Privacy Policy

1. Two kinds of data, two roles

• Your account data (your name, e-mail, login): we decide how it is used, so we are the controller.
• Your business data (customers, suppliers, invoices, stock, staff, bank and tax details that you enter): you are the controller and we are your processor. We use it only to run the service for you and on your instructions. You are responsible for having a lawful reason to enter it.

2. What we collect

• Account: e-mail address, password (stored only as a secure hash, we cannot read it), company and branch names, your role.
• Business records you create: accounting entries, documents, contacts, tax registration numbers, stock and sales data.
• Technical: log-in times, the audit log of who created or changed a record, error logs and basic device and browser details.
• Cookies: only the ones needed to keep you logged in. We do not use advertising cookies.

3. Why we use it

• To provide, secure and support the service and to keep the audit trail your accounting needs.
• To send service e-mails (confirmation, password reset, important notices).
• To meet legal obligations and to prevent misuse.

We do not sell personal data.

4. Who else handles it

We use trusted providers to run the service: a database and login provider (Supabase), a hosting provider (Vercel) and an e-mail sender. They process data only to provide those services. Because some of these providers operate outside the UAE, data may be stored or processed in another country, such as in Europe or India, under contracts that require appropriate protection. We may also disclose data when a court or authority lawfully requires it.

5. Security

Data is encrypted in transit (HTTPS), each company's data is separated from every other company's by database access rules, and access is limited to the roles you assign. No system is perfectly secure; if a breach affects you we will tell you as the law requires.

6. How long we keep it

We keep your data while your subscription is active. After cancellation we keep it for 90 days, then delete it, except where the law requires longer retention (for example, UAE tax and commercial rules can require accounting records to be kept for several years). Posted accounting entries are never altered; they are corrected by reversal.

7. Your rights

You can ask us to give you a copy of your personal data, correct it, delete it, restrict how we use it, or object to a use. Write to [support e-mail address]. If you are an employee or customer of one of our clients, please contact that business first, as it controls that data. Some records must be kept by law, so we may not be able to delete everything on request.

8. Changes

We may update this policy and will show the date above. For important changes we will tell you in the app or by e-mail.

9. Contact

[Company legal name], [Registered address, United Arab Emirates]. E-mail: [support e-mail address].