Privacy Policy

Last updated: 28 July 2026

Draft template. This page is a standard starting point for a SaaS privacy policy. It has not been reviewed by a lawyer and does not yet name the operating legal entity, data retention periods, or any third-party subprocessors actually in use. Replace the bracketed placeholders and have this reviewed — especially before serving customers in a jurisdiction with specific requirements (e.g. GDPR, Australian Privacy Act).

1. What we collect

Account data: name, email address, and password (stored as a salted hash, never in plain text).
Business data you enter: invoices, expenses, contacts, employee records, and related financial data you add to your workspace.
Usage data: basic technical logs (IP address, browser, timestamps) for security and troubleshooting.

2. How we use it

To provide and operate the Service, respond to support requests, and maintain security (e.g. detecting suspicious login activity). We do not sell your data.

3. Where it's stored

[Hosting region and infrastructure provider to be specified.] Data is stored per-workspace and isolated from other customers' workspaces.

4. Third parties

[List of subprocessors — e.g. email delivery, payment processing — to be specified once finalised.] We do not share your business data with third parties for marketing purposes.

5. Data retention

We retain your data for as long as your account is active. [Retention period after account closure/deletion request to be specified.] You can export your data at any time from within the app.

6. Your rights

You can access, correct, export, or request deletion of your account data by contacting us. [Add specific rights language if serving EU/UK residents under GDPR, or Australian residents under the Privacy Act 1988, once the operating entity and jurisdiction are confirmed.]

7. Cookies

We use essential cookies to keep you signed in and remember preferences (such as theme). We do not use third-party advertising or tracking cookies.

8. Security

Passwords are hashed, not stored in plain text. We support optional two-factor authentication on your account. [Add any additional security certifications/practices once verified.]

9. Changes to this policy

We may update this policy from time to time. Material changes will be notified via the Service or by email.

10. Contact

Questions about this policy, or to request access/export/deletion of your data: [support/privacy contact email to be specified].