This Privacy Policy explains how Accounting Orbit (“Accounting Orbit,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information when you visit our websites and applications, use our accounting and financial-record management, platform, applications, APIs, integrations, and related services, or otherwise interact with us (collectively, the “Service”).
This Policy does not apply to information processed under a separate privacy, notice, such as a dedicated applicant or workforce notice, or to third-party services that maintain their own privacy policies. It also does not replace a customer’s privacy notice for Customer Data the customer controls.
For individual consumer accounts, account registration, billing, website operation, marketing, direct, communications, and other processing we, determine, we generally decide why and how personal information is processed and act as a business or controller.
When a business customer uploads or connects information concerning its employees, customers, vendors, contractors, or other individuals (“Customer Data”), we generally process that information on the customer’s behalf as a service provider or processor. The customer controls that Customer Data and is responsible for providing required, notices, obtaining required, permissions, and responding to privacy requests. Individuals should ordinarily direct requests concerning Customer Data to the relevant customer.
For personal, accounts, we generally act as controller for information the individual enters or connects for personal or household financial recordkeeping. For organizational accounts, our role may differ by data category: we may be controller for account, billing, security, and relationship information while acting as processor or service provider for Customer Data controlled by the organization.
Additional processor obligations may be stated in our Data Processing Addendum at Available on request.
Depending on how you use the Service, we may collect the following categories of information.
The Service is not intended to collect full payment-card numbers or online-banking passwords directly unless an interface expressly states otherwise. If bank connectivity or payment processing is enabled, a third-party provider may collect credentials and provide us with tokens, account, metadata, or transaction information under its own privacy policy.
Current payment processor: Stripe
We may use cookies, local storage, pixels, and similar technologies to keep you signed in remember preferences, protect the Service, understand, performance, and if enabled, measure use or marketing effectiveness.
Analytics tools currently used: None
Advertising tools currently used: None
Where required, we obtain consent before using nonessential cookies. Browser settings may block some technologies, but doing so may impair Service functionality. Our cookie controls are available at Browser settings.
Some browsers transmit “Do Not Track” signals, for which no single uniform response is required in every jurisdiction. We respond to legally recognized opt-out preference signals, such as the Global Privacy Control, when applicable to our processing. A preference signal generally applies to the browser or device that sends it and may not opt you out of processing performed solely in our role as a processor for a customer.
We collect information you provide in support requests, demonstrations, surveys, calls, emails, chats, and other communications, including attachments and troubleshooting details.
We may receive information from:
If a customer provides information about another person, we may not have a direct relationship with that person. The customer is responsible for providing any notice required at collection, subject to any notice obligations that apply directly to us.
When we act as a controller and obtain personal information from a source other than the individual, we will provide any notice required by applicable law within the required period unless a lawful exception applies.
We use personal information to:
We may use automated tools to extract receipt or invoice, fields, suggest classifications or matches, detect, anomalies, and assist with workflows. These tools are intended to support human review and are not designed to make decisions producing legal or similarly significant effects about an individual.
We do not use Customer Data to train a general-purpose artificial-intelligence model unless the customer has expressly agreed to that use in writing.
Where laws such as the UK GDPR or EU GDPR, apply, we process personal information as necessary to:
When we process Customer Data as a processor, the customer determines the applicable legal basis.
Account identifiers, authentication information, and information required to administer a paid subscription are contractual or operational requirements. If you do not provide them, we may be unable to create or secure an account, process, payment, provide requested functions, or communicate necessary notices. Other information is optional unless an interface identifies it as required.
We may disclose personal information to the following recipients for the purposes described in this Policy:
Current material service providers and locations: Available on request.
We do not sell personal information for money.
We do not sell or share personal information for cross-context behavioral advertising and do not process personal information for targeted advertising as those terms are defined by applicable U.S. state privacy laws. We have not sold or shared personal information for those purposes during the preceding 12 months.
We do not knowingly sell or share personal information of individuals under 16.
When we maintain information as de-identified, we will take reasonable measures designed to prevent it from being associated with an individual, publicly commit to maintain and use it in de-identified form, and not attempt to re-identify it except where permitted by law to test whether de-identification processes are effective.
We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Service, comply with legal and accounting obligations, resolve disputes, maintain security and audit, records, and enforce agreements.
We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. Depending on the system and risk, safeguards may include access controls, authentication, encryption in transit, encryption at rest, logging, backups, vulnerability, management, personnel, controls, and incident-response procedures.
No method of transmission or storage is completely secure. You are responsible for maintaining appropriate account, credentials, configuring permissions, protecting devices, and promptly notifying us of suspected unauthorized access at [email protected].
If we confirm a security incident affecting personal information, we will investigate, contain, remediate, and provide legally required notifications to affected customers, individuals, or authorities. Notification timing and content depend on the facts, our role, contractual, commitments, and applicable law.
We and our service providers may process information in countries other than where you live. Where required, we use recognized transfer, safeguards, such as adequacy decisions, standard contractual, clauses, or another lawful transfer mechanism. Information about applicable safeguards may be requested using the contact information below.
Primary hosting locations: United States
Depending on your location and applicable law, you may have the right to:
Submit requests at /settings or [email protected]. We may need to verify your identity and authority. An authorized agent may submit a request where permitted by law, subject to verification.
We will respond within the period required by applicable law. If we deny a request, we will explain the basis where required and provide instructions for an available appeal. We do not charge a fee unless permitted by law, such as when a request is manifestly unfounded, excessive, or repetitive. Verification information will be used only to process and document the request, protect against fraud, and satisfy legal obligations.
If your information is Customer Data controlled by one of our customers, contact that customer first. We will assist the customer as required by contract and law.
You may unsubscribe from marketing email using the link in the message. Administrative and transactional communications may continue while you maintain an account.
For residents of states with comprehensive privacy laws, the categories collected during the preceding 12 months are described in Section, 2, the purposes are described in Section, 3, and recipient categories are described in Section 6.
We use and disclose sensitive personal information only as reasonably necessary to provide requested, services, secure accounts, process authorized transactions and records, resist, fraud, and perform other purposes permitted without a right to limit, unless we provide a separate notice and choice. We do not use sensitive personal information to infer characteristics about individuals except as disclosed and permitted by law.
Our treatment of sale, sharing, and targeted advertising is stated in Section 7. We will recognize legally required browser-based opt-out preference signals where applicable to our processing.
The Service is intended for businesses and individuals who are at least 18 years old or the age of legal majority where they live. It is not directed to children under, 13, and we do not knowingly collect personal information directly from children under 13. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.
The Service may link to or integrate with third-party websites, banks, payment services, applications, and platforms. Their privacy practices are governed by their own notices. We are not responsible for a third party’s independent privacy practices.
We may update this Policy to reflect changes in the Service, our practices, or applicable law. We will post the updated version and revise the “Last updated” date. If required, we will provide additional notice or obtain consent before a material change takes effect.
Accounting Orbit
Attn: Privacy
Email: [email protected]
Telephone: Not provided
Data Protection Officer or representative, if applicable: Not applicable
If you are in the EEA or UK, you may also lodge a complaint with your local supervisory authority.