Privacy Statement for the Taki App

Taki for iOS and Android · Mandora AS

1.Introduction

This privacy statement applies to the Taki mobile app for iOS and Android. It explains which personal data is processed when you use the app, why it is processed, who it is shared with – including which AI providers receive data and for what purpose – and the rights you have. Personal data is any information relating to an identified or identifiable natural person.

The app is a mobile client for the Taki service. Processing that takes place via the website takiregnskap.no is covered by the website privacy statement; the service in general is covered by the in-product privacy statement. This statement covers what is specific to the app.

2.Contact us

For questions or privacy requests, including a possible breach of your privacy, contact us at privacy@mandora.no.

Mandora AS · Karenslyst allé 56, 0277 Oslo, Norway

3.Our roles and how the app is used

Mandora AS as data processor. Accounting and voucher data you enter in the app (for example receipts, invoices and messages to Taki) is processed on behalf of the customer – the business that has an agreement with us. The business is the data controller, and the processing is governed by the data processing agreement in the Terms of Service. If you run a sole proprietorship (ENK), you are normally both the customer and the data subject – in that case the information in this statement applies to you directly.

Mandora AS as data controller. For processing where Mandora itself determines the purposes and means – such as account administration, security, bug fixing and app analytics – Mandora is the data controller. These activities are described in section 5.

How you add accounting data. You can upload receipts and vouchers by taking a photo in the app, choosing from your photo library, or sharing files from other apps via the share extension. The app only accesses your camera and photos when you grant permission in the operating system, and only the photos and files you select are uploaded. Uploaded material becomes accounting data and is processed as described above and in section 4. If you add a Taki widget to your home screen, selected information from your account is displayed locally on your device; note that widget content may be visible to others who can see your screen. The app does not currently send push notifications – if introduced, this statement will be updated and the operating system will ask for your permission.

4.AI processing in the app

Taki runs on AI. To answer you and keep your books, Taki sends your messages and relevant accounting information, such as invoices and uploaded documents, to our AI provider.

The data is sent to the following named providers, who act as our sub-processors:

• Anthropic PBC (USA) – our AI provider (the Claude language model); processes your requests and generates replies. Transfers are safeguarded by the EU Standard Contractual Clauses (SCCs). Anthropic does not train its models on your data.
• Google Ireland Limited (EEA) – fallback (Gemini); used only if Anthropic is unavailable. Processing takes place in an EU region (europe-west4, the Netherlands). Google does not train its models on your data.
• OpenAI Ireland Ltd. (USA) – additional fallback AI (GPT), from 23 November 2026 at the earliest; used only if our primary AI provider is unavailable. Processed in the USA, safeguarded by the EU Standard Contractual Clauses (SCCs). OpenAI does not train its models on your data.

Before you can use the app, a dedicated activation screen (“Taki runs on AI”) explains this processing. You must actively choose “Allow and continue” before any data is sent; if you choose “Not now”, nothing is sent. The information is also available in the app settings. The data is used solely to deliver the service to you – never to train language models, and never for decisions about individuals.

5.Processing activities in the app

Account and sign-in. When you sign in, your name, email address, phone number, profile photo (if any), sign-in method and authentication data are processed via our sign-in provider Clerk. Two-factor authentication (2FA) is required for all users. Legal basis: necessary to deliver the service under the agreement, see GDPR Article 6(1)(b).

Security, stability and bug fixing. If the app encounters an error, crash reports are collected via Firebase Crashlytics so that we can fix bugs. The reports contain technical information about the error (stack traces, which screen was open and which API calls were made just before – method, URL path and status code), device information (device model, OS version, app version) and your user and organisation ID, so that errors can be tied to an account during debugging. The reports never contain names, email addresses, message content or amounts, and API content is not logged in the production version of the app. Crash and error reports are deleted after 90 days. Legal basis: legitimate interest, see GDPR Article 6(1)(f) – delivering a stable and secure app.

App analytics and service improvement (only with your consent). With your consent, we collect statistics on how the app is used via Google Analytics for Firebase (Google Analytics 4) – for example events such as “invoice created”, “message sent” and “screen opened”, with counts and category values only. Together with the events we process your user and organisation ID, device model, OS version, app version, language, country (derived from IP address) and a random installation ID stored on your device. We never send names, email addresses, phone numbers, message content or amounts, and we use no advertising identifiers (IDFA / Android Advertising ID) and no ad tracking. Analytics is off by default and only starts if you consent when the app asks you at first launch. You can withdraw your consent at any time in the app settings – collection then stops. User- and event-level data is deleted after 2 months; only aggregated statistics containing no personal data are retained longer. Legal basis: consent, see GDPR Article 6(1)(a) and section 3-15 of the Norwegian Electronic Communications Act.

App updates and configuration. The app fetches settings (for example a notice that an update is required) via Firebase Remote Config, which only delivers configuration to the app and does not collect user data. Ongoing app updates are delivered via Expo (EAS Update), which receives technical device and app-version data when checking for updates, without user identity. Legal basis: legitimate interest, see GDPR Article 6(1)(f).

Requesting access. Taki is currently available by invitation only. If you request access via the app, we process the information you provide (name, email, phone number and business – with a company lookup against the Brønnøysund Register Centre). The information is registered in our CRM system Pipedrive (Pipedrive OÜ, Estonia), which acts as our processor and stores the information in the EU/EEA. Certain information may be transferred to Pipedrive’s group companies and sub-processors in the USA; such transfers are safeguarded by the EU Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework (DPF). Legal basis: steps taken at your request prior to entering into a contract, see GDPR Article 6(1)(b), and legitimate interest, see Article 6(1)(f). Retention follows the website privacy statement.

6.How your personal data may be shared

Mandora AS is part of the Visma group. We may share personal data across Visma group companies where a valid legal basis exists, limited to what is necessary. Beyond this, data is shared as follows:

Sub-processors (where Mandora is a data processor). For accounting data processed on behalf of the customer (section 3), we use sub-processors in categories including: AI providers (see section 4), the underlying accounting platform and storage (Visma companies), authentication, accounting support, and development, maintenance and user support (from 23 November 2026 at the earliest). The complete and up-to-date list of sub-processors, with processing locations and transfer mechanisms, is set out in the data processing agreement that forms part of the Terms of Service.

Processors (where Mandora is the data controller). For the processing described in section 5, we use the following providers. Where providers are located outside the EU/EEA, we ensure a valid transfer mechanism (the EU Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework (DPF)).

Business partners. Mandora has partner agreements with Contér Services AS and Lumi Accounting, which provide accounting services to Taki customers. Where an accounting partner is your authorised accountant (the Pro plan), this is governed by a separate engagement agreement. Communication with your accountant in the app is shared with the relevant partner.

Public authorities. The police and other authorities may request access to personal data. We only disclose data where a valid legal basis exists, for example a court order.

7.App permissions

The app only asks for permissions when they are needed, and you can change them at any time in your device settings:

• Camera: to photograph receipts and vouchers.
• Photos/files: to select receipts and documents you want to upload.

8.Cookies and tracking

The app does not use cookies for tracking or marketing, and contains no advertising or marketing tracking. Session handling at sign-in is managed by our sign-in provider (Clerk) and is strictly necessary for the service. For crash reporting – and, only if you have consented, for app analytics – a random installation ID is stored on your device, as described in section 5.

9.Your rights

You have the right of access, rectification, erasure, restriction, data portability, and the right to object to processing based on legitimate interest. If you have consented to app analytics, you may withdraw your consent at any time in the app settings. Send requests to privacy@mandora.no. If your request concerns accounting data processed on behalf of a customer (section 3), please direct it to the data controller – for sole proprietorships that is normally you, and we will assist you directly. You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).

10.Changes

We update this statement as needed and will notify you in the app of material changes that significantly alter our privacy practices.

Last updated: 21 October 2026.

© 2026 Mandora AS · Karenslyst allé 56, 0277 Oslo, Norway · hei@takiregnskap.no