulness of prior processing. Statutory exceptions may limit these rights.

Email [email protected]. We will verify your identity if necessary. We respond within one month; complex requests may take up to two additional months, with an explanation provided within the first month. If we process your data on behalf of another business, we will help direct your request to that business.

You may file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).