Privacy Policy

1. Scope, who is responsible, and our privacy roles

This Policy applies to personal data we receive when someone visits our public pages, creates or uses a workspace, uses our desktop or mobile applications, purchases a subscription, contacts support, receives a service communication, or interacts with our security and operational systems.

Customer-controlled workspace data

The Customer company ordinarily decides why and how personal data about its customers, suppliers, contacts, workers, employees, and other people is entered and used in HisaBooks. For that data, the Customer is normally the controller, organisation, Data Fiduciary, or equivalent responsible party, and HISABOOKS PRIVATE LIMITED acts as its processor, service provider, or data intermediary. Requests about data entered by your employer or another Customer should normally be directed to that Customer first.

HisaBooks-controlled service data

HISABOOKS PRIVATE LIMITED determines the purposes of processing for account creation, company-code administration, subscription billing, legal-policy acceptance, support, service communications, product security, abuse prevention, reliability, legal compliance, and our own business records. For these activities, HISABOOKS PRIVATE LIMITED may be an independent controller, organisation, or Data Fiduciary. The Data Processing Addendum describes the baseline under which the Customer acts as controller and HISABOOKS PRIVATE LIMITED acts as processor for Customer-controlled workspace personal data.

This Policy does not cover a Customer's independent privacy practices or third-party sites and services that the Customer chooses to use.

2. Information we collect

We ask Customers not to enter personal data that is unnecessary for a business workflow. Some enabled HR, payroll, claims, attachment, and signature features can contain sensitive information. The Customer must decide whether it has a lawful basis and appropriate safeguards before using those fields.

3. What happens on each platform

3.1 Web application and websites

The web service sends workspace requests to HisaBooks servers. It uses secure session cookies and related request-security values to authenticate users and protect forms. Free signup uses an anti-abuse device cookie; the server stores a one-way hash of that identifier for rate limiting. Public contact, signup, checkout, authentication, and workspace pages collect the information shown in their forms.

3.2 Desktop application

The desktop application is an Electron client that connects to the HisaBooks API over HTTPS. At login it may send the company code, username, device hostname, operating-system platform, application kind, and version. It stores the active session token in the application's user-data folder using operating-system protected storage where encryption is available, and stores non-sensitive window size and position locally. Workspace records are requested from the server and displayed in the application; document previews are loaded only from the permitted HisaBooks API origin.

3.3 HisaBooks Business mobile application

The mobile application connects to the same HisaBooks API and may process account, workspace, device, and diagnostic data. Depending on the features you choose:

• Secure account storage: authentication tokens and saved account profiles, including company code, username, company/user display names, and last-used time, are stored in the device's secure storage. A limited number of saved accounts may be retained for account switching.
• Offline queue: pending actions and their form payloads may be stored in application storage until they are sent or removed. This can include business or personal data entered into an offline form.
• Notifications: if permission is granted, the app obtains a push token and registers it with HisaBooks so the device can receive operational notifications. Notification routing may use Expo and the device platform's push service.
• Camera, photos, and files: camera permission is requested only when you choose to take a photo or scan a barcode. Existing photos are chosen through the device's own photo picker and files through its file picker, so the app does not ask for access to your whole photo library. Only the items you select may be copied to app cache, converted for upload, and sent to HisaBooks as part of the chosen record.
• Biometric unlock: if enabled, the operating system checks the device biometric or device credential. HisaBooks does not receive or store your fingerprint, face template, or other biometric template; it receives only the result needed to unlock the locally stored session.
• Device preferences: theme, biometric preference, document-viewer choice, and similar settings may remain on the device.

You can control optional permissions in device settings. Refusing an optional permission prevents the related feature but does not prevent unrelated use of the Service.

3.4 Sign in with Google

If you choose Continue with Google, Google confirms who you are and sends us your Google account identifier, verified email address, and name. We use them only to sign you in, to link that Google sign-in to your HisaBooks account, and to confirm your email address. We ask Google only for this basic profile and email: we do not receive your Google password and cannot read your Gmail, files, contacts, or calendar. Google handles the sign-in under its own privacy policy.

3.5 Connected company mailboxes

A Company Administrator can connect a company mailbox, such as an inquiries address, so the team can read, file, and answer email inside HisaBooks. HisaBooks then signs in to that mailbox with the details the Customer provides, keeps the password encrypted, copies messages and attachment details into the workspace, fetches an attachment from the mailbox when a user opens or files it, and sends replies through the mailbox's own mail server. This is Customer Data handled on the Customer's instructions. The Customer chooses which mailbox to connect and can pause syncing at any time.

4. How and why we use information

We use personal data for the following purposes:

• create and administer companies, accounts, roles, permissions, workspaces, plans, and enabled features;
• provide Customer-directed accounting, document, service, procurement, inventory, HR, payroll, approval, reporting, export, and communication workflows;
• authenticate users, verify email, support password recovery and multi-factor authentication, maintain sessions, and register authorised devices;
• process subscriptions, maintain billing records, prevent duplicate provisioning, handle payment failures, cancellation, support, and disputes;
• send verification, security, billing, workflow, document, support, and other operational communications requested by the Customer or needed to provide the Service;
• detect fraud, spam, account abuse, unauthorised access, malware, and violations; enforce limits and protect users, HISABOOKS PRIVATE LIMITED, and the public;
• monitor errors, availability, performance, and compatibility; troubleshoot and improve features, accessibility, and reliability;
• keep audit, acceptance, accounting, tax, security, and legal records; establish or defend legal claims; and comply with lawful requests;
• create aggregated or de-identified statistics that are not reasonably capable of identifying a person; and
• send product news or marketing messages only with consent where the law requires it and always with a way to opt out. We do not send any at present.

Depending on the applicable law and context, our legal grounds may include performing the contract, taking requested pre-contract steps, complying with law, protecting legitimate interests in preventing fraud and misuse and keeping the Service secure, acting on the Customer's documented instructions, and consent where required. A Customer is responsible for identifying its own lawful basis for Customer-controlled workspace data, and for giving its own notice to the people whose personal data it enters, such as its employees, customers, suppliers, and contacts. This Policy explains how HisaBooks handles that data but does not give that notice on the Customer's behalf.

Under Singapore's Personal Data Protection Act 2012, we rely on the legitimate interests exception, without asking for consent, only to detect and prevent fraud, to detect and prevent misuse of the Service, and to keep the Service secure, for example through sign-in attempt limits, security logs, and audit records. Before relying on it, we assessed the likely adverse effects on individuals and the safeguards that reduce them, and concluded that these legitimate interests outweigh any likely adverse effect. You may ask our Data Protection Officer about that assessment.

Error, performance, and security logs are used only to run, fix, and protect the Service, never for marketing, profiling, or behavioural tracking.

We do not sell personal data. We do not use Customer Data for third-party behavioural advertising. We do not make decisions producing legal or similarly significant effects about individuals solely through automated processing on our own behalf.

5. When we disclose information

We disclose only what is reasonably necessary in these circumstances:

• Customer and Authorised Users: workspace data is visible according to the Customer's roles, permissions, modules, public-document links, exports, and sharing choices.
• Service providers: providers may support hosting and infrastructure, databases and backups, email delivery, payment processing, push notifications, security, error monitoring, customer support, and professional advice. They receive data required for their function and are subject to contractual or legal duties.
• Stripe: payment and billing details are sent to Stripe for checkout, recurring billing, fraud prevention, payment status, invoices, and subscription management. Stripe handles payment-method data under its own privacy terms and as a payment provider.
• Expo and platform push services: where mobile notifications are enabled, push tokens and notification-routing information pass through Expo and Google/Android platform services as needed to deliver the message.
• Google sign-in: if you choose Continue with Google, Google knows that you are signing in to HisaBooks.
• Customer-selected recipients and integrations: when a user emails, exports, downloads, prints, shares, or integrates a record, or the Customer connects a company mailbox, the selected recipient or provider receives that information at the Customer's direction.
• Legal, safety, and rights: we may disclose data to regulators, courts, law enforcement, advisers, insurers, or affected parties where reasonably necessary and lawful to comply with process, protect safety or rights, investigate wrongdoing, or establish and defend claims.
• Business transfer: data may be disclosed under confidentiality in connection with financing, restructuring, merger, acquisition, or sale. A successor remains subject to applicable privacy obligations.

We do not allow a service provider to use Customer Data for the provider's unrelated marketing. The Subprocessor Register identifies current provider categories and must be updated when material production providers change.

6. Cookies, tokens, and similar storage

A cookie is a small value stored by a website in a browser. Similar technologies include secure mobile storage, application storage, and desktop token files.

The current application baseline does not intentionally load third-party behavioural-advertising pixels on HisaBooks pages. If we introduce non-essential analytics or advertising technologies, we will update this Policy and provide consent controls where required. Blocking strictly necessary storage may prevent login, checkout, security, or saved-device features from working. See the Cookie and Local Storage Notice for more detail.

7. International processing and transfers

HISABOOKS PRIVATE LIMITED is based in Singapore. HisaBooks and its providers may process data in Singapore and other countries where infrastructure, payment, email, notification, security, support, or backup providers operate. Those countries may have different privacy laws.

Where required, we use contractual, organisational, and technical measures intended to provide an appropriate or comparable level of protection, such as transfer contracts, data-processing terms, provider due diligence, access controls, and encryption in transit. Customers must also assess any international transfer they initiate through their users, recipients, integrations, or configuration. Market expansion remains subject to any applicable localisation or transfer requirements.

8. Retention, export, account closure, and deletion

We retain data only while reasonably needed for the purposes described above, considering the Customer's instructions, account status, type and sensitivity of data, security needs, contractual commitments, dispute periods, backup lifecycle, and legal accounting, tax, employment, and regulatory duties.

• Active workspace data: generally retained while the workspace is active and until deleted by an authorised user, closed under the service process, or no longer needed.
• Closed workspace grace window: after closure is approved, the workspace stays recoverable for 30 days before anything is permanently deleted.
• Closed workspace deletion: within 90 days after that grace window, we delete or anonymise the workspace data we do not need to keep, unless a legal hold, a legal retention duty, the Customer's own duties, a dispute, security needs, or a provider limitation requires longer.
• Business, tax, payroll, billing, payment, refund, and legal acceptance records: generally retained for at least 7 years from the relevant financial year, closure, or last transaction, or longer where local law, audit, dispute, or enforcement requires.
• Security, audit, access, and admin-operation logs: routine records are generally kept online for 2 years and then deleted. Records marked as warning or critical may be kept in a separate archive for up to 5 additional years when needed for a security investigation, abuse response, accountability, or legal response. Records linked to an active legal hold remain until the hold is resolved.
• Support tickets and privacy-request evidence: generally retained for 7 years after final response so we can evidence verification, decisions, and completion.
• Sessions, reset links, invite links, and push tokens: expire by their configured security lifetime, and stale tokens are targeted for purge within 30 days.
• Local app data: remains on the mobile or desktop device until the relevant logout, account-removal, clear-storage, or uninstall action removes it, subject to operating-system behavior.
• Backups: deleted data may remain in restricted rotating backups until those backups expire or are overwritten, which is up to 35 days unless disaster recovery, a legal hold, or a provider limitation requires longer. Backups are used for recovery and are not restored to avoid a valid deletion request except where technically necessary, after which the deletion process will resume.
• De-identified data: may be retained where it can no longer reasonably identify a person.

Company Administrators can use available data-export tools before closure. Account, deletion, access, export, and correction requests can be submitted through the Data and Account Requests page or sent to dpo@hisabooks.com. We may verify the requester's identity and authority, coordinate with the Customer that controls the workspace, and explain data that must be retained. Removing an individual user does not necessarily delete business records the Customer must retain. Deleting an app from a device does not close the server account or cancel a subscription.

9. Security and incident response

We use administrative, technical, and organisational safeguards designed for the nature of the Service. Current controls include tenant-scoped access checks, role and permission controls, password hashing, session protections, HTTPS transport, CSRF protection for web requests, output encoding and content-security controls, login throttling, optional time-based one-time-password authentication with QR setup, audit and security events, restricted API origins in the desktop client, operating-system protected token storage where available, mobile secure storage, backup and recovery processes, and provider access controls.

No system can guarantee absolute security. Customers must use strong unique passwords, enable available multi-factor authentication, secure devices and email accounts, review permissions and activity, keep applications updated, and avoid placing unnecessary sensitive data in free-text fields.

If we confirm a personal-data incident, we will contain and assess it, preserve relevant evidence, notify affected Customers and regulators where required, and provide information reasonably needed for the Customer's own duties. Suspected vulnerabilities or unauthorised access should be reported promptly to support@hisabooks.com without accessing or changing other users' data. See the Security Overview for current security and vulnerability-reporting guidance.

10. Your rights and choices

Depending on your location and the context, you may have rights to request access, correction, completion, deletion or erasure, restriction, objection, portability, withdrawal of consent, information about use and disclosure, nomination of another person, or review of a privacy decision. You may also have a right to complain to a privacy regulator.

To exercise a right concerning Customer-controlled workspace data, contact the relevant Customer or Company Administrator. You may also contact us, and we will route or assist with the request as appropriate. For HisaBooks-controlled account, billing, support, or security data, contact us directly. We may request information needed to verify identity, authority, company relationship, and scope. Rights can be limited by law, the rights of others, legal privilege, security, fraud prevention, or required record retention.

You can update many account or company fields in the Service, manage notification and device permissions through application or operating-system settings, remove saved app accounts, log out to remove active tokens where supported, and use workspace export tools if authorised. Please keep your account details accurate and up to date in the Service, or tell our Data Protection Officer if information we hold about you is wrong.

Withdrawing consent

Where we rely on your consent, you may withdraw it at any time through the Data and Account Requests page or by emailing our Data Protection Officer. We aim to process a withdrawal within 10 business days. Before completing it, we will tell you about any consequences, for example that we may no longer be able to provide part or all of the Service to you, or that the Customer that controls your workspace account must be involved. Withdrawal does not affect processing that took place before it, or processing that the law requires or permits without consent.

Access and correction requests

We aim to respond to access and correction requests within 21 business days. If we cannot respond within 30 days after receiving a request, we will tell you in writing within those 30 days when we expect to respond. We do not charge for ordinary access requests; if a complex access request would involve a fee permitted by law, we will tell you the amount before we process it. If we cannot provide or correct information, we will generally explain why, unless the law says we need not.

11. Regional information

11.1 Singapore

HISABOOKS PRIVATE LIMITED is a Singapore company and handles personal data subject to the Singapore Personal Data Protection Act 2012 where applicable. Our Data Protection Officer is the public data-protection contact for HisaBooks and coordinates access and correction requests, protection, retention, transfer, and breach-notification responsibilities. Direct Singapore privacy enquiries to the contact below with the subject "PDPA Request".

HisaBooks does not use full or partial Singapore NRIC or FIN numbers as passwords, default passwords, account authenticators, or document unlock codes. Customers must not configure workflows that use full or partial NRIC or FIN numbers for authentication.

11.2 India

India's Digital Personal Data Protection Act 2023 and Digital Personal Data Protection Rules 2025 have phased commencement dates from 13 November 2025, with additional obligations coming into force on later official timelines. As the relevant provisions become applicable, HISABOOKS PRIVATE LIMITED and Customers must provide required notices, maintain appropriate security safeguards, support applicable Data Principal rights and grievance handling, and meet breach and processor-management duties for their respective roles. Direct India privacy grievances to the contact below with the subject "India Privacy Grievance".

11.3 European Economic Area and United Kingdom

Where the GDPR or UK GDPR applies, HISABOOKS PRIVATE LIMITED's legal bases are described in Section 4. Customers ordinarily act as controllers for workspace data and should enter appropriate data-processing and international-transfer terms before production use involving those regions. Individuals may complain to their local supervisory authority. HISABOOKS PRIVATE LIMITED has not represented in this Policy that it has an EU or UK establishment; applicability and representative requirements must be assessed before targeted expansion.

11.4 Other countries

Local privacy, employment, payroll, tax, consumer, localisation, and breach rules may apply even when HisaBooks does not provide local tax automation. The Customer is responsible for assessing its use, and HISABOOKS PRIVATE LIMITED will review additional market requirements before actively launching a local paid offering.

12. Children

HisaBooks is not directed to children and accounts may be created only by adults acting for a business or organisation. Customers must not use the Service to collect children's personal data unless the feature is appropriate, the processing is lawful, and required parental or guardian authorisation and safeguards are in place. Contact us if you believe a child created an account without appropriate authority.

13. Data Protection Officer, complaints, and Policy updates

For privacy questions, rights requests, complaints, security concerns, or account/data deletion requests, use the Data and Account Requests page or contact:

HISABOOKS PRIVATE LIMITED
UEN 202607376D
Registered office: 22 Sin Ming Lane, #06-76 Midview City, Singapore 573969
Data Protection Officer for HisaBooks
Singapore
Email: dpo@hisabooks.com

Include your name, company code if applicable, relationship to the Customer, request type, and enough detail to locate the relevant information. Do not email passwords, full identity numbers, complete card details, or authenticator secrets. We will acknowledge and handle requests within the period required by applicable law and may first refer a Customer-controlled request to the Customer.

We may update this Policy when our products, providers, laws, or data practices change. We will post the revised version and update the date above. If a change materially affects how we use personal data, we will provide additional notice or request consent where required.