Effective date: 2026-10-14

Privacy Policy

1. Who we are#

Struktürs is a trading name of Yorkville Advisors B.V., a private limited company incorporated in the Netherlands (KvK 87502151), with its registered office at Platinaweg 25, 2544 EZ The Hague, the Netherlands ("Struktürs", "we", "us").

This policy explains how we handle personal data when you visit strukturs.ai, apply for or use the Struktürs platform (the "Service"), or contact us.

• Privacy contact: privacy@strukturs.ai, or by post to the address above, marked "Privacy".
• Information Officer (South Africa): privacy@strukturs.ai.
• Representative in the United Kingdom (Article 27 UK GDPR): our UK representative, privacy@strukturs.ai.

2. Our two roles#

We are the controller for personal data we decide how to use: your account, billing, support and security records, applications, website visits, and marketing. This policy covers that data.

We are a processor for our customers for the content they put into the Service: trial balances, financial records, knowledge articles, questions, board packs and anything else uploaded to or created in a customer's workspace ("Customer Data"). The customer (usually your employer) decides how that data is used and is its controller (under the EU and UK GDPR) or responsible party (under South Africa's POPIA). We process it under our Data Processing Agreement with that customer. If you have a question about personal data within Customer Data, contact the customer; we will help them answer it.

3. What we collect#

You must give us account, billing and acceptance data to use the Service; without them we cannot provide it. Marketing and website analytics data are optional.

We do not seek to collect special categories of personal data (such as health data). Customer Data may contain personal data, for example names in a ledger; that is processed for our customer as described in section 2.

4. Why we use it, and our legal basis#

Where we rely on legitimate interests, we have weighed them against your rights. You can ask us for that assessment.

We do not use the content of Customer Data to improve the Service for anyone else. If we ever offer that, it will be off unless the customer chooses to turn it on.

5. AI processing#

Several features of the Service use AI models: Ask (questions about your organisation's records), Board Packs drafting, knowledge capture (interviews and drafting articles from documents), narrative explanations, and mapping trial-balance accounts.

• What the model receives. Only what a request needs: your question and the conversation, extracts from your organisation's knowledge articles and evidence, aggregated figures, and, when a question needs them, the names and amounts of relevant accounts. When you ask for an article to be drafted from a document, the model receives that document's text. Your organisation is identified to the model by an internal code, not its name. We do not send your complete ledger.
• Who runs the models. Models run on Google Cloud Vertex AI, under Google's terms as our processor. We use Claude (a model made by Anthropic and run by Google, under Anthropic's commercial terms) and Google's Gemini models. We do not send Customer Data to Anthropic's own services.
• No training. We do not use Customer Data to train AI models. Our AI model providers are contractually prohibited from using it to train or fine-tune their models (Google Cloud's Service Specific Terms, and Anthropic's Commercial Terms for Claude).
• Your review. AI output can be wrong. The Service shows where AI was used, and important outputs, such as trial-balance submissions and board packs, require a person to review and sign off.
• No automated decisions about you. We do not make decisions with legal or similarly significant effects about individuals by automated means.

6. Where your data is processed#

A customer chooses its workspace's region when the workspace is created. That workspace's files, figures and database are stored in a Google Cloud project of its own in that region. Some processing takes place elsewhere:

Service providers. Our sign-in provider (Clerk), email provider (Resend) and payment provider (Stripe) process account and billing data in the United States and, for some, in the EU; Stripe also processes worldwide. Our customer relationship and support system (HubSpot) holds applications, contacts and support messages in the European Union (Germany). Some HubSpot processing (usage data and support access) takes place in the United States. The full list, with locations, is our Sub-processor List.

We currently offer workspaces in the United Kingdom and South Africa. When we offer further regions, including the European Union, the United States and Canada, we will add them here before workspaces are offered there.

7. International transfers#

When personal data moves between countries we rely on the following safeguards:

• From the UK to the EU: the UK's adequacy regulations for the European Economic Area.
• From the EU to the UK: the European Commission's adequacy decision for the United Kingdom.
• From the EU or UK to the United States and other countries without adequacy: the European Commission's Standard Contractual Clauses (with the UK Addendum for UK data) or the provider's certification under the EU–US Data Privacy Framework and its UK Extension, as set out in our agreements with each provider.
• From South Africa: section 72 of POPIA. Data leaves South Africa only for the purposes in section 6 (AI features, search indexes, sign-in, billing, administration, email, support and the audit record), and only to recipients bound by agreements we have assessed as providing an adequate level of protection. Where we ask the user responsible for a South African workspace to confirm the transfer for AI features, that consent is an additional basis, to the extent the person confirming is, or may consent for, the person the data is about.

You can ask us for a copy of the relevant safeguards at privacy@strukturs.ai.

8. Who we share it with#

We do not sell personal data. We share it only with:

• the service providers on our Sub-processor List, who process it on our instructions. Some of them also use limited data as independent controllers under their own privacy policies: Stripe, for fraud prevention, anti-money-laundering and know-your-customer checks, and to improve its own services; Clerk and Resend, for their own account administration, security and service operation;
• your organisation, where you use the Service as one of its users;
• professional advisers, insurers and auditors, under confidentiality;
• authorities, where the law requires it; and
• a buyer or successor, if our business is sold or reorganised, under equivalent protection.

9. How long we keep it#

When a retention period ends we delete the data or anonymise it so that it no longer identifies you.

10. Your rights#

Depending on where you are, you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete data, where there is no overriding reason for us to keep it;
• restrict or object to processing, including any processing based on legitimate interests, and to object at any time to direct marketing;
• portability: receive data you gave us in a structured, machine-readable format; and
• withdraw consent at any time, without affecting earlier processing.

To exercise a right, email privacy@strukturs.ai. We respond within one month, and tell you if we need longer. For Customer Data, we will pass your request to the customer that controls it.

The audit record. We keep the record of who did what in the Service even if you ask us to delete your data, because it is needed to establish, exercise or defend legal claims and to show which person approved which financial record. It identifies you by an internal identifier, not your name, and contains no document contents. We will tell you if your request is affected by this.

11. Complaints#

Please contact us first. You also have the right to complain to a supervisory authority:

• Netherlands (our lead authority in the EU): Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl
• United Kingdom: Information Commissioner's Office, ico.org.uk
• South Africa: Information Regulator, inforegulator.org.za
• Elsewhere in the EU: the authority in the country where you live or work.

12. Cookies#

Our website uses:

• strictly necessary cookies, for sign-in, security and form handling, which are always on;
• analytics cookies (Google Analytics), only if you consent.

We set no marketing cookies. If we add any, we will list them here first, and set them only if you consent.

Analytics cookies are off until you choose otherwise. You can change your choice at any time in our cookie settings.

The Service itself (app.strukturs.ai) uses only strictly necessary cookies, for sign-in and security. It runs no analytics or marketing cookies and shows no cookie banner. We understand how the Service is used from our own records of the requests it receives (the *Product usage* data in section 3), without cookies or third-party analytics.

13. Security#

We protect personal data with technical and organisational measures appropriate to the risk, including a dedicated cloud project for each customer, encryption at rest with keys we manage in Google Cloud Key Management Service and encryption in transit, no routine staff access to customer workspaces (emergency access is temporary, logged and reviewed), and audit logging. Our Data Processing Agreement describes these measures in more detail.

14. Children#

The Service is for businesses. It is not directed at anyone under 18, and we do not knowingly collect their personal data.

15. Other regions#

If you are in a country not named above, the rights described in section 10 are available to you, and we will respond to requests under the law that applies to you. Where we offer the Service in the United States or Canada, we will add any notices those countries' laws require before workspaces are offered there.

16. Changes to this policy#

We will tell you about material changes by email or in the Service before they take effect. The effective date at the top shows the current version. Earlier versions are available on request.

17. Contact#

Yorkville Advisors B.V., trading as Struktürs Platinaweg 25, 2544 EZ The Hague, the Netherlands privacy@strukturs.ai