How Numbers Game handles your data and your clients’.
Numbers Game B.V., effective 19 May 2026. Last reviewed 8 October 2026. We collect what we need to keep your books, and nothing else.
At a glance
We are Numbers Game B.V., a Dutch private limited company. Because we are established in the EU, the GDPR governs everything we do, even though most of our customers are US accounting firms.
We act in two roles: as a controller for our Firm users and our prospects; and as a processor for the QuickBooks Online and Xero client records the Firm authorizes us to handle.
We provide secure MCP tools to the AI client a Firm chooses, such as Claude or ChatGPT. The Firm’s chosen AI provider receives data through that client under the Firm’s relationship with that provider. Numbers Game does not send ordinary ledger data to Anthropic or OpenAI for model inference.
We do not sell personal information and do not share it for cross-context behavioral advertising.
You can reach our privacy team at [email protected].
01Who we are
Numbers Game B.V. (KvK 81465688) operates the Numbers Game service at numbersgame.xyz/ai, an AI-assisted bookkeeping product that connects to QuickBooks Online and Xero on behalf of accounting firms and their clients. Xero is available in limited release.
Registered office
George Gershwinlaan 441
1082 MT Amsterdam
Netherlands
Privacy contact: [email protected]
We have not appointed a Data Protection Officer, because our processing activities do not meet the thresholds in Article 37 GDPR. The privacy contact above is our designated point of contact for all data protection enquiries.
Because our establishment is in the Netherlands, our lead supervisory authority is the Autoriteit Persoonsgegevens (Dutch DPA), Hoge Nieuwstraat 8, 2514 EL The Hague, autoriteitpersoonsgegevens.nl.
02Who this policy applies to, and our role
This policy describes how we handle personal information in three distinct contexts.
Firm users. Partners, accountants, and staff who use Numbers Game to keep books for clients. For Firm users, we are the controller.
Client records. Bookkeeping data the Firm authorizes us to access in QuickBooks Online or Xero, including chart of accounts, vendors or suppliers, customers, transactions, journal entries, and the actions we take on them. For client records, the Firm is the controllerand Numbers Game is the processor. The terms of our processing are set out in our Data Processing Agreement, which forms part of the Master Subscription Agreement. A current copy is available on request, email [email protected].
Prospects. Anyone who contacts us about the product, books a demo, or corresponds with our sales team. For these contexts, we are the controller.
Website visitors. We are the controller for information collected through our public marketing website. Section 10 explains our use of cookies, analytics, advertising measurement, session replay, visitor identification, and your choices.
03What we collect, why, and on what legal basis
The table below describes each category of personal information we collect, the purposes we use it for, and our lawful basis under Article 6 GDPR.
| Category | Examples | Purpose | Lawful basis (GDPR Art. 6) |
|---|---|---|---|
| Firm user account data | Name, work email, role at the firm | Provision the product, authenticate users, support, billing administration | Contract (6(1)(b)) with the Firm; legitimate interests (6(1)(f)) for support and account integrity |
| Product activity | Actions taken in the product, timestamps, rules invoked, items reviewed or posted | Maintain the audit trail, troubleshoot, detect misuse, secure the service | Contract (6(1)(b)); legal obligation (6(1)(c)) where audit records are needed for tax-adjacent compliance; legitimate interests (6(1)(f)) for security |
| QuickBooks Online and Xero client records (as processor) | Chart of accounts, vendors, customers, transactions, journal entries, attachments | Categorize transactions, reconcile accounts, draft reports, and write back to the connected ledger at the Firm’s instruction | Processed under the Firm’s instructions per Article 28 GDPR; the Firm determines its own lawful basis |
| Connected source data (as processor) | Bank and card transactions retrieved through Plaid (date, amount, description, merchant and counterparty names, account name and last four digits); records read from a client’s Stripe, Square or Ramp account | Code and book the client’s bank, payment and spend activity into the connected ledger, at the Firm’s instruction | Processed under the Firm’s instructions per Article 28 GDPR; the Firm determines its own lawful basis |
| Connected Slack workspace data | Channel IDs and message-post permissions for channels the Firm explicitly connects | Post notifications and approvals to the channels the Firm wires up | Contract (6(1)(b)) |
| Server logs | IP address, user agent, request URL, request timestamps, referrer | Operate the service, mitigate abuse, debug | Legitimate interests (6(1)(f)) in running a secure service |
| Sales and support correspondence | Email content, attachments, demo notes | Respond to enquiries, schedule meetings, qualify prospects | Legitimate interests (6(1)(f)); pre-contractual measures (6(1)(b)) where applicable |
| Billing records | Firm legal entity, billing address, invoices, payment status | Charge the Firm for the subscription | Contract (6(1)(b)); legal obligation (6(1)(c)) for invoice retention |
We do not request QuickBooks Online or Xero scopes we do not need. We do not read Slack channels we have not been wired into. We do not collect special-category personal data under Article 9 GDPR and ask Firms not to upload it through the product.
04How we use AI in the product
Numbers Game is an MCP tool provider, not a model host. A Firm chooses and connects its own AI client, such as Claude or ChatGPT, which requests approved information from Numbers Game and receives the resulting ledger data. The Firm’s relationship with that AI provider governs the provider’s model inference, retention, and training terms.
Xero consent. Before a Xero organisation can be connected, an owner or administrator must give explicit consent to the separate Xero data-sharing terms. The consent names the third-party AI provider that will receive Xero API data, is recorded against a versioned terms document, and can be withdrawn. Withdrawal stops Numbers Game from serving Xero data to that provider.
Tenancy isolation. Numbers Game stores Firm and client data in per-Firm tenancies. We do not commingle data across Firms and we do not share data across Firms’ tenancies.
Automated decision-making (Article 22 GDPR). The Firm’s selected AI client may suggest transaction categorizations, journal entries, and reconciliations. Numbers Game does not use AI to take legal or similarly significant decisions about individuals. If you believe a specific automated suggestion has produced an outcome that affects you, you can ask us to involve a human reviewer using the contact above.
05Who we share personal information with
We share personal information only with the recipients listed below, and only as needed for the purposes in section 3.
| Recipient | Role | Location | Transfer mechanism |
|---|---|---|---|
| Intuit Inc. (QuickBooks Online) | The system of record we read from and write to | United States | EU–US Data Privacy Framework (where applicable) and/or Standard Contractual Clauses (Module 2/3) |
| Xero (Xero (NZ) Limited) | The system of record we read from and write to for Xero organisations in limited release | New Zealand and locations of Xero group companies and hosting providers | New Zealand adequacy decision; Standard Contractual Clauses or equivalent safeguards for other restricted transfers under Xero’s data processing terms |
| Plaid Inc. | Retrieves transactions, read only, from the US bank and card accounts a Firm connects for the bank feed | United States | Standard Contractual Clauses; EU–US Data Privacy Framework where the recipient has certified |
| Stripe, Inc. and its affiliates | Billing for the Numbers Game subscription; and, where a Firm connects a client’s Stripe account, the source system we read from and write to at the Firm’s confirmed instruction | United States and Ireland | Standard Contractual Clauses; EU–US Data Privacy Framework where the recipient has certified |
| Block, Inc. (Square) | Where a Firm connects a client’s Square account, the source system we read from and write to at the Firm’s confirmed instruction | United States | Standard Contractual Clauses; EU–US Data Privacy Framework where the recipient has certified |
| Ramp Business Corporation | Where a Firm connects a client’s Ramp business, the source system we read from, read only | United States | Standard Contractual Clauses; EU–US Data Privacy Framework where the recipient has certified |
| Salesforce (Slack Technologies) | Notification and approval messaging, only in workspaces the Firm connects | United States | EU–US Data Privacy Framework and Standard Contractual Clauses |
| Oracle Cloud Infrastructure | Hosting, compute, and encrypted storage | Primary region: OCI Amsterdam (eu-amsterdam-1). US region available for US-tenancy customers on Enterprise | Within EEA where region is EU; otherwise SCCs |
| Cloudflare, Inc. | Edge network, DDoS mitigation, WAF | Global edge; configuration HQ United States | EU–US Data Privacy Framework and Standard Contractual Clauses |
| Resend, Inc. | Transactional email delivery (account, billing, security notices) | United States | Standard Contractual Clauses; EU–US Data Privacy Framework where the recipient has certified |
| Better Stack, Inc. | Server log search and alerting | European Union (Germany) | Stored within the EEA; for any access from outside it, EU–US Data Privacy Framework where the recipient has certified, otherwise Standard Contractual Clauses (Module 2/3) |
| PostHog, Inc. (PostHog EU Cloud) | Product analytics, attributed to the Firm rather than to individuals, and masked session replays of the dashboard | European Union (Frankfurt, Germany) | Within EEA |
| Professional advisors | Auditors, lawyers, tax advisors, insurers, only where necessary | Netherlands and engagement-specific | Article 6(1)(f) legitimate interests; SCCs if outside the EEA |
| Regulators and law enforcement | Only where compelled by valid legal process | Engagement-specific | Article 6(1)(c) legal obligation |
A current sub-processor list, with each recipient’s role, location, and transfer mechanism, is available on request from [email protected]. Firm administrators are notified at least 30 days before a new sub-processor begins processing client records, with the opportunity to object as set out in the DPA.
We do not sell personal information. We do not use the personal information the product processes, including anything you or your clients enter into Numbers Game or that we read from QuickBooks Online or Xero, for advertising, cross-context behavioral advertising, or profiling of any kind. The one exception is our public marketing website, which carries Google and Meta (Facebook) advertising pixels that let us measure our advertising and show ads to visitors on Facebook and Instagram. That collection, and how to limit it, is described in section 10 (Cookies and tracking) of this policy.
06International transfers
Numbers Game B.V. is established in the Netherlands. Because we provide a service to firms in the United States and use US-based sub-processors, personal information is transferred to the United States and (depending on Cloudflare edge routing) other countries.
For each transfer outside the EEA, we rely on one or more of the following:
- The EU–US Data Privacy Framework (and the UK Extension, where UK personal data is in scope), for recipients that maintain a current self-certification;
- The 2021 Standard Contractual Clauses (Commission Decision 2021/914), with the appropriate module per relationship, supplemented by a Transfer Impact Assessment and supplementary technical measures (encryption in transit and at rest, key management, access controls, and minimization);
- Where applicable, derogations under Article 49 GDPR, but only for occasional and necessary transfers.
A copy of the SCCs and our TIA for a specific recipient is available to Firm controllers on request.
07Where data lives, and for how long
Tenancy. Firm and client data is stored by default in the Oracle Cloud Amsterdam region. US-tenancy and hybrid configurations are available to Enterprise customers.
Retention.
| Data | Retention |
|---|---|
| Firm user account data | Life of the Firm’s account, then deleted within 30 days of account closure |
| Client records (as processor) | Life of the Firm’s account. On termination, deleted or returned within 30 days at the Firm’s election, subject to the retention requirements below |
| Billing records | Seven (7) years after the end of the fiscal year, to meet Dutch fiscal record-keeping obligations (Article 52 AWR) and equivalent US obligations |
| Server logs (security and operational) | Request logs (IP address, user agent, URL) and application logs on our servers, including our local copy of shipped logs: 90 days, then deleted. Searchable copies with our log-search provider: 3 days |
| Backups | Encrypted database backups are deleted after 30 days; the copies kept on our own server, after 14 days. Personal information in backups becomes unreachable for new processing as soon as deletion completes in the primary store, and is gone when the last backup holding it is deleted |
| Sales and support correspondence | 24 months from last contact, unless a contract is in place |
We will not retain personal information longer than necessary. Where a legal hold, an audit obligation, or an ongoing legal claim requires longer retention, we will preserve the minimum data needed for that specific purpose and isolate it from operational systems.
08Security
Numbers Game is built around minimization, separation, and a tight audit trail.
- TLS 1.3 in transit; AES-256 at rest.
- OAuth refresh tokens for QuickBooks Online, Xero, and Slack are stored under envelope encryption with 90-day key rotation.
- Per-Firm tenancy isolation in storage and processing; no cross-tenant queries.
- Role-based access control on the product; production access by Numbers Game personnel is logged, time-bound, and reviewed.
- Continuous vulnerability monitoring and a coordinated disclosure program at [email protected].
- SOC 2 Type II audit in progress; report expected Q1 2027. Current attestations and the security overview are available at numbersgame.xyz/security.
Personal data breach handling. Where Numbers Game acts as controller, we will notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware of a personal data breach where required by Article 33 GDPR, and will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Article 34 GDPR). Where Numbers Game acts as processor, we will notify the affected Firm controller without undue delay, and in any event within 72 hours, of becoming aware of a personal data breach, with the information the Firm needs to meet its own 72-hour notification obligation.
09Your rights
Subject to the conditions in the applicable law, you have the rights listed below.
Under the GDPR / UAVG, you have the right to:
- access the personal data we hold about you (Article 15);
- have inaccurate personal data corrected (Article 16);
- have personal data erased in defined circumstances (Article 17);
- restrict our processing (Article 18);
- receive your personal data in a portable, machine-readable format and transmit it to another controller (Article 20);
- object to processing based on legitimate interests, including any profiling (Article 21);
- withdraw consent where processing is based on consent (Article 7(3)), withdrawal does not affect the lawfulness of processing before withdrawal;
- not be subject to a solely automated decision producing legal or similarly significant effects (Article 22), see section 4 for how we handle human review;
- lodge a complaint with the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or, if you live elsewhere in the EEA, with your local supervisory authority.
For US residents. Depending on where you live, US state privacy laws (CCPA/CPRA in California; VCDPA in Virginia; CPA in Colorado; CTDPA in Connecticut; UCPA in Utah; and equivalents in other states) give you the right to know what personal information we hold, request deletion or correction, opt out of ‘sale’ or ‘sharing’ (we do neither), and limit the use of sensitive personal information. We will respond to verifiable requests within the timeframes those laws require (typically 45 days, extendable once).
How to exercise these rights. Email [email protected]. Where you are a client of a Firm and the request concerns client records, we will route the request to the controlling Firm; we will support the Firm’s response, but we cannot act unilaterally on the Firm’s data.
We may need to verify your identity in a manner proportionate to the sensitivity of the request. We do not charge for handling a request unless it is manifestly unfounded or excessive (in which case we will tell you, and you can challenge our assessment).
10Cookies and tracking
The product itself (app.numbersgame.xyz) uses only strictly necessary cookies: session, authentication, CSRF protection, and load-balancer affinity. It carries no advertising, session-replay, or visitor-identification technology, and nothing you or your clients enter into Numbers Game is touched by any such tool.
Our public marketing website uses cookies and similar technologies for analytics, advertising measurement, visitor identification, session replay, and retargeting. These technologies may collect or receive your IP address, browser and device information, pages viewed, referral URL, timestamps, and pseudonymous identifiers or cookie IDs.
LinkedIn Insight Tag. The MCP landing page uses the LinkedIn Insight Tag. LinkedIn may use cookies and a first-party pseudonymous LinkedIn Ads ID to measure whether LinkedIn ads lead to visits or conversions, report on audiences, and create website-retargeting audiences. The tag is not used on product pages where people manage financial accounts or transactions. LinkedIn explains its cookies and related controls in its Cookie Table and its Privacy Policy.
Reddit Pixel. Certain marketing pages use the Reddit Pixel to record PageVisit activity, measure whether Reddit ads lead to visits or conversions, and create website-retargeting audiences. Reddit explains its data practices and controls in its Privacy Policy.
We also use Google, Meta, PostHog, and Instantly/Leadsy technologies on the marketing website for analytics, advertising measurement, session replay, and visitor identification. We do not use these technologies to track activity inside the Numbers Game product.
You can manage cookies in your browser and advertising preferences with the relevant platform, including LinkedIn. We do not treat continued browsing of the marketing website as consent to non-essential tracking.
11Direct communications and marketing
We may email Firm users about product updates, security notices, and account administration. These are service messages relating to the contract and you cannot opt out without closing the account.
Where we send a marketing email, a newsletter, an event invitation, a feature announcement to a prospect, you can unsubscribe via the link in every message, or by emailing [email protected]. We do not buy marketing lists.
12Children
Numbers Game is a business product for accounting firms. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, please contact us and we will delete it.
13Changes to this policy
We will publish material changes here and email the administrator on every active Firm account at least 30 days before they take effect. The ‘Last reviewed’ date at the top of this policy is the authoritative version marker. Continued use of the service after the effective date is acceptance of the updated policy. Where a change requires fresh consent under the GDPR, we will collect that consent before applying the change to your data.
14For accounting firms (controller-to-processor terms)
Firms using Numbers Game enter into a Data Processing Agreement (DPA) that incorporates the EU 2021 Standard Contractual Clauses (Module 2/3) and addresses:
- the subject-matter, duration, nature, and purpose of processing;
- the categories of data subject and personal data;
- our Article 28 GDPR obligations as processor, including sub-processor approval, breach notification, and assistance with data subject requests;
- audit rights, including acceptance of our SOC 2 Type II report where adequate, with on-cause audit rights preserved;
- deletion or return of data on termination.
A counter-signed copy is provided on contract execution. To request the current template before signing, write to [email protected].
15Contact
George Gershwinlaan 441
1082 MT Amsterdam
Netherlands
Privacy: [email protected]
Security disclosures: [email protected]
Sub-processor list: on request
Data Processing Agreement: on request
Security overview: numbersgame.xyz/security
If you believe we are not handling your personal information appropriately, please contact us first so we can try to resolve it, and remember you can always lodge a complaint with the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) or your local supervisory authority.