GDPR-first
Privacy notice
Verdia is being built GDPR-first. This notice explains what this website collects and why. It is short because we collect very little.
What we collect
If you request early access we store your email address, the company size you select, the language you used and the time of the request. If you choose to tell us more, we also store the company name, organisation number, role and finance tooling you give us, and if you arrived through someone's referral link, the code of that link. As we work through the list we add a status (new, contacted, design partner, declined), a segment derived from your answers, and notes from any conversation we have with you. Named colleagues at Verdia can read that record and export the list; every change is logged. Nothing else. This site sets no cookies and runs no third-party analytics.
Why, and on what basis
We use your email only to tell you when early access opens. The legal basis is your consent (GDPR article 6(1)(a)), which you can withdraw at any time by asking us to delete your entry.
If you connect a bank account
The preview can read a business account you own, read-only, after you approve it at your bank. We then store the balances and the transactions of the last 90 days: date, amount, counterpart and reference. Verdia cannot move money. A consent lapses after ninety days, and everything read under one is deleted within a month of it lapsing. Disconnecting deletes every balance and transaction we hold for you immediately; the record that a connection existed and was removed stays in our audit log.
If you connect an accounting system
The preview can read the unpaid customer invoices in an accounting system your company uses, read-only, after you approve it there. For each invoice we store its number, the customer's name, the invoice and due dates, the total, what is still owed and the currency, together with the invoice record as the system sent it, so we can check our reading of it. The access the system gives us is stored encrypted. Verdia cannot create, change or send an invoice. Disconnecting deletes the connection and every invoice read under it immediately; a connection we have not been able to read for 30 days is deleted the same way. To withdraw the access at the source too, remove the integration in your accounting system. The record that a connection existed and was removed stays in our audit log.
If you connect an agent
You can create a personal access token that lets an AI agent of your own read your figures over the Model Context Protocol. With an accounting system connected, those figures include the open customer invoices counted in the forecast: customer name, amount and due date. We store a hash of the token, never the token itself, together with the name you gave it, what you allowed it to read, when it was created, when it was last used and when it expires. Every request it makes is written to our audit log: which token, which method, which tool — never the arguments and never what came back. The access is read-only; no tool can move money or change anything. Revoking a token from Settings stops it immediately.
How the written insights work
The sentences on the Insights page are written by our own software from figures it computes: balances, recurring payments, a forecast. If the language model option is switched on, that model is sent those finished sentences and asked only to reword them. They can include a payee name, an amount and a date where something looks unusual. They never include your name, your organisation number, your account numbers or a list of your transactions. Every figure and date in the reworded version is compared with ours, and anything that differs, or that breaks our own copy rules, is replaced with our wording. The model provider processes this on our behalf under a data-processing agreement; we do not use your data to train a model.
Where it lives and for how long
Data is stored on servers in the EU and kept until early access has opened or you ask us to delete it, whichever comes first.
Your rights
You can ask what we hold about you, have it corrected or deleted, and complain to the Swedish Authority for Privacy Protection (IMY). Write to hello@verdiabank.com.
Controller
Verdia, Stockholm, Sweden. This notice will be updated as the platform develops.