COUNT

GDPR overview

COUNT publishes no GDPR information at all: the regulation is never mentioned. Across the twenty pages collected, marketing, security, AI principles, help center and archived HTML included, GDPR and CCPA do not appear once. No Article 27 EU representative is designated and no data processing agreement is published or offered. The framework COUNT does display is SOC 2 Type II, through a public Secureframe Trust Center, which is a security standard rather than a data protection one. The privacy policy carries a New Zealand supplement governed by the NZ Privacy Act 2020, and the site serves two regions, the United States and New Zealand. Access and rectification requests go to privacy@getcount.com. One subprocessor, the support tool Crisp, hosts data in France, the only EU data location, with no documented GDPR framework around it. European buyers will have to ask for all of this directly.

Who owns the data?

COUNT states on its Security page that the data belongs to the customer: "Your data is yours to control. We're dedicated to ensuring you decide who can access specific information and when. We never share or sell your data to third parties." Access is governed by role-based permissions and detailed audit logs. Data can be exported at any time, including transactions, reports, invoices and documents, and read-only access to historical records is retained after cancellation. One caveat: none of this is confirmed by contract. The terms of service are rendered client-side in JavaScript and return no readable text, so no ownership or intellectual property clause could be checked.

Reuse rights

Bank and card connections are read-only. COUNT imports transactions and statements and states that it does not, will not and cannot change banking or financial data, so no money movement is possible. Other integrations are read-only as well unless the customer explicitly grants write access. Internally, AI categorizes transactions, matches them, flags anomalies and answers questions in natural language. The AI Principles page claims that no customer data is shared with external large language models and that all responses and insights are generated internally, while the Security page describes automatic redaction of sensitive information and intellectual property during LLM data collection, training, fine-tuning and inference. The Trust Center, however, lists OpenAI as a declared subprocessor for AI language model services with data held in the United States, alongside Azure, Mailersend, Stripe, Vercel and Crisp. Those two statements are difficult to reconcile from public documentation alone.

Data retention & training

Hosting summary

COUNT runs on Microsoft Azure, with data located in the United States according to its Trust Center, and the front end is deployed on Vercel, also in the United States. Storage sits behind Azure Web Application Firewalls. The data centers are described as having biometric access controls, permanent monitoring, redundant power, fire suppression and controlled climate. Data is replicated across several database servers spread over two geographic zones, and a nightly backup is written to tape and stored off site. Traffic is protected by 256-bit SSL in transit, and encryption at rest is one of the monitored Secureframe controls. Of the six declared subprocessors, one holds data in the European Union: Crisp, the support and messaging tool, hosted in France. The other named subprocessors, Mailersend for email, Stripe for payments and OpenAI for AI language model services, are located in the United States. In practice the accounting data itself lives in the United States, and the only EU footprint is support conversations, with no European legal framework attached to that French hosting anywhere on the site.