Privacy & Data Protection Policy
Our binding commitment to safeguarding your financial records, personal data, and business privacy
Overview & Scope
This Privacy Policy outlines how ToLedger collects, processes, stores, and protects personal and commercial financial data when organizations use our cloud accounting software, website, APIs, and associated customer portal.
Data Categories Collected
We collect: (a) Account identity information (name, work email, phone number, company name); (b) Financial and accounting transaction records (invoices, expenses, journal lines, chart of accounts, tax identifiers); (c) Subscription and billing information; and (d) Technical log data (IP addresses, login timestamps, user-agent details for security audits).
Legal Basis for Processing
Data processing is carried out pursuant to: (a) Contractual necessity to deliver the accounting service agreed upon in the Terms of Service; (b) Compliance with statutory regulatory obligations, such as ZATCA electronic invoicing frameworks and local tax record retention laws; and (c) Legitimate interests in protecting application integrity and preventing unauthorized intrusions.
Security Measures & Database Isolation
ToLedger implements a strict database-per-tenant architecture. Financial records for each customer are housed within an isolated PostgreSQL database, precluding data cross-contamination. All data is encrypted in transit using TLS 1.3 and at rest with AES-256 standards. Administrative access is restricted via multi-factor authentication and role-based policies.
Data Retention & Archival Policies
Financial and tax records are retained throughout the active duration of the customer subscription and for statutory retention periods mandated by applicable tax authorities (typically 5 to 10 years). Customers may request complete data purges or export their complete archives upon subscription termination.
Customer & User Rights
Under regional privacy frameworks, customers maintain the right to: (a) Access and inspect all recorded personal and company data; (b) Request rectification of inaccurate records; (c) Export accounting data in open formats; and (d) Request deletion of personal credentials subject to legal retention obligations.
Enterprise Data Protection Agreements (DPA)
Corporate and enterprise customers may request an executed Data Processing Agreement (DPA) incorporating standard contractual clauses, custom audit inspection provisions, and specific residency hosting requirements.