Part A - General Terms and Conditions
Chapter 1 — Definitions & Applicability
Article 1 — Definitions
Below we explain what we mean by the most important terms in these terms and conditions.
In these General Terms and Conditions the following definitions apply:
- AdMemo: The mobile and/or web application for automated administration processing, developed and offered by Slim Solutions B.V.
- Slim Solutions / Provider: Slim Solutions B.V., located at Wijttenbachstraat 53B, 1093 HV Amsterdam, registered in the Trade Register of the Chamber of Commerce under number 99976781.
- User: The natural person or legal entity who creates an Account and uses AdMemo on the basis of a Subscription.
- Consumer: A User who is a natural person and does not act in the exercise of a profession or business.
- Account: The personal environment that User creates to access AdMemo.
- Subscription: The paid access to AdMemo on a monthly or annual plan basis, as described on the AdMemo website.
- Service: The full functionality that AdMemo offers, including voice-controlled administration processing, AI-driven data extraction, invoice generation and administration overviews.
- AI processing: The use of external AI services (including Deepgram and Google Gemini) for transcription, analysis and structuring of data entered by the User.
- Customer Data: All information, voice recordings, images and data that User enters into or sends via AdMemo.
- Sub-processor: A third party engaged by Slim Solutions for the processing of personal data, as stated in the Processing Agreement.
- Processing Agreement (VWO): The separately concluded agreement regarding the processing of personal data in accordance with Article 28 GDPR.
- Payment processor: The party through which the User pays for their Subscription. Depending on the platform, this is Apple (In-App Purchases within the iOS app), Google (Google Play Billing within the Android app), or Stripe (web app and direct upgrade flows).
- Writing: By e-mail or via a digital means of communication, unless otherwise indicated.
Article 2 — Applicability
These terms apply to everyone who uses AdMemo. Your own purchasing conditions do not apply.
2.1 These General Terms and Conditions apply to all Subscriptions, offers and agreements between Slim Solutions and the User regarding AdMemo, as well as to all legal acts related to it.
2.2 By creating an Account or taking out a Subscription, the User accepts these General Terms and Conditions.
2.3 Any purchasing or other conditions of the User are expressly not applicable.
2.4 Deviations from these General Terms and Conditions are only valid if Slim Solutions has expressly confirmed them in writing.
2.5 If one or more provisions are null and void or are annulled, the remaining provisions will remain in full force and effect. In that case, the parties will enter into consultation to agree on a replacement provision that is as close as possible to the scope of the original provision.
2.6 Slim Solutions reserves the right to refuse assignments or account requests without giving reasons.
Chapter 2 — Account & Access
Article 3 — Creating and managing an Account
You are responsible for the security of your account. Use a strong password and report any suspicious activity to us immediately.
3.1 Using AdMemo requires creating an Account. User is obliged to provide accurate and complete information upon registration.
3.2 User is responsible for the confidentiality of their login details and for all activities that occur via their Account.
3.3 The User must immediately inform Slim Solutions of (suspected) unauthorized use of the Account via support@admemo.nl.
3.4 Slim Solutions is not liable for damage resulting from unauthorized use of an Account as a result of negligence or carelessness on the part of the User.
3.5 An Account is strictly personal and non-transferable, unless it concerns a business account where multiple users have expressly agreed.
Article 4 — Suspension and Termination of the Account
We may suspend your account if you violate the rules or fail to pay. After termination you can export your data.
4.1 Slim Solutions is entitled to immediately suspend or terminate an Account if:
- User does not fulfill their payment obligations;
- User acts contrary to these General Terms and Conditions or applicable laws and regulations;
- User misuses the Service or overloads the systems of Slim Solutions or third parties;
- User has provided incorrect or misleading registration information.
4.2 In the event of suspension due to non-payment, the User will be notified in writing with a recovery period of 14 days.
4.3 After definitive termination of the Account, the User has 30 days to export their Customer Data in Excel format (XLSX), in accordance with the VWO. Upon request, the Parties can discuss whether another common format can be supplied. After this period, the data will be deleted.
Chapter 3 — Subscription & Payment
Article 5 — Subscription and term
You choose a monthly or annual subscription at the start. This will continue automatically until you cancel it. The payment method that applies depends on the platform on which you take out your subscription.
5.1 AdMemo is offered on a paid Subscription basis. The current plans, prices and features are available on the AdMemo website.
5.2 User can choose a monthly or annual Subscription. The duration and the chosen plan are stated when confirming the Subscription.
5.3 The Subscription will be automatically extended for the same period at the end of each term, unless the User cancels the Subscription in time in accordance with Article 6.
5.4 A Subscription is concluded when the User has made payment via the applicable Payment Processor (see Article 8) and has received a confirmation by e-mail or via the Application.
Article 6 — Termination
You can cancel monthly subscriptions at any time, effective the following month. For annual subscriptions, a period of 30 days applies before the renewal date. Subscriptions taken out via Apple or Google are also managed in those platforms.
6.1 The User can cancel a monthly Subscription at any time, subject to a notice period of 7 days before the end of the current month. The Subscription ends at the end of the payment period.
6.2 User may cancel an annual Subscription up to 30 days before the automatic renewal date. Cancellation after this period will take effect on the next renewal date.
6.3 Termination takes place:
- for Subscriptions taken out via the iOS app (Apple In-App Purchases): via Apple's subscription management settings;
- for Subscriptions taken out via the Android app (Google Play Billing): via the subscription management settings of Google Play;
- for Subscriptions taken out via the web app or via an upgrade link (Stripe): via the account settings in AdMemo or in writing via support@admemo.nl.
6.4 In the event of cancellation, the Subscription will not be terminated prematurely. Subscription fees already paid will not be refunded, unless Article 7 (right of withdrawal) applies.
Article 7 - Right of withdrawal (Consumers)
Are you a private individual? You then have 14 days to cancel your purchase — but only if you have not yet used the service during that period.
7.1 Consumers have the right to withdraw from the agreement within 14 days after concluding the Subscription without giving reasons.
7.2 The right of withdrawal expires if the User has expressly agreed to the immediate performance of the Service and has acknowledged that he thereby loses his right of withdrawal. When creating an Account and starting to use the Service, the User gives this consent.
7.3 Revocation of Subscriptions concluded via the web app or via Stripe is made by written notification via support@admemo.nl within the revocation period. Slim Solutions confirms receipt and processes any refund within 14 days.
7.4 For Subscriptions purchased through Apple In-App Purchases or Google Play Billing, refunds will be processed through Apple or Google respectively, in accordance with their own refund policies. In appropriate cases, Slim Solutions can provide support in submitting a refund request.
7.5 This article does not apply to business Users.
Article 8 — Prices and payment
All prices are exclusive of VAT, unless stated otherwise. Payments are made via Apple, Google or Stripe — depending on where you take out the subscription. In the event of non-payment, access may be blocked and collection costs may be charged.
8.1 All prices stated are exclusive of VAT and other government levies, unless expressly stated otherwise.
8.2 Payment is made in advance via the Payment Processor applicable to the platform chosen by the User:
- iOS App: Apple In-App Purchases (Apple Inc.);
- Android app: Google Play Billing (Google LLC);
- Web app and instant upgrades: Stripe (Stripe Payments Europe Ltd.).
For annual subscriptions, the full amount will be invoiced at the start.
8.3 Slim Solutions never processes credit card, card or bank account numbers itself. These are handled solely by the Payment Processor under their own terms and privacy policies. See the Privacy Statement for more information.
8.4 In the event of late payment, the User is legally in default. Slim Solutions is entitled:
- immediately suspend access to AdMemo;
- to charge statutory commercial interest from the due date;
- to charge extrajudicial collection costs in accordance with the Decree on compensation for extrajudicial collection costs.
8.5 Slim Solutions is entitled to index the rates annually based on the CPI index (CBS). An increase of more than 10% compared to the current price (excluding indexation) will be announced in writing at least 30 days in advance. In that case, the User has the right to cancel the Subscription as of the effective date of the price increase.
8.6 Slim Solutions reserves the right to pass on cost changes of external AI services or Payment Processors to the User, provided that timely written notice is given.
Chapter 4 — The Service
Article 9 – Nature and delivery of the Service
AdMemo is a tool — not an accountant. The AI can make mistakes. Always check the output before using it for your administration or tax return.
9.1 Slim Solutions provides the Service on a best efforts basis and does not guarantee uninterrupted or error-free operation.
9.2 The Service uses AI processing. User acknowledges and accepts that:
- AI models operate probabilistically and may generate incorrect, incomplete or inconsistent output;
- AI output is not a substitute for professional financial, tax or legal advice;
- The User remains ultimately responsible for the accuracy of their administration at all times;
- User generated output should be checked before using it for invoices, tax returns or other official purposes.
9.3 Slim Solutions has the right to (partially) modify, expand or change functionalities of the Service. Material changes will be announced at least 30 days in advance. In the event of significant deterioration, the User can cancel the Subscription as of the effective date of the change.
9.4 Slim Solutions strives for an availability of at least 99% on a monthly basis, excluding planned maintenance and disruptions at subprocessors. There is no formal SLA, unless otherwise agreed in writing.
Article 10 — External AI Services and Sub-Processors
For the AI functions, AdMemo uses third-party services such as Deepgram and Google. We have no influence on their availability or any changes.
10.1 The Service uses Subprocessors for AI processing, hosting, object storage, email sending, payment processing and other technical functionalities, as stated in Appendix D of the Processor Agreement.
10.2 Slim Solutions has no influence on the operation, availability, pricing or output of external AI services or Payment Processors. Disruptions, limits or changes to these services are beyond the responsibility of Slim Solutions.
10.3 Slim Solutions is entitled to change or replace Subprocessors, provided this is in accordance with the VWO and the User is notified in advance in accordance with Article 7 of the VWO.
10.4 Customer data is not used for training AI models by Slim Solutions or its Subprocessors. Audio recordings and raw transcriptions are not stored permanently; only the extracted administrative data is kept.
Article 11 — Obligations and Acceptable Use
Only use AdMemo for legitimate administration purposes. Abuse will result in immediate account suspension.
11.1 The User is obliged to use AdMemo in accordance with the law, these General Terms and Conditions and the reasonable instructions of Slim Solutions.
11.2 The User is not permitted to use AdMemo for:
- fraudulent, misleading or unlawful purposes;
- processing data from third parties without a legal basis;
- actions that overload or disrupt the systems of Slim Solutions, Subprocessors or third parties;
- circumvent or reverse engineer the security or operation of AdMemo;
- reselling, sublicensing or otherwise commercially exploiting the Service for the benefit of third parties.
11.3 The User guarantees the legality of the Customer Data that they enter into AdMemo and indemnifies Slim Solutions against claims from third parties arising from unlawful data processing by the User.
11.4 Slim Solutions reserves the right to block actions or suspend accounts in the event of (suspected) violation of this article, without prior notice and without liability for resulting damage.
Chapter 5 — Intellectual Property
Article 12 — Ownership of AdMemo
AdMemo and everything in it is ours. Your data is and remains yours.
12.1 All intellectual property rights in AdMemo — including the software, design, AI prompts, workflow architecture, logos and documentation — belong solely to Slim Solutions or its licensors.
12.2 The User only receives a non-exclusive, non-transferable and revocable right of use to use AdMemo for their own administrative purposes, for the duration of the Subscription.
12.3 User is not permitted to copy, reverse engineer, modify, resell or otherwise commercially exploit AdMemo or any part thereof.
12.4 All Customer Data remains the property of the User at all times. Slim Solutions only obtains the right to process this data for the performance of the Service, in accordance with the VWO.
Chapter 6 — Liability
Article 13 — Liability of Slim Solutions
Our liability is limited. We are not liable for consequential damage, errors in AI output or disruptions to external services. Legal minimum rights apply to consumers.
13.1 Slim Solutions is only liable for direct damage that is the direct result of an attributable shortcoming in the fulfillment of the agreement.
13.2 Slim Solutions is not liable for:
- errors, inconsistencies or hallucinations in AI-generated output;
- disruptions, downtime or changes to external AI services, Payment Processors or Sub-processors;
- consequential damage, indirect damage, lost profits, lost savings or damage to reputation;
- damage resulting from incorrect or incomplete Customer Data entered by the User;
- damage resulting from unauthorized use of the User's Account.
13.3 Maximum liability: If Slim Solutions is liable, that liability is limited per event to the amount that the User has paid for the Subscription in the three (3) months prior to the damaging event.
13.4 Consumer: The limitations in this article do not apply to Consumers to the extent that the law grants mandatory minimum rights that cannot be limited contractually.
13.5 Prescription: Any claim for compensation lapses if it is not reported to Slim Solutions in writing within twelve (12) months after discovery of the damage.
Article 14 — Indemnity
If your use of AdMemo leads to third-party claims, you are responsible — not us.
14.1 The User indemnifies Slim Solutions against all claims from third parties arising from the use of AdMemo by the User, including but not limited to:
- unlawful processing of personal data of third parties;
- violation of intellectual property rights of third parties;
- infringement of laws and regulations by the User.
14.2 Reasonable costs incurred by Slim Solutions for legal assistance in connection with such claims will be borne by the User.
Article 15 — Force majeure
If we are unable to provide the service due to circumstances beyond our control, we will not be liable.
15.1 Slim Solutions is not liable for shortcomings resulting from force majeure. Force majeure is in any case understood to mean: disruptions to the internet or electricity infrastructure, disruptions to Subprocessors, external AI services or Payment Processors, government measures, strikes and pandemics.
15.2 In the event of force majeure, Slim Solutions' obligations will be suspended. If the force majeure situation lasts longer than thirty (30) days, both parties have the right to terminate the agreement in writing without obligation to pay damages.
15.3 Force majeure does not entitle the User to a refund of subscription fees already paid, unless the parties agree otherwise.
Chapter 7 — Privacy & Secrecy
Article 16 — Data Protection
How we handle your personal data is described in detail in the Processing Agreement and our Privacy Statement. These documents are leading in this area.
16.1 Slim Solutions processes personal data partly as a processor (for Customer Data that the User enters in the Application) and partly as a controller (for, among other things, account details, payment status and support correspondence). The Processing Agreement applies to the processor role; on the responsible role the Privacy Statement.
16.2 In the event of any conflict between the VWO and these General Terms and Conditions, the VWO will prevail with regard to the processing of personal data.
16.3 The User guarantees that all personal data entered in AdMemo has been obtained lawfully and may be processed. Slim Solutions is not liable for damage resulting from unlawful data processing by the User.
16.4 Customer data is not used for training AI models. Audio recordings and raw transcriptions are not stored permanently. For other privacy aspects, we refer to the Privacy Statement of AdMemo and the VWO.
Article 17 — Confidentiality
We keep the information you entrust to us confidential. Conversely, we expect the same from you with regard to our systems and working methods.
17.1 Both parties undertake to maintain confidentiality of confidential information they receive in the context of the agreement. Information is considered confidential when this has been communicated or is apparent from the nature of the information.
17.2 Confidential information of Slim Solutions includes in any case: the working method, architecture, AI prompts and technical configurations of AdMemo.
17.3 The obligation of confidentiality does not apply to information that: was already public, was developed independently, was lawfully obtained from a third party, or must be made public based on legislation or regulations.
17.4 The confidentiality obligation remains in effect for three (3) years after termination of the agreement.
Chapter 8 — Final provisions
Article 18 — Changes to the General Terms and Conditions
We may change these terms. You will always be notified at least 30 days in advance. If you don't agree, you can cancel your subscription.
18.1 Slim Solutions is entitled to change these General Terms and Conditions. Changes will be announced to the User in writing (by e-mail) at least 30 days in advance.
18.2 In the event of material changes to the detriment of the User, the User has the right to cancel the Subscription with effect from the date on which the change takes effect.
18.3 Continued use of AdMemo after the effective date constitutes acceptance of the amended terms.
Article 19 — Transfer
19.1 Slim Solutions is entitled to transfer rights and obligations under the agreement to a group company or legal successor, without prior permission from the User.
19.2 User is not entitled to transfer rights or obligations under the agreement to third parties without prior written permission from Slim Solutions.
Article 20 — AI Act (EU)
If you want to use AdMemo for applications that the EU AI Act designates as 'high-risk', you as a user are responsible for compliance with those regulations.
20.1 AdMemo is an administration processing tool and is not specifically designed as a high-risk AI system within the meaning of the EU AI Act.
20.2 User is solely responsible for assessing whether its use of AdMemo is subject to the obligations of the EU AI Act or other applicable AI regulations, and for compliance with those obligations.
20.3 Slim Solutions is not liable for any non-compliance with the EU AI Act by the User.
Article 21 — Applicable law and disputes
Dutch law applies to these conditions. We submit disputes to the court in Amsterdam, unless the law provides otherwise.
21.1 All agreements and these General Terms and Conditions are exclusively governed by Dutch law.
21.2 Disputes will be submitted to the competent court in the Amsterdam district, unless mandatory law - including consumer protection provisions - designates another competent court.
21.3 Before submitting a dispute to the court, the parties enter into consultations in order to resolve the dispute amicably.
Slim Solutions B.V. · Wijttenbachstraat 53 B, 1093 HV Amsterdam · Chamber of Commerce 99976781 · support@admemo.nl
These General Terms and Conditions were last changed on May 3, 2026. Version 1.1.
Part B - Data Processing Agreement
Definitions
The following terms are used in this agreement:
Application: The Slim Solutions Administration Agent (AdMemo), a SaaS application for recording and processing administrative data.
GDPR: The General Data Protection Regulation (Regulation (EU) 2016/679).
EEA: The European Economic Area.
Sub-processor: A third party engaged by the Processor for the processing of Personal Data.
Processor: Slim Solutions B.V., located at Wijttenbachstraat 53 B, 1093 HV Amsterdam, Chamber of Commerce number 99976781.
Controller: The party that enters into this agreement with the Processor and uses the Application.
Clause 1 — Scope and interpretation
1.1 Purpose and scope This agreement governs the processing of Personal Data by the Processor on behalf of the Controller and ensures compliance with Article 28 of the GDPR.
1.2 Interpretation Terms defined in the GDPR have the same meaning in this Agreement as in the GDPR.
1.3 Precedence in case of conflict In the event of any conflict between this agreement and other agreements between the parties, this agreement shall take precedence as far as the processing of Personal Data is concerned.
Clause 2 — Subject matter and scope of the processing
2.1 Processing through the Application The Processor processes Personal Data on behalf of the Controller through the Application.
2.2 Specification in Appendix B The details of the processing, including the categories of Personal Data, the categories of data subjects, the nature and purpose of the processing and the duration of the processing, are specified in Appendix B.
Clause 3 — Instructions from the Controller
3.1 Written instructions The Processor processes Personal Data exclusively on the basis of written instructions from the Controller. These instructions consist of:
- the use of the Application by the Controller; and
- the processing purposes as specified in Appendix B.
3.2 Purpose limitation The Processor processes Personal Data exclusively for the purposes specified in Appendix B. The Processor does not use Personal Data for its own purposes and does not make independent decisions about the purposes or means of the processing.
3.3 Further instructions The Controller may at any time provide further written instructions regarding the processing of Personal Data.
3.4 Legal obligation If the Processor is required by a legal obligation to process Personal Data in a manner that deviates from the instructions of the Controller, the Processor shall inform the Controller in advance, unless the law prohibits this notification.
3.5 Notice of conflicting instructions If the Processor believes that an instruction from the Controller is contrary to the GDPR or other applicable data protection law, the Processor will immediately inform the Controller thereof.
Clause 4 — Responsibilities of the Parties
4.1 Responsibility of the Controller The Controller is and remains responsible for the lawfulness of the processing of Personal Data, including having a valid processing basis and informing data subjects.
4.2 Accuracy of data and instructions The Controller guarantees that the Personal Data provided to the Processor is correct and that the instructions given are lawful.
4.3 Responsibility of the Processor The Processor is responsible for compliance with the obligations under this agreement and the GDPR to the extent that they apply to processors.
4.4 Geen medeverantwoordelijkheid Nothing in this agreement results in the Processor being regarded as a (co-)controller.
Clause 5 — Confidentiality
5.1 Toegangsbeperking The Processor guarantees that only persons who need access to Personal Data for the execution of this agreement are given access to this Personal Data.
5.2 Geheimhoudingsverplichting The Processor ensures that all persons who process Personal Data are bound by an obligation of confidentiality and only process this Personal Data in accordance with the instructions of the Controller.
Clause 6 — Security of processing
6.1 Passende beveiligingsmaatregelen The Processor takes appropriate technical and organizational measures to ensure a risk-appropriate level of security for the processing of Personal Data, in accordance with Article 32 of the GDPR. This includes protection against destruction, loss, alteration or unauthorized disclosure of or access to Personal Data.
6.2 Risico-afweging When determining and implementing security measures, the Processor takes into account the state of the art, the implementation costs, the nature, scope, context and purpose of the processing, as well as the risks to the rights and freedoms of natural persons that vary in likelihood and severity.
6.3 Specification in Appendix C The technical and organizational measures are specified in Appendix C and form an integral part of this agreement.
6.4 Aanpassing van maatregelen The Processor is entitled to adjust the measures described in Appendix C, provided that:
- the overall security level is not reduced;
- the adjustment remains in accordance with the requirements of the GDPR; and
- the Processor informs the Controller of material changes in the security measures.
Clause 7 – Engagement of Sub-processors
7.1 Algemene toestemming The Controller hereby grants the Processor general permission to engage sub-processors for the processing of Personal Data in the context of this agreement.
7.2 Lijst van subverwerkers The Processor maintains an up-to-date list of sub-processors in Appendix D, which includes at least the name of the sub-processor, the nature of the processing and the location of the processing.
7.3 Voorafgaande kennisgeving The Processor shall notify the Controller in writing at least 30 days in advance of any intended changes regarding the addition or replacement of sub-processors. In urgent cases where immediate adjustment is necessary, a shorter period with immediate notification afterwards applies.
7.4 Recht van bezwaar The Controller has the right to object to the intended change within the period referred to in Article 7.3 on legitimate grounds related to data protection.
7.5 Bezwaarprocedure If the Controller objects, the Parties will enter into consultation to find a solution. Possible solutions include deploying an alternative subprocessor or disabling the affected functionality. If no solution is found within 30 days, the Controller has the right to terminate this agreement with 30 days' notice.
7.6 Overeenkomst met subverwerkers The Processor shall ensure that an agreement is concluded with each sub-processor imposing at least the same data protection obligations as those arising from this agreement. The Processor remains fully responsible to the Controller for the fulfillment of the obligations by sub-processors.
7.7 Derdenbeding voor dataopslag For sub-processors that store Personal Data, the Processor enters into a third-party clause whereby, in the event that the Processor has ceased to exist or has become insolvent, the Controller has the right to terminate the agreement with the sub-processor and order the sub-processor to return the Personal Data.
7.8 Continuïteit bij beëindiging Upon termination of this agreement, the Processor will ensure that the Controller retains access to or receives a copy of all Personal Data, regardless of which sub-processor it resides.
Clause 8 — International transfer
8.1 Doorgifte buiten de EER The Processor ensures that transfers of Personal Data outside the European Economic Area take place in accordance with Chapter V GDPR.
8.2 Waarborgen voor doorgifte The Processor takes appropriate safeguards for international transfers, such as standard contractual clauses or an adequacy decision from the European Commission. The safeguards applied per sub-processor are listed in Appendix D.
8.3 Doorgifte via subverwerkers The Controller agrees that sub-processors may use standard contractual clauses for transfers of Personal Data outside the EEA.
Clause 9 – Assistance to the Controller
9.1 Doorsturen van verzoeken The Processor shall immediately inform the Controller of any request from a data subject that the Processor receives. The Processor does not respond to the request itself, unless the Controller has given permission to do so.
9.2 Bijstand bij rechten van betrokkenen The Processor shall assist the Controller in fulfilling obligations relating to the rights of data subjects. This assistance consists of providing available information and technical support, taking into account the nature of the processing.
9.3 Bijstand bij overige verplichtingen The Processor shall, where applicable, provide assistance in complying with data security obligations, breach notifications and conducting data protection impact assessments.
9.4 Geen juridisch advies The Processor does not provide legal advice or make decisions on behalf of the Controller. The Controller remains responsible for compliance with the GDPR at all times.
Clause 10 – Notification of personal data breaches
10.1 Notification to the Controller The Processor shall notify the Controller without undue delay, and at the latest within 48 hours, as soon as the Processor becomes aware of a Personal Data breach.
10.2 Inhoud van de kennisgeving The notification shall contain at least the following information, where available:
- a description of the nature of the breach, including the categories and approximate number of data subjects and personal data involved;
- contact details for obtaining more information;
- the likely consequences of the infringement and the measures taken or proposed to address the infringement and limit its consequences.
10.3 Gefaseerde kennisgeving The Processor shall provide available information without delay and additional information as soon as it becomes available.
10.4 Ondersteuning bij onderzoek The Processor will provide support in investigating and documenting the breach, to the extent it relates to processing under this agreement.
10.5 Notification duty to the Controller The Controller is responsible for assessing whether notification to the supervisory authority or data subjects is necessary and for making such notifications.
Clause 11 — Termination
11.1 Termination in case of breach The Controller may terminate this agreement if the Processor materially breaches its obligations under this agreement and does not cure such breach within 30 days of written notice.
11.2 Deletion or return of data After termination of this agreement, the Processor will delete all Personal Data or return it to the Controller, at the Controller's option. The return will take place within 30 days in a structured and common format. AdMemo currently provides data exports in Excel format (XLSX). Upon request, the Parties can discuss whether another common format can be supplied.
11.3 Confirmation of deletion The Processor confirms in writing to the Controller that all Personal Data has been deleted or returned.
11.4 Statutory retention obligation The Processor may retain Personal Data if and to the extent that a legal obligation requires this. In that case, the Personal Data will only be processed for the purpose of the retention obligation.
Appendix B — Description of the processing
1. Categories of data subjects
The following categories of natural persons are processed:
- Users of the Application (self-employed professionals, entrepreneurs and freelancers)
- Customers of the user (natural persons for whom the user performs work)
- Suppliers of the user (natural persons on invoices and receipts)
2. Categories of personal data
Depending on the use of the Application, the following categories of personal data are processed:
a) Identification data - First and last name - Address details - Email address - Phone number
b) Financial data - IBAN (bank account for billing) - VAT number - Amounts on invoices and receipts - Hourly rates - Imported bank transactions, including date, amount, currency, counterparty, description and reference - Masked and pseudonymised identifiers of own accounts and counterparty accounts
c) Administrative data - Descriptions of activities - Hours and dates worked - Project descriptions - Material use and expenses
d) Images - Photos of receipts and invoices (if user uses this functionality)
e) AI-generated data - Structured administrative output based on speech or image input
3. Processed sensitive data
No special categories of personal data within the meaning of Article 9 GDPR are processed (such as health data, criminal data, etc.).
4. Nature of the processing
a) Receipt and collection Receiving data via manual input, voice input, image upload (receipts, invoices), or a bank statement file selected by the Controller.
b) Analysis and extraction Transcribe speech input using AI; analyzing images (OCR) using AI; extracting relevant administrative data from speech and images; technically parsing, deduplicating and proposing matches for structured bank transactions.
c) Structuring and storage Structuring extracted data into administrative categories (customer, project, hours, amounts); storing structured data in a database (within the EU); storing images, generated PDF invoices and (temporarily) audio files in object storage within the EU. An uploaded bank-statement source file is not stored permanently; only the structured transaction and review data remain stored.
d) Generation and presentation Generating timesheets, invoices and administrative overviews; presenting output to user via the Application.
e) Deletion Deletion of data at the request of the user or after termination of the agreement.
Important notes on audio processing:
- Audio recordings are not stored permanently. With synchronous processing they are deleted immediately after transcription.
- With asynchronous processing (where the recording is temporarily placed in secure object storage for processing by a background system), the audio file is automatically deleted after processing. Metadata about the file (such as file name, size, and hash) is retained briefly for auditing and debugging purposes.
- Verbatim transcripts are not stored permanently — only extracted administrative data is recorded.
- Data is not used for training AI models.
- Limited use for debugging can be done with anonymized test data.
5. Purposes of the processing
The Personal Data will only be processed for the following purposes:
- Project administration: recording activities per customer and project; registering hours and dates worked.
- Financial administration: keeping track of expenses and material costs; registering hourly rates and amounts.
- Invoicing: generating invoices for the user's customers; processing bank details (IBAN) for payment instructions.
- Bank statement processing: importing, deduplicating, reviewing and matching bank transactions with invoices, expenses or other administrative categories selected by the user.
- Reporting: creating time sheets; generating administrative overviews and export files.
- Technical support: limited use of anonymized data for debugging and error tracing, only after explicit notification by the user.
6. Duration of processing
Personal data will be processed for as long as the Controller's account is active, and until 30 days after termination of this agreement (in accordance with Clause 11.2).
Uitzondering wettelijke bewaarplicht: If a legal retention obligation applies (for example a fiscal retention obligation of 7 years for invoices), personal data may be retained for longer, solely for the purpose of that retention obligation and without further processing.
Appendix C — Technical and Organizational Measures
1. Access security and authorization
- Access to personal data limited to authorized persons (least privilege principle)
- Multi-factor authentication (MFA) for access to production systems
- Authenticate users via session tokens; these do not contain direct contact details (such as email address) but only an internal user identifier and role information
- Periodic access control: at least every six months; Accounts that are no longer needed will be deleted immediately
2. Encryption and passwords
- All communications via TLS (transport-layer encryption)
- Passwords stored using PBKDF2-SHA256, an OWASP recommended password hash function
- Backups stored encrypted
- Data sent to AI services via TLS; zero-retention policy at sub-processors where contractually agreed
Encryption of sensitive financial fields in the database (including IBAN) is planned and on the roadmap for implementation. Until then, this data is protected by the access controls described above, TLS, and the physical and logical security of the hosted EU database.
3. Storage and data minimization
- Design in accordance with data minimization principle
- Audio recordings and verbatim transcriptions not stored permanently
- Primary database on VPS within the EU (Hostinger, Frankfurt/Lithuania, ISO 27001)
- Object storage for receipts, invoices, generated PDFs and (temporary) audio files via Backblaze B2 in the EU region (Frankfurt)
4. Backups and recovery
- Daily automated backups (retained for 7 days)
- Weekly full backups (retained for 30 days)
- Backups stored encrypted in EU object storage (Backblaze B2, Frankfurt)
- Backup recovery procedures tested at least semi-annually
- Recovery time (RTO): 24 hours in case of complete system failure
5. Logging and monitoring
- Access logs (login attempts, time, IP address) — kept for 90 days
- No substantive personal data in log files
- Monitoring for anomalies and suspicious activities
6. Incident response
In the event of a data breach: identify and contain (within 2 hours) → analyze impact → inform customers (within 48 hours at the latest, in accordance with Provision 10) → root cause analysis → documentation.
7. Security of AI services
- Only AI services with their own DPA and (where contractually agreed) zero-retention policy
- No IBAN or other sensitive financial data in AI prompts
- All communication with AI services via TLS
Appendix D — List of Subprocessors
Last updated: May 3, 2026
1. AI service providers
1.1 Deepgram
| Field | Value |
|---|---|
| Name | Deepgram, Inc. |
| Address | 1323 Walnut Street, Suite 600, Philadelphia, PA 19107, USA |
| Type of service | Speech to text |
| Goal | Transcription of speech input in the main voice flow and onboarding |
| Storage | No permanent storage intended; operational logging in accordance with service conditions |
| Location | United States |
| Transfer outside the EEA | Yes — Standard Contractual Clauses (EU-US) |
| DPA | deepgram.com/legal/data-processing-addendum |
| Essential | Yes — transcription core functionality |
1.2 Google (Gemini API)
| Field | Value |
|---|---|
| Name | Google Ireland Limited / Google LLC |
| Address | Gordon House, Barrow Street, Dublin 4, Ireland |
| Type of service | AI processing (Gemini API) |
| Goal | Extraction and structuring of administrative data based on transcripts and documents; OCR of receipts and invoices |
| Storage | No training on customer data; limited operational logging |
| Location | Worldwide (possibly US) |
| Transfer outside the EEA | Possibly — EU-US Data Privacy Framework + SCCs |
| DPA | cloud.google.com/terms/data-processing-addendum |
| Essential | Yes — core data extraction functionality |
2. Hosting and infrastructure
2.1 Hostinger
| Field | Value |
|---|---|
| Name | Hostinger International Ltd. (Hostinger UAB) |
| Address | J. Jasinskio g. 16B, LT-01112 Vilnius, Lithuania |
| Type of service | VPS hosting |
| Goal | Application and primary database hosting |
| Types of data | All personal data processed within the Application |
| Storage | Permanent storage |
| Location | European Union (Frankfurt) |
| Security | TIER III data centers, ISO 27001 |
| Transfer outside the EEA | No |
| DPA | hostinger.com/legal/dpa |
| Essential | Yes — primary infrastructure |
2.2 Backblaze B2
| Field | Value |
|---|---|
| Name | Backblaze, Inc. |
| Address | 201 Baldwin Avenue, San Mateo, CA 94401, USA |
| Type of service | Object storage (S3 compatible) |
| Goal | Storage of receipt photos, generated PDF invoices, temporary audio files during async processing, and encrypted database backups |
| Types of data | Images of receipts and invoices, audio files (temporary), backup data |
| Storage | Permanente opslag (bonnetjes/facturen/backups); temporary (audio) |
| Location | EU region (Frankfurt, region eu-central-003) |
| Security | Server-side encryption, ISO 27001 certified |
| Transfer outside the EEA | Standard Contractual Clauses (EU-US) apply at vendor level, although data is physically located in EU |
| DPA | backblaze.com/company/dpa.html |
| Essential | Yes — primary object storage |
2.3 Strato AG
| Field | Value |
|---|---|
| Name | Strato AG |
| Address | Pascalstraße 10, 10587 Berlin, Germany |
| Type of service | SMTP service for outgoing e-mail |
| Goal | Sending transactional emails (welcome email, password reset, account notifications, trial expiration emails) |
| Types of data | E-mail address and name of recipient; no billing or payment information |
| Storage | Operational email logs in accordance with terms of service |
| Location | European Union (Germany) |
| Transfer outside the EEA | No |
| DPA | Auftragsverarbeitungsvertrag accepted on March 11, 2026 (strato.de) |
| Essential | Yes — send transactional emails |
3. Payment Processors
3.1 Stripe
| Field | Value |
|---|---|
| Name | Stripe Payments Europe Ltd. |
| Address | 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland |
| Type of service | Payment processing |
| Goal | Processing of subscription payments via web app and direct upgrade flows (including the trial expiration email flow) |
| Types of data | User's name, email address, billing address, card or payment details, IP address and transaction information |
| Storage | Stripe processes and stores this data as an independent controller under its own privacy policy; Processor only receives and stores customer and subscription identifiers, payment status and (where applicable) billing information |
| Location | European Union (primary) and United States |
| Transfer outside the EEA | Standard Contractual Clauses + EU-US Data Privacy Framework |
| DPA | stripe.com/legal/dpa |
| Essential | Yes — core web payments functionality |
In addition to Stripe, payments within the iOS app use Apple In-App Purchases (Apple Inc.) and payments within the Android app use Google Play Billing (Google LLC). In this capacity, these parties act as an independent controller of the payment data and not as a sub-processor of Slim Solutions. Processor only receives transaction identifiers, subscription status and anonymized account tokens from these parties.
Slim Solutions B.V. · Wijttenbachstraat 53 B, 1093 HV Amsterdam · Chamber of Commerce 99976781 · support@admemo.nl
Questions about these conditions? Contact us at support@admemo.nl