Privacy Policy
How Reqora handles account data, client contact details, uploaded documents, support messages, analytics events, and billing records for the live product.
Last updated May 13, 2026
What this policy covers
This policy explains how Reqora processes personal data when accounting or bookkeeping firms use the service, when clients upload documents through secure request links, and when visitors contact Reqora or browse the public website.
Controller and processor roles
Reqora is operated by Thicle Sàrl-S, Luxembourg. For account administration, billing, support, website analytics, product feedback, and direct commercial communication, Thicle Sàrl-S acts as controller. For client contact details, request content, uploaded documents, notes, and activity records entered by a workspace, the workspace owner acts as controller and Reqora acts as processor.
Personal data we process
Reqora may process account identity details, workspace settings, owner and staff names and emails, client names and emails, request titles, checklist items, due dates, upload metadata, activity logs, uploaded files, billing identifiers, support messages, feature requests, testimonials submitted for review, dropoff feedback, basic analytics events, IP-derived request metadata handled by infrastructure providers, and authentication/session data.
Sources of data
We receive data directly from workspace users during signup, onboarding, billing, support, settings, client management, template creation, and request creation. We receive uploaded files and optional notes from clients who use secure no-login links. Some technical data is generated automatically when the site, app, emails, or upload routes are used.
How we use data
We use data to authenticate users, provide workspace access, isolate workspace data, create and send document requests, receive secure uploads, send reminders and completion emails, review request progress, process billing through Stripe, answer support requests, improve the product, protect the service from abuse, and meet legal and accounting obligations.
Legal bases
For controller activities, we rely on contract necessity to create accounts, provide the service, manage subscriptions, and respond to service requests; legitimate interests to secure, operate, improve, and understand the product; legal obligation for accounting, tax, compliance, and dispute records; and consent where a specific optional use requires it. For workspace client data and uploaded documents, Reqora processes personal data on the documented instructions of the workspace controller.
Recipients and service providers
Personal data may be processed by service providers that help operate Reqora, including Supabase for database, authentication, and storage, Vercel for hosting and serverless functions, Stripe for billing and invoices, Resend for transactional email delivery, and internal tools used to handle support, feedback, analytics, roadmap, and approved testimonials. We do not sell personal data.
Storage and access controls
Application data and uploaded files are stored in tenant-scoped systems. Uploaded files remain private, are not exposed through public URLs, and are available only through the workspace and request workflow that owns them. Access is limited to authenticated workspace users, authorized operational access, and the specific secure upload route needed for the client request.
Hosting location
In the current production setup, application data and uploaded client documents are stored in Supabase in the AWS eu-central-1 region, located in Frankfurt, Germany. Reqora server functions run on Vercel in the FRA1 region, also in Frankfurt, Germany.
International transfers
Reqora aims to keep primary application data and uploaded documents in the EU region described above. Some providers, such as Stripe, email delivery, support tooling, or group-company support by infrastructure providers, may involve processing outside the EEA. Where required, we rely on the provider's published transfer safeguards, such as adequacy decisions or Standard Contractual Clauses.
Retention
Workspace records and uploaded files are retained while the workspace remains active or while needed to provide the service. Billing and invoice records may be retained for legal, tax, accounting, and dispute purposes. Support, feedback, analytics, and security records are kept only as long as needed for the purpose collected. Workspace owners can contact Reqora to request deletion or export of workspace data, subject to legal retention obligations and the rights of other parties.
Cookies, local storage, and analytics
Reqora uses necessary cookies for authentication, security, and language preference. The app also uses local storage to remember limited feedback-display preferences. Reqora records first-party product analytics events such as page views, signup steps, checkout events, request actions, and upload completion; these events are used to understand and improve the product and are not sold to advertising networks.
Your rights
Depending on your role and the applicable law, you may request access, rectification, erasure, restriction, portability, or objection to processing. If processing is based on consent, you may withdraw consent at any time. If your data was entered by an accounting firm using Reqora, you should normally contact that firm first as the controller. You may also contact Reqora at info@reqora.io. You have the right to lodge a complaint with a data protection authority, including Luxembourg's CNPD.
Security measures
Reqora applies practical technical and organisational measures such as workspace scoping, private storage, secure token request links, server-side validation, role-based access, protected administrative operations, and restricted operational access. No online service can guarantee absolute security.
Children
Reqora is a B2B product for professional accounting and bookkeeping workflows. It is not intended for children or for household consumer use.
Changes to this policy
We may update this policy when the product, providers, legal requirements, or processing practices change. The latest version is published on this page with the updated date above.
Contact
For privacy questions about Reqora, contact info@reqora.io. If your question concerns client documents requested by an accounting firm, include enough context for us to identify the workspace or ask the firm directly.