Privacy

What Nordsynk stores and why

Nordsynk authenticates MCP sessions and operates Fortnox workflows. Some workflows also store company data, bank data, change details, uploaded files, and operational information to provide the service. This notice describes the main purposes and known storage windows; periods vary by data type.

Provider: Nordbeam AB, reg. no. 559434-4201, Limhamn, Sweden
Last updated: October 2, 2026

This notice is published in Swedish and English. Where the two differ, the Swedish text governs.

Identity and account data

Nordsynk stores the internal Nordsynk user id, the connected Fortnox company's id, company name, organization number, last login timestamp, and when available the Fortnox-linked email address and Fortnox user identifier.

Session data

Nordsynk uses encrypted browser cookies to keep you signed in across the admin pages and the pages where you connect an AI assistant, on `nordsynk.se` and `mcp.nordsynk.se`. Those cookies contain the Nordsynk user id, the connected Fortnox company's id, company name, and the approved Fortnox integration scopes needed to reuse the session safely. A separate server-side record stores a session identifier, issue and expiry times, and revocation status so Nordsynk can validate the session. Sessions expire within 30 days; expiry or revocation ends access. Expired records are removed in bounded batches when new sessions are issued. Revocation does not erase a record immediately.

Licensing and company connection state

For the Fortnox Marketplace rollout, Nordsynk caches company connection records and Fortnox seat-verification results so the service can decide whether a user should be allowed to connect.

Operational telemetry

Nordsynk records limited operational events such as OAuth activity, MCP tool names, durations, and success or failure state in its first-party Cloudflare telemetry stores. A strictly filtered, pseudonymous subset is mirrored to PostHog EU Cloud for product learning. Raw Fortnox records, company names, organization numbers, email addresses, free-form messages, OAuth material, and approval payloads are not included in that mirror.

Cookies and site analytics

Nordsynk uses Google Analytics 4 (measurement ID G-Y1VLVFJWVP) and PostHog EU Cloud to understand how the site and onboarding are used. Analytics storage is denied by default and PostHog does not start until you click Allow cookies. Before acceptance, Google receives only aggregated, cookieless Consent Mode pings without identifiers. After acceptance, PostHog records intentional product events and may record fully masked sessions on marketing and onboarding pages: all visible text, form inputs, and element attributes are masked, and dashboard, agency, operations, authentication callback, and approval pages are excluded. Raw accounting data is never included. Google Analytics events are retained for 14 months and processed by Google LLC in the United States under the EU Standard Contractual Clauses; PostHog data is processed in the EU. You can change your choice at any time via “Manage cookies” in the footer.

Support chat

If you message us through the support chat, we store the message, the page it was sent from, and the email address you provide. The message is also sent to our Slack channel so the team can follow the conversation and reply directly. When AI replies are enabled, message text is sent to Google's Gemini API to generate a response. Slack and AI replies are shown in the chat.

Marketing and ad audiences

To reach companies similar to our customers, we may normalize and hash customer email addresses before sending the hash to advertising platforms such as Meta and Google. Hashing reduces direct exposure, but the hash remains personal data and is used for audience matching, measurement, suppression, and related advertising purposes described here. The legal basis is our legitimate interest in marketing the service; you can object at any time by emailing hello@nordbeam.io and we will exclude your address from future audiences.

Fortnox data access

Fortnox data is accessed through authenticated MCP sessions and Fortnox-issued OAuth tokens. Each user connects with their own Fortnox account, and access remains subject to that user's company permissions, product licenses, Nordsynk seat, and the approved integration scopes. Selected workflows store protected SIE/ledger snapshots for reports and DataLink exports, plus change-request details and replay data used to show a preview, record a decision, and execute the requested change. By default, changes open a browser approval preview; a company can enable auto-approve in Nordsynk Dashboard → Settings → Change approval. Fortnox permissions and the company's Nordsynk access policy apply in either mode.

Bank data through open banking

If bank connections are enabled for a company, Nordsynk can use Enable Banking Oy, a Finnish account information service provider (AISP) supervised by FIN-FSA, to read selected Swedish bank accounts, balances, and transactions. Returned details can include dates, amounts, currencies, counterparties, references, and remittance text when the bank provides them. The connection is read-only and cannot initiate payments. Detailed bank sessions and transaction history are stored in Nordsynk's bank ledger with an explicit EU jurisdiction. A separate D1 database stores connection and account summaries, including a masked account identifier and latest balance, but not transaction rows; it has no explicit geographic pin. People with access to the company in Nordsynk can read this data, including accounting-firm consultants with access to the client company in their workspace. When you ask your AI assistant for bank data, it is returned to the connected AI client and handled by that provider under your agreement. Enable Banking states that it is also a data controller for the regulated AISP service; the role allocation requires legal review.

Bank consent and deletion

Consent lasts until the date shown by the bank. You can review or revoke it on Enable Banking's data-sharing consent page. When consent expires or is revoked, further fetching stops once the change is detected, but bank history already fetched is not deleted immediately. If the feature is enabled for your company, connect, account mapping, refresh, status, and disconnect are available in Dashboard → Bank. Offboarding and qualifying consent-expiry markers become eligible for scheduled purge after a 30-day grace period; failures are retried, so this is not a guaranteed deletion deadline. To request access, correction, or deletion of bank data held by Nordsynk, email hello@nordbeam.io. Limited audit metadata or backups may remain under separate retention rules.

Dropzone — temporary file storage

When you send a file, such as a receipt or invoice PDF, to Fortnox through your AI assistant, it is staged briefly in private Nordsynk storage. No file is published at a public URL. The upload link is valid for 30 minutes by default (5–60 minutes), and you can ask the assistant to revoke a pending upload session. Staged bytes are normally deleted once Fortnox has received the file, with a 24-hour cleanup backstop; rejected files, such as the wrong file type or an invalid PDF, are not retained.

Controller and processor roles

For the account data, session data, operational telemetry, and marketing data described above, Nordbeam AB is the data controller. For bookkeeping and customer data that Nordsynk reads or writes in a customer's Fortnox company on the customer's instructions, Nordbeam AB instead acts as a data processor, and the customer remains the controller for that data. The roles for bank data among Nordbeam AB, Enable Banking Oy, the bank, and the customer require review for each processing purpose. Enable Banking states that it is the data controller for its regulated AISP service.

Data processing agreement (DPA)

A data processing agreement covering how Nordbeam AB handles a customer's bookkeeping data in Fortnox on the customer's instructions is available on request at hello@nordbeam.io. That agreement does not establish the terms for Enable Banking's regulated AISP service. Enable Banking states that it is the data controller for that service. Contact hello@nordbeam.io for the current terms and role allocation that apply to a particular bank-data processing purpose.

Sub-processors and bank data provider

Nordsynk uses Cloudflare (hosting, database, file storage, and email delivery), Google (the Gemini API for website support chat and Google Analytics 4), and PostHog EU Cloud (product analytics). Firm agreements also use Stripe (billing). When bank connections are enabled, Nordsynk uses Enable Banking Oy, Finland, as its regulated account information service provider. Enable Banking is a Finnish AISP supervised by FIN-FSA; its role and terms for bank access are described in the bank-data section. Fortnox, Spiris, and Bokio are accounting systems the customer chooses to connect.

Retention periods

Storage periods vary by workflow and data type. A protected SIE/ledger snapshot becomes stale after six hours; that is a freshness threshold, not a deletion deadline. Scheduled cleanup removes snapshots after 30 days without successful use. Revoking or expiring a DataLink ends access through the link but does not set a separate deletion date for its source snapshot. Change approvals retain a masked preview and decision and outcome details. New exact requests needed to execute or resume a change are encrypted at rest; scheduled cleanup clears them 30 days after a resolved execution, sooner for declined requests. Unresolved or safely retryable requests retain their replay copy until their lifecycle is settled. Older plaintext requests are migrated in bounded batches. This notice does not state a fixed deletion period for approval audit rows. Application cleanup does not immediately erase D1 Time Travel or backup history. Google Analytics events are kept for 14 months (see "Cookies and website analytics" above). Dropzone file bytes are deleted after successful ingest, expiry, or revoke, with a 24-hour cleanup backstop — see the Dropzone section below. Related file and event metadata may remain after the bytes are deleted; this notice does not state a fixed deletion period for that metadata.

Privacy contact and updates

Nordsynk is provided by Nordbeam AB (org. no. 559434-4201), Nätsnäcksgränd 8, 216 31 Limhamn, Sweden. Questions, access requests, correction requests, or deletion requests can be sent to hello@nordbeam.io. This notice may be updated when the service, Fortnox requirements, or supported MCP clients change.