Privacy Policy

This Privacy Policy applies to visitors to our website; audit firm members (owners, managers and auditors) who create or use a LedgersLines account; and client contacts invited by a firm to upload documents through the client portal.

The Service is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, please contact us at info@ledgerslines.ai and we will take steps to delete it.

We only collect personal data that is reasonably necessary for, or directly related to, providing the Service.

2.1 Account information

When a firm member or client contact creates an account, we collect their name, email address and password (stored in hashed form, never in plain text), and, for firm members, their role at the firm (owner, manager or auditor).

2.2 Documents and engagement content

The Service exists to collect documents, so this is its main category of data: files a client contact uploads against a firm's request (which may themselves contain the audited company's own financial, payroll, banking or personnel information), the filename and file size, who uploaded or reviewed it and when, and any review notes exchanged between the firm and the client about a document.

2.3 Client and engagement details

Company details a firm enters about the client it is auditing (for example legal form, or whether the client runs payroll), used to determine which audits and document requests apply.

2.4 Billing information

A firm's plan, seat count and storage usage. Card and payment details are entered directly on our payment processor Stripe's own page — we never see or store card numbers ourselves.

2.5 Usage data

Standard technical data collected automatically when you use the Service or visit our website: IP address, browser and device type, and the pages or screens viewed.

2.6 Communications

If you contact us, we retain the content of that communication and our response.

2.7 Terms acceptance records

When you accept our Terms & Conditions, we record that you did so. This is a deliberate legal record rather than ordinary usage data, so we set out exactly what it contains:

• your name and email address, and your account identifier;
• the firm or client workspace you were entering at the time, and its name as it was then;
• which version of the Terms you accepted, the exact sentence you agreed to, and whether you were accepting on behalf of an organisation or only for yourself;
• whether you confirmed you were authorised to bind your organisation;
• the date and time, and whether the English or Arabic text was on screen;
• your IP address, where our network captured it, and the browser and device your browser reported.

We record the IP address only as our network reported it, and we store nothing when it was not captured rather than fall back to a value that could be altered by whoever sent the request. The browser and device information is self-reported by your browser and we treat it as such.

We do not run third-party analytics or advertising trackers on this site. There is no Google Analytics, advertising pixel, or similar tool collecting data about you as you browse.

We collect personal data directly from you (for example, when you register or contact us); automatically through your use of the Service; and from the audit firm that invited you, when it enters a client contact's name, email and role on your behalf.

We use personal data to:

• create, administer and secure accounts;
• provide, operate and improve the Service, including routing each document to the people who should see it;
• authenticate users and prevent unauthorized access;
• process subscriptions and billing, through Stripe;
• send service communications, including upload confirmations and reminders about outstanding documents;
• respond to support requests; and
• comply with our legal obligations.

We collect, use and disclose personal data on the following bases:

• to perform our contract with the firm that holds your account;
• to comply with our legal obligations;
• with your consent, where we ask for it; and
• to establish, exercise or defend legal claims — this is the basis on which we keep the terms acceptance records described in section 2.7; and
• for our legitimate interests (such as maintaining security and improving the Service), where those interests are not overridden by your rights.

We do not sell personal data. We disclose personal data only to:

• Supabase — our database and document-storage provider;
• Cloudflare — which hosts the application;
• Stripe — which processes payments;
• Resend — which sends service and reminder emails on our behalf;
• Google Ireland Limited — which serves the Google Fonts used on this site; and
• professional advisers, or government and regulatory authorities, where reasonably required or legally compelled.

We require these providers to protect personal data and to use it only for the purpose we disclosed it to them for.

Signing in to the Service relies on an essential session mechanism, and the interface remembers a small number of display preferences (such as whether a sidebar is collapsed) in a cookie. Neither is used to track you across other sites.

Google Fonts may log IP addresses as an ordinary part of serving font files to your browser; Google Ireland Limited's own privacy policy covers that processing.

You can control cookies through your browser settings.

TechBridge Technologies L.L.C-FZ is based in Dubai, U.A.E. Some of the service providers listed in Section 6 may store or process personal data in other countries, including the United States and the European Union, where those providers operate. Where personal data is disclosed abroad, we take reasonable steps to ensure it is handled consistently with this Policy.

These are true of the Service today, not promises for later:

• documents are stored in a private bucket, encrypted at rest. A document uploaded since we shipped per-file encryption is also encrypted in your browser first, under a key unique to that file that our storage provider never holds, so a copy taken from storage is unreadable;
• every download uses a signed link that stops working after two minutes, so a link left in an old email opens nothing;
• access is enforced by role in the database itself, not only on the screen: a client contact sees only the document groups their role covers, and a firm auditor sees only their own clients;
• an uploaded file is checked against its actual bytes, not just its name, before it is accepted; and
• sign-in is by email and password, or Google.

No method of transmission or storage is completely secure. If we become aware of a breach likely to result in a risk to your rights, we will notify affected individuals and any authority we are required to notify, as required by law.

An archived client's documents and records are kept for the retention period the firm sets, seven years by default, and every purge is logged. Account data is kept for as long as the account is active, and for as long afterward as needed to meet our legal, tax and accounting obligations.

The terms acceptance records described in section 2.7 are treated differently, and we want to be straightforward about it: they are kept permanently, and they are not deleted when an account, a client workspace or a firm is deleted. They are also stored in a way that cannot be edited or removed afterwards — if a record needs correcting, we add a new one rather than change what is there. A record of agreement is only worth anything if it still exists, and is demonstrably unaltered, at the point somebody disputes it; one we could quietly revise would be worthless to you as well as to us.

Depending on where you live, you may have the right to do the following with the personal data we hold about you, to the extent permitted by law:

• access it, and obtain a copy of it;
• correct it, if it is inaccurate or incomplete;
• have it erased;
• restrict or object to our processing of it;
• receive it in a portable format and have it transferred to another provider; and
• withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, contact us at info@ledgerslines.ai. We will respond within a reasonable time, and always within one month. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

One exception we would rather state plainly than leave you to discover: we cannot erase or amend the terms acceptance records described in section 2.7, and the right to erasure does not extend to data we need in order to establish, exercise or defend a legal claim. If you believe one of those records is wrong, tell us and we will add a correcting record alongside it and give you a copy of both. Everything else about your account remains subject to the rights above.

Most of the personal data behind your account belongs to the audit firm that holds it — if you are a client contact, the fastest way to correct or remove something is often to ask that firm directly, since they control what is requested and from whom.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. If we make a material change, we will notify you by email or through the Service. The “Last updated” date at the top of this page shows when it was last revised.

If you have questions, concerns or requests about this Privacy Policy or how we handle personal data, contact us at info@ledgerslines.ai.

TechBridge Technologies L.L.C-FZ
Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.