Privacy Policy

1. Who we are

xacc (app.xacc.pro and xacc.pro) is run by XACC TECH PTE. LTD. (UEN 202645032E), a company registered in Singapore (“we”, “us”). This policy explains how we collect, use, disclose and look after personal data, in line with Singapore's Personal Data Protection Act 2012 (“PDPA”).

2. Four kinds of data

• Account data— about the people who use xacc: name, email address, password (stored only as a one-way hash), Google account identifier if you sign in with Google, your firm's name, your role, and when you sign in — and, for billing, your firm's subscription details from Stripe (plan, status and Stripe's reference numbers) and a code Stripe gives the card used, which lets us offer one free trial per card. We never receive or store card numbers. We decide how this is used.
• Technical data — IP addresses and browser details, which appear in our server logs and those of our hosting and network providers, and a log in each entity of who did what and when (the audit log). We use these to keep xacc secure and working, and to answer questions about changes to the books.
• Books data— everything a firm puts into xacc for the entities it keeps books for: bank statements, invoices, bills, customers, suppliers, journals and files. It can include personal data about other people (for example a customer who is an individual). The firm that enters it decides how it is used; we process it on the firm's behalf, as a data intermediary under the PDPA, only to run the service for that firm.
• Support data — when you open a support ticket or email us: your name, email address and what you write, and our replies. We use it only to answer you and to improve xacc and its guide.

As a data intermediary we protect books data, keep it only as long as set out below, use it only to run the service, and tell the firm without undue delay if a data breach affects it.

3. What we use account data for

• to create and secure your account, sign you in and keep you signed in;
• to send emails the service needs: welcome, invitations, password links and password-change notices;
• to send, when a user asks, the firm's invoices and statements to its customers by email — sent as “the firm's entityvia xacc”, with replies going to the firm, not to us;
• to give support when you ask for it, and to look into problems or misuse;
• to bill your firm for its subscription, and to keep records the law requires.

We don't sell personal data, and we don't use it for advertising.

4. Who can see books data

• the people your firm's admin gives access to, with the role the admin chooses;
• people at another firm, only if an xacc administrator gives them access to one of your entities at your firm's request (for example your outside accountant);
• xacc's own administrators, for support, to fix problems, or where the law requires. Each time an administrator opens another firm's entity it is recorded.

5. Service providers

We use these providers to run xacc. Each handles personal data only as needed for its part:

• Render — hosts the app and its database, and keeps its own short-term backups of the database (up to about a week), in Singapore;
• Cloudflare — stores uploaded files (such as bank statements and bill attachments), runs our domain names and the xacc.pro website, and passes traffic to the app;
• Zoho Mail — sends our emails and receives replies to support@xacc.pro, on its Singapore service;
• Google — only if you choose “Sign in with Google”;
• Stripe — takes card payments for subscriptions (card details go to Stripe, never to xacc);
• Tawk.to — runs the support widget on xacc.pro, our support ticket form and our help centre (xacc.tawk.help), and stores support tickets and our replies.

Cloudflare, Google, Stripe and Tawk.to may process data outside Singapore. Where they do, we rely on their contractual commitments to protect it to a standard comparable to the PDPA.

6. Cookies

The xacc app uses only its own cookies, needed for the service to work: to keep you signed in, remember which entity you are working on, show one-off messages after an action, complete Google sign-in, and remember your display settings. There are no advertising or tracking cookies. The xacc.pro website shows a Tawk.to support widget, which sets Tawk.to's own cookies to run it; the support ticket form and the help centre are pages on Tawk.to's own site, which sets its own cookies there. Tawk.to's cookies are covered by its own policy.

7. How long we keep data

We keep account and books data while your firm uses xacc. When a firm's subscription ends, or its trial ends without a subscription, its data may be deleted at any time. When a user or a firm is deleted, their data is removed from the live database along with its uploaded files. Our hosting provider's backups are kept for up to about a week, so deleted data is gone from backups soon after. Firms are responsible for keeping their own copies of records they must retain by law (for example under the Companies Act or for IRAS) before closing their account.

8. Security

Connections are encrypted (HTTPS). Passwords are stored as salted hashes, sessions expire, accounts lock after repeated wrong passwords, and access to each entity is checked on every request. No system is perfectly secure. If a data breach happens, we will notify the Personal Data Protection Commission and the people affected where the PDPA requires.

9. Your choices and rights

You can ask to see or correct the personal data we hold about you, or withdraw consent to its use — which may mean we can no longer provide the service to you. You can change your own details and close your account in Account settings. For books data, contact the firm that holds it first; we will help that firm respond.

10. Contact

Questions, requests or complaints go to our Data Protection Officer at support@xacc.pro. We respond as the PDPA requires.

11. Changes

We may change this policy at any time by publishing a new version on this page; it applies from the date shown at the top.