Privacy Policy
Last updated: 11 July 2026
1. What we collect
Account data: your name, email address and password hash. Company data: company names, VAT/CRN registration numbers, national addresses, branding assets. Business records you enter: customers, products, invoices, expenses, bank statement lines and journal entries — including your customers' names, contact details and tax numbers. Technical data: standard server logs (IP, timestamps) kept for security and debugging.
2. How we use it
Solely to operate the Service: generating compliant invoices and VAT returns, submitting e-invoices to ZATCA when you enable Phase 2, sending invoice emails and reminders you trigger, and providing support. We do not sell your data or use it for third-party advertising.
3. Where it lives
Data is stored in a Supabase (PostgreSQL) database hosted on AWS (Asia-Pacific region). Each company's records are isolated with database row-level security so one workspace can never read another's data. Backups are managed by Supabase. The application is served by Vercel.
4. Processors we rely on
Supabase (database, authentication, file storage) · Vercel (hosting) · Resend (transactional email, only when you send invoices/reminders by email) · ZATCA Fatoora APIs (only for invoices you submit for clearance/reporting). Each processor receives only what it needs to perform its function.
5. Retention
Your records are kept for as long as your workspace exists. Invoice and tax records may be retained after account deletion only to the extent required by KSA/UAE statutory record-keeping periods, then deleted. You can export everything (CSV, PDF, XML) at any time.
6. Security
Passwords are hashed, transport is TLS-encrypted, tenant data is isolated by row-level security, ZATCA credentials are stored encrypted with no direct client access, and authenticated pages are served with no-store cache headers. Report vulnerabilities to the contact below.
7. Your rights
You may access, correct, export or delete your personal data. Company administrators manage their team members' profiles. For personal-data requests under the KSA Personal Data Protection Law (PDPL) or applicable UAE data protection regulations, contact us and we will respond within a reasonable period.
8. Contact
Privacy questions and requests: tghha6854@gmail.com. See also our Terms of Service.