Privacy Policy & Data Protection
Last updated: September 2026
1. Overview
Ledger Synapse ("we", "our", or "us") provides an autonomous financial intelligence and accounting orchestration platform. We are committed to protecting the privacy, confidentiality, and security of our users and their organization data.
2. Information We Collect
We collect information necessary to deliver and improve our financial intelligence services:
- Account Credentials: Name, work email address, organization name, and authentication details.
- Financial Documents & Metadata: Invoices, receipts, bank statements, and general ledger records uploaded by authorized organization users.
- Usage & Telemetry: Log data, browser type, IP address, and interaction metrics to ensure platform stability.
3. Multi-Organization Data Isolation & Security
All organization data is strictly partitioned using PostgreSQL Row-Level Security (RLS) policies and encrypted in transit (TLS 1.3) and at rest (AES-256). Your organization's financial records are never commingled or accessible by other organizations.
4. Artificial Intelligence & Zero-Training Guarantee
Ledger Synapse utilizes artificial intelligence for automated document extraction, OCR, transaction reconciliation, and narrative reporting. We enforce strict enterprise governance:
- No Model Training: Your financial data, journal entries, and document extractions are strictly never used to train or fine-tune public foundation models.
- Organization BYOK (Bring-Your-Own-Key): Organizations may configure their own enterprise API credentials via Supabase Vault, ensuring direct commercial agreements with AI providers.
- AI Privacy Opt-Out: Organizations retain full autonomy to opt out of AI inference features at any time via Organization Settings, disabling external AI processing completely.
5. Subprocessors & Cloud Infrastructure
We partner with enterprise cloud and infrastructure providers who maintain SOC 2 Type II, ISO 27001, and HIPAA certifications:
| Subprocessor | Purpose | Location |
|---|---|---|
| Supabase Inc. | PostgreSQL database, authentication, vault encryption | Global / EU / US |
| Vercel Inc. | Application hosting, edge delivery, serverless compute | Global Edge |
| OpenAI / Anthropic / Google | AI reasoning, multimodal document OCR, narrative synthesis | US / Global |
| DeepSeek / OpenRouter | Alternative AI task routing and inference | Global |
| Resend Inc. | Transactional emails and notification delivery | US |
| Upstash Inc. | Distributed caching, rate limiting, task coordination | Global |
6. Statutory Data Retention Schedules (UAE Compliance)
In accordance with United Arab Emirates statutory legislation, financial and tax records processed through the platform are retained under the following minimum statutory periods:
- UAE Corporate Tax (Federal Decree-Law No. 47 of 2022): Seven (7) years from the end of the relevant tax period for financial statements, books of account, audit workpapers, and corporate tax return submissions.
- UAE Value Added Tax (Federal Decree-Law No. 8 of 2017 & amendments): Five (5) years from the end of the tax period for VAT invoices, credit notes, and Form 201 filing records (extended to 15 years for real estate records).
- UAE Commercial Companies Law (Federal Decree-Law No. 32 of 2021): Five (5) years for general meeting records, director resolutions, and annual audited financial statements.
7. Third-Party Integrations & OAuth
When you authenticate using third-party identity providers such as Google OAuth, we only access basic profile information (email and display name) for identity verification. We never access your personal emails, files, or external drive documents.
8. Contact Us
If you have questions regarding this Privacy Policy or wish to exercise data protection rights, please contact our compliance officer at: admin@ledgersynapse.com.