Privacy policy

1. Who we are

Portofol is a bookkeeping service for companies in Kosovo, offered by Dev2Devs, a company registered in the Republic of Kosovo, under the Portofol brand. Dev2Devs is the controller of your account data. For anything about your data write to info@portofol.app.

2. What we store

Your account. Name, email address, password (stored only as a hash we cannot read), office name, chosen language and theme, sign-up date.

The books you keep. Everything you enter in the app: companies and their details (business number, fiscal number, VAT number, address, bank account), customers and suppliers, items, invoices, payments, bank statements you import, employees and payslips, fixed assets, the journal and the reports derived from them.

Technical data. Ordinary server logs (IP address, time, request) kept for security for up to 30 days. The app contains no analytics, advertising, trackers or third-party advertising SDKs.

What we do not collect. We do not ask for access to contacts, location, camera or microphone. Files are opened only when you pick one to import (CSV) or save a PDF, through the system dialog.

3. Why we use it

• To provide the service: store the books, compute VAT, payroll and reports, and recognise you when you sign in.
• To send account emails: the confirmation code, password reset, the welcome mail and notices about changes to the service. We send no advertising.
• For the security of the service and to meet legal obligations.

The legal bases are our contract with you (providing the service), our legitimate interest in security and, where it applies, a legal obligation.

4. Your clients' books

When an accounting office records data about its clients' companies, their employees or their partners, the office is the controller of that data and Portofol acts as a processor on its instructions. We use that data only to provide the service and do not look at it unless you ask for support.

5. Where it is stored and who sees it

Data is stored on servers in the European Union (Supabase, Ireland region), encrypted in transit and at rest, with row-level access control: each office sees only its own companies. Emails are sent through Resend. The site and the web app are hosted at Hostinger. These providers process data only for us and under data processing agreements.

When you upload an invoice PDF to have the form filled in, the document is sent to Anthropic's service (USA) only to be read; under their commercial terms it is not used to train models and is not kept longer than 30 days. We do not store the PDF itself, only the fields you confirm in the form and a count of reads for the monthly quota.

When a company issues a fiscal coupon, the coupon data (items, amounts, VAT, the company's identifiers) is sent to the Tax Administration of Kosovo, as Administrative Instruction (MF) 01/2026 requires. We do not sell data, do not use it for advertising and do not share it with anyone else, unless the law or a competent authority requires it.

6. How long we keep it

For as long as your account is active. When you delete the account, the data is removed from active systems immediately and from backups within 30 days. Technical logs are kept for up to 30 days.

7. Your rights

• Access and correction: view and change your data in the app.
• Export: reports, VAT books and invoices export as CSV or PDF at any time.
• Deletion: Settings → Delete account, or by email to info@portofol.app. Deletion is immediate and irreversible.
• Complaint: to the Information and Privacy Agency of the Republic of Kosovo, or to your supervisory authority if you are in the EU.

We apply Law No. 06/L-082 on Protection of Personal Data of the Republic of Kosovo and, for users in the European Union, the GDPR.

8. Security

HTTPS only, hashed passwords, address confirmation by code, per-office access restrictions on the database, daily backups. No system is perfect; if an incident affects your data we notify you without delay.

9. Children

The service is for businesses and is not directed at people under 18. We do not knowingly collect children's data.

10. Cookies and local storage

The app keeps on your device only the sign-in session and preferences (language, theme, last opened company). The site portofol.app uses no tracking cookies.

11. Changes

If we change this policy we publish the new version here with a new date and, for material changes, notify you by email.

Albanian version: Politika e privatësisë.