Privacy Policy

1. Data We Collect

We collect the following categories of data:

• Account data: your name, email address, and authentication details. If you sign in with Google, we receive your basic Google profile (name, email, and avatar) as permitted by your Google account.
• Financial data you enter: cash flow entries, income and expense records, tax and zakat figures, project details, and any receipts or files you upload.
• Usage and technical data: log information such as IP address, device and browser type, and timestamps, collected to operate, secure, and improve the Service.

2. How We Use Your Data

We use your data to:

• provide, maintain, and improve the Service;
• perform the calculations and reports you request (income tax estimates, zakat, and cash flow analysis);
• authenticate you and secure your account;
• send essential transactional emails such as account confirmation, password resets, security notifications, and invitations;
• maintain an audit trail of changes for accountability; and
• detect, prevent, and respond to fraud, abuse, and security incidents.

3. Legal Bases for Processing

Where applicable, we process your data to perform our contract with you (providing the Service), to comply with legal obligations, on the basis of your consent (which you may withdraw), and for our legitimate interests in operating and securing the Service.

4. Service Providers (Sub-Processors)

We rely on trusted third-party providers to operate the Service. These providers process data on our behalf under appropriate safeguards:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting and delivery.
• Google — optional sign-in (OAuth).
• Cloudflare Turnstile — bot and abuse protection on authentication forms.
• Resend (with Amazon SES as underlying infrastructure) — delivery of transactional email.
• Have I Been Pwned — checking passwords against known breaches; passwords are checked using a privacy-preserving k-anonymity method and are never sent in full.

5. Data Sharing

We do not sell your personal data. Within projects you share, your data may be visible to other members according to their assigned role. We may disclose data if required by law, to enforce our Terms, or to protect the rights, safety, and security of our users and the Service.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. You may request deletion of your account and associated data, subject to retention required for legal, accounting, security, or audit purposes. Audit log entries may be retained on an append-only basis for integrity.

7. Security

We use technical and organizational measures to protect your data, including encrypted transport (HTTPS), row-level security in the database, hashed passwords, bot protection, and security notifications for sensitive events such as password changes. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact us using the details below. You may update much of your account information directly within the Service.

9. International Processing

Our providers may process and store data in data centers located outside your country. Where data is transferred internationally, we rely on the safeguards offered by these providers to protect your information.

10. Children's Privacy

The Service is not intended for individuals under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us data, contact us so we can remove it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date above. Your continued use of the Service after changes take effect constitutes acceptance.

12. Contact

For privacy questions or requests, contact us at brm.startup@gmail.com.