Business Suite Terms & Data Processing Addendum

When you use Business Suite, you don't just enter your own information — you enter information about your own clients: their names, what you invoiced them, sometimes their address or contact details on an invoice. That's personal data belonging to people who have never signed up for ExpatPilot and never agreed to anything here. Dutch and EU data protection law (the AVG/GDPR) has specific rules for exactly this situation, and this addendum sets out how we handle it.

For any client or business data you enter into Business Suite (invoice recipients, receipt vendors, mileage trip details, and similar), you are the data controller — legally responsible for having a lawful basis to collect and process that data, and for it being accurate. ExpatPilot acts only as your data processor: we store and process this data solely on your instructions (by you using the product), never for our own separate purposes, and never sell or share it with anyone except as this addendum describes.

This is the same legal structure used by comparable Dutch bookkeeping platforms. Accepting these terms, together with using Business Suite, constitutes the data processing agreement required between us under the AVG/GDPR for this relationship.

• Invoices — client name, amount, invoice number, status, dates you enter via Invoice Generator
• Receipts — vendor name, amount, category, date, and the receipt image if you upload one
• Mileage logs — trip date, route/locations, distance, and any client or purpose notes you add
• Hours — task descriptions and time entries you log

We store this because it's the product — a bookkeeping and invoicing tool needs this data to function. We don't use it to train AI models, sell it, or share it with advertisers.

Some Business Suite tools use AI to generate content: the Invoice Generator, the KVK business description generator, the Dutch business letter interpreter, and the tax/profit estimator. When you use these specifically, the relevant text you enter (e.g. a Dutch letter you paste in for translation, or invoice details for formatting) is sent to our AI provider (Anthropic's Claude) to generate the output. This is the same AI-disclosure principle already shown on Ask ExpatPilot, applied here: your business data isn't sent to any AI unless you're actively using one of these four specific tools, and it's used only to generate your requested output, not stored by the AI provider for their own purposes beyond standard processing.

Accountant Mode lets you invite a real accountant of your choosing to view your records. This is a decision you make explicitly, one accountant at a time, and you can revoke it at any moment. Because this involves sharing your data with a specific named third party, we show you a separate, detailed confirmation at the moment you connect an accountant — covering exactly what they can see, and requiring your explicit confirmation before the invite is sent. See that screen for the full detail; this addendum just confirms the mechanism exists and is opt-in.

Beyond you and any accountant you explicitly connect, your Business Suite data is processed by these infrastructure providers, strictly to run the service (they don't use it for their own purposes):

• Supabase — database and file storage
• Vercel — application hosting
• Anthropic (Claude) — only for the specific AI tools described in Section 4
• Resend — transactional email (e.g. accountant invite emails)

We keep your Business Suite data for as long as your account is active. Dutch tax law requires business owners to retain financial administration (invoices, receipts, and related records) for a minimum period — generally cited as 7 years for most business records under the fiscale bewaarplicht. This is general information, not tax advice — confirm your exact retention obligations with a belastingadviseur, since they can vary by situation. If you close your ExpatPilot account, we'll retain the underlying records for a limited period afterward specifically so you aren't caught out by this legal requirement, then delete them — export anything you need via Accountant Mode's "Download your records" first.

If we ever become aware of a data breach affecting your Business Suite data, we'll notify you without undue delay, describing what happened and what data was involved, consistent with our obligations under the AVG/GDPR.

The KOR decision helper, tax/profit estimator, hour tracker, and every other calculation or suggestion in Business Suite is provided for general guidance only. These tools can help you understand your situation, but they don't replace a qualified belastingadviseur or accountant — especially for anything that will end up in an actual tax filing. You remain responsible for the accuracy of your own bookkeeping and filings.

You confirm that you have a lawful basis (e.g. a genuine business relationship) to hold your clients' data, and that entering it into Business Suite doesn't violate any agreement you have with them. If one of your clients asks you to delete their data, that request is between you and your client — you can do so directly within the product (deleting the relevant invoice or receipt), and we'll process that deletion on your instruction.

If we make a material change to how we process Business Suite data, we'll notify active Business Suite users by email before it takes effect.

Questions about this addendum specifically? Email hello@expatpilot.nl with "Business Suite Data" in the subject line.