Privacy Policy
How we process personal data under Qatar's Personal Data Privacy Protection Law, Law No. 13 of 2016.
2026-09-19
Some statutory service-provider details (commercial registration, registered address, contact email) have not been supplied yet. They appear here as soon as they are confirmed — no placeholder values have been substituted.
What we process
Account data (name, email, hashed password), the organisation you create, the accounting data you enter, and the technical logs needed to run and secure the service.
Purposes and lawful basis
To provide the contracted service, to meet statutory and tax obligations, and to protect the system from misuse. Processing is limited to specific, explicit and legitimate purposes and is not repurposed.
Direct electronic marketing
We send direct electronic marketing only with your explicit, prior consent. You may withdraw it at any time, as easily as it was given, with no detriment to you.
Your rights
You have the right to be informed of the processing and its purposes, to access your data, to have it corrected, to request erasure, to object to processing, and to withdraw consent. Requests are handled through the contact address below.
Children and special-nature data
We do not process a child's data without a parent's explicit consent. We do not process data of a special nature (ethnic origin, health, religious belief, family relations, criminal offences) without the competent authority's prior approval.
Retention
Accounting records are retained for the period required by the tax and commercial rules of the tenant's country, then deleted or anonymised. Account data is deleted within a reasonable period after termination unless the law requires otherwise.
Tenant isolation
Every organisation is logically isolated from every other, enforced by row-level security in the database rather than by the application layer alone, so one tenant cannot read another's data.
Breach notification
Where a breach may cause serious damage to personal data or to the privacy of data subjects, we notify the competent authority and the affected individuals without undue delay and within 72 hours of becoming aware of it.
Transfers outside the State
Data is hosted in the approved region. It is not transferred outside it except in accordance with the law and under adequate safeguards.
Privacy contact
To exercise your rights or ask about this policy, contact us at the address below.
—