AcctRelayPrivacy Policy
Last updated: [date]
This policy explains how [legal name] (“AcctRelay”, “we”) handles personal data.
1. Data we collect about you
- Account data: name, work email, company name.
- Billing data: handled by Paddle.com as Merchant of Record; we receive only limited order information.
- Technical data: API request logs (time, endpoint, status, connected company ID), kept up to 30 days for debugging and security.
2. Accounting data passing through the Service
When an authorized application calls the API, data from the connected Sage 50 company (which may include personal data of the customer's clients, vendors or employees) passes through our servers in transit. We act as a processor on behalf of the data owner. We do not sell this data, do not use it for advertising, and are designed not to store copies of accounting records beyond what is needed to complete a request.
3. How we use data
To provide and secure the Service, provide support, bill for paid plans, and meet legal obligations.
4. Sharing
With service providers we use to run the Service (hosting, email, payments — Paddle.com), only as needed. With authorities when required by law.
5. Security
Encryption in transit (TLS), outbound-only agent connections, per-company API keys, limited log retention.
6. Your rights
You can ask to access, correct or delete your personal data by emailing stepan@acctrelay.com. If you are in the EU/UK or Canada, you may also have rights under GDPR or PIPEDA, including the right to complain to your data-protection authority.
7. International transfers
Our servers are located in [hosting region]. Data may be processed outside your country with appropriate safeguards.