Privacy Policy

Last updated: 6 July 2026

1. What we collect

Account data (name, email, organisation details); business data you enter (invoices, bills, contacts, items, payroll, and related records); and technical data (log and device information needed to run and secure the Service).

2. How we use it

To provide and maintain the Service, process your subscription, secure accounts, and improve the product. We do not sell your data. We do not use your business data for advertising.

3. Confidential business data

Costs, purchases, and salaries are treated as confidential and are visible only to users you grant permission to within your organisation, enforced by database-level access controls.

4. Third parties

We use trusted providers to operate the Service: Supabase (database and authentication) and Vercel (hosting). If you enable optional integrations — Telegram (reminders/marketing) or Bakong (payment reconciliation) — data needed for those features is shared only with those services at your direction. Each processes data under its own terms.

5. Payments

Subscription payments are made via KHQR/Bakong. We store a record of the payment (amount and reference) but do not store your bank credentials.

6. Data retention

We keep your data while your account is active. After termination we retain it for a reasonable period to allow export and to meet legal obligations, then delete it.

7. Security

Data is protected with encryption in transit, row-level access controls, optional two-factor authentication, and audit logging. No system is perfectly secure; you are responsible for keeping your credentials safe.

8. Your rights

You can access, correct, export, or request deletion of your data through your account or by contacting the operator.

9. Changes

We may update this Policy and will notify you of material changes.

10. Contact

Privacy questions: contact the Plong operator through your account.