Privacy Policy

Account & identity information

• Name, email address, and password (hashed, never stored in plain text)
• Company name and business details you provide during registration
• Profile picture and display preferences

Financial data

• Bank transaction records you upload or import (amounts, dates, descriptions, references)
• Document files (bank statements, invoices, receipts) uploaded to your workspace
• Journal entries, account balances, and categorisation data generated through the platform

Usage & technical data

• IP address, browser type, operating system, and device identifiers
• Pages visited, features used, and time spent in the application
• Access logs recording authentication events and API calls
• Error logs and crash reports used to improve reliability

Data you provide to us

• Support messages and communications with our team
• Feedback, survey responses, and feature requests

We use the data we collect to:

• Create and manage your account and provide access to Accureta services
• Process and automatically categorise your financial transactions
• Generate financial reports (P&L, balance sheet, cash flow statements)
• Enable collaboration between you and your assigned accountant
• Send transactional emails (account verification, password reset, notifications)
• Detect, investigate, and prevent fraudulent or unauthorised use of the platform
• Comply with applicable laws, regulations, and legal obligations
• Improve our AI categorisation models using aggregated, anonymised data

We do not sell your personal data to third parties, nor do we use your financial data to serve you advertisements.

Accureta offers sign-in via Google OAuth 2.0. When you choose to sign in with Google, we receive a limited set of data from Google in accordance with the OAuth scopes you approve:

• Your Google account email address
• Your full name and profile picture (if made available)
• A unique Google user ID used to link your Google account to your Accureta account

We do not request access to your Gmail, Google Drive, Google Calendar, or any other Google services unless you explicitly connect them in a future integration feature, which will require a separate, explicit consent.

Google OAuth tokens are stored securely and are only used to authenticate you. You can revoke Accureta's access at any time from your Google Account permissions page.

Our use of data received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

We share your data only in the following circumstances:

Within your organisation

• Accountants and admin users within your Accureta tenant can view data you have uploaded to the shared workspace.

Service providers

• Cloud infrastructure: Your data is stored on servers in our hosting environment. All providers are contractually bound to confidentiality obligations.
• Object storage: Document files are stored in MinIO-compatible S3 storage with server-side encryption.
• Email delivery: Transactional emails are routed through our email service provider.

Legal requirements

• We may disclose your data where required by law, court order, or government authority, or to protect the rights, property, or safety of Accureta, our users, or the public.

Business transfers

• In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

All data is stored in PostgreSQL databases and S3-compatible object storage with encryption at rest. All data in transit is protected by TLS 1.2 or higher.

We implement the following security controls:

• Passwords are hashed using bcrypt with a per-user salt — plaintext passwords are never stored
• JWT access tokens expire after 30 minutes; refresh tokens are rotated on use
• All API requests are authenticated and authorised at the endpoint level
• Audit logs record all authentication events, data access, and modifications
• Row-level data isolation ensures tenant data is never exposed to other organisations
• Regular dependency updates and automated vulnerability scanning

Despite these measures, no system is completely immune to security risks. In the event of a data breach that affects your rights and freedoms, we will notify you within 72 hours of becoming aware, in compliance with applicable data protection law.

We retain your data for as long as your account is active or as needed to provide services.

• Account data: Retained for the duration of your account and deleted within 90 days of account closure, unless we are legally required to retain it longer.
• Financial records: Retained for 7 years in accordance with Nigerian tax and accounting regulations (FIRS requirements).
• Access logs: Retained for 12 months for security and audit purposes.
• Deleted files: Document files are removed from object storage within 30 days of deletion from the platform.

You may request deletion of your personal data at any time (see Your Rights below), subject to our legal obligations to retain certain financial records.

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Ask us to correct inaccurate or incomplete data.
• Erasure: Request deletion of your personal data, subject to legal retention obligations.
• Portability: Receive your data in a machine-readable format (CSV/JSON).
• Restriction: Ask us to restrict processing of your data in certain circumstances.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Where we rely on consent, you may withdraw it at any time without affecting prior lawful processing.

To exercise any of these rights, email us at privacy@accureta.app. We will respond within 30 days. We may need to verify your identity before fulfilling certain requests.

We use cookies and similar technologies for the following purposes:

• Authentication: A secure, HTTP-only session cookie stores your access token to keep you signed in. This cookie is strictly necessary.
• Preferences: A cookie stores your theme preference (light/dark mode). No personal data is involved.

We do not use third-party advertising cookies, cross-site tracking pixels, or analytics tools that profile individual users.

Your browser settings allow you to refuse or delete cookies; however, refusing the authentication cookie will prevent you from signing in.

Accureta is a professional financial management platform intended for use by businesses and individuals aged 18 and over. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us immediately at privacy@accureta.app and we will promptly delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by displaying a prominent notice within the application at least 14 days before the changes take effect. Your continued use of Accureta after the effective date constitutes acceptance of the updated policy.

Previous versions of this policy are available upon request.

If you have questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact our Data Protection Officer: