Privacy Policy | HisaBooks

1. Scope, who is responsible, and our privacy roles

This Policy applies to personal data we receive when someone visits our public pages, creates or uses a workspace, uses our desktop or mobile applications, purchases a subscription, contacts support, receives a service communication, or interacts with our security and operational systems.

Customer-controlled workspace data

The Customer company ordinarily decides why and how personal data about its customers, suppliers, contacts, workers, employees, and other people is entered and used in HisaBooks. For that data, the Customer is normally the controller, organisation, Data Fiduciary, or equivalent responsible party, and AARK acts as its processor, service provider, or data intermediary. Requests about data entered by your employer or another Customer should normally be directed to that Customer first.

AARK-controlled service data

AARK determines the purposes of processing for account creation, company-code administration, subscription billing, legal-policy acceptance, support, service communications, product security, abuse prevention, reliability, legal compliance, and our own business records. For these activities, AARK may be an independent controller, organisation, or Data Fiduciary. The Data Processing Addendum describes the customer-controller and AARK-processor baseline for Customer-controlled workspace personal data.

This Policy does not cover a Customer's independent privacy practices or third-party sites and services that the Customer chooses to use.

2. Information we collect

Category	Examples	Typical source
Company and account data	Company name and code, country or tax region, primary currency, administrator name, username, work email, phone, company address, registration details, role, permissions, and verification status.	You, a Company Administrator, or the Customer.
Workspace business data	Customers, suppliers, items, quotations, invoices, credit notes, purchase orders, inventory, payments, financial entries, service reports, delivery orders, tasks, approvals, notes, and generated documents.	Authorised Users, imports, and Customer-directed workflows.
Employee and HR data	Names, contact details, addresses, dates of birth, nationality, government or employment identifiers, work-pass and residency information, employment dates, attendance, leave, shifts, claims, performance, salary, allowances, payroll, CPF or statutory fields, and payslips.	The Customer, its users, and its workers.
Files and interaction content	Uploaded images and PDFs, receipts, signatures, stamps, document acknowledgements, email-template content, support requests, feedback, and correspondence.	You, your device, or the Customer.
Billing and transaction data	Plan, billing interval, currency, amount, billing contact, payment status, Stripe customer/subscription/session references, invoice or receipt records, failed-payment status, and cancellation history.	You, the Customer, Stripe, and our billing systems.
Security and technical data	IP address, date and time, browser or app type, user agent, device name, operating system, app version, session and token identifiers, login attempts, multi-factor status, push token, security events, audit logs, request errors, and diagnostic metadata.	Your browser/device and our systems.
Public-site and signup data	Contact-form details, pricing selections, approximate market derived from network location where enabled, referral context, consent and policy-acceptance evidence, and a hashed anti-abuse device identifier.	You and your browser/network.

We ask Customers not to enter personal data that is unnecessary for a business workflow. Some enabled HR, payroll, claims, attachment, and signature features can contain sensitive information. The Customer must decide whether it has a lawful basis and appropriate safeguards before using those fields.

3. What happens on each platform

3.1 Web application and websites

The web service sends workspace requests to HisaBooks servers. It uses secure session cookies and related request-security values to authenticate users and protect forms. Free signup uses an anti-abuse device cookie; the server stores a one-way hash of that identifier for rate limiting. Public contact, signup, checkout, authentication, and workspace pages collect the information shown in their forms.

3.2 Desktop application

The desktop application is an Electron client that connects to the HisaBooks API over HTTPS. At login it may send the company code, username, device hostname, operating-system platform, application kind, and version. It stores the active session token in the application's user-data folder using operating-system protected storage where encryption is available, and stores non-sensitive window size and position locally. Workspace records are requested from the server and displayed in the application; document previews are loaded only from the permitted HisaBooks API origin.

3.3 HisaBooks Business and HisaBooks Team mobile applications

The mobile applications connect to the same HisaBooks API and may process account, workspace, device, and diagnostic data. Depending on the features you choose:

Secure account storage: authentication tokens and saved account profiles, including company code, username, company/user display names, and last-used time, are stored in the device's secure storage. A limited number of saved accounts may be retained for account switching.
Offline queue: pending actions and their form payloads may be stored in application storage until they are sent or removed. This can include business or personal data entered into an offline form.
Notifications: if permission is granted, the app obtains a push token and registers it with HisaBooks so the device can receive operational notifications. Notification routing may use Expo and the device platform's push service.
Camera, photos, and files: these permissions are requested only when you choose to capture or attach an image or PDF. Selected files may be copied to app cache, converted for upload, and sent to HisaBooks as part of the chosen record.
Biometric unlock: if enabled, the operating system checks the device biometric or device credential. HisaBooks does not receive or store your fingerprint, face template, or other biometric template; it receives only the result needed to unlock the locally stored session.
Device preferences: theme, biometric preference, document-viewer choice, and similar settings may remain on the device.

You can control optional permissions in device settings. Refusing an optional permission prevents the related feature but does not prevent unrelated use of the Service.

4. How and why we use information

We use personal data for the following purposes:

create and administer companies, accounts, roles, permissions, workspaces, plans, and enabled features;
provide Customer-directed accounting, document, service, procurement, inventory, HR, payroll, approval, reporting, export, and communication workflows;
authenticate users, verify email, support password recovery and multi-factor authentication, maintain sessions, and register authorised devices;
process subscriptions, maintain billing records, prevent duplicate provisioning, handle payment failures, cancellation, support, and disputes;
send verification, security, billing, workflow, document, support, and other operational communications requested by the Customer or needed to provide the Service;
detect fraud, spam, account abuse, unauthorised access, malware, and violations; enforce limits and protect users, AARK, and the public;
monitor errors, availability, performance, and compatibility; troubleshoot and improve features, accessibility, and reliability;
keep audit, acceptance, accounting, tax, security, and legal records; establish or defend legal claims; and comply with lawful requests;
create aggregated or de-identified statistics that are not reasonably capable of identifying a person; and
send product or marketing communications where permitted and where required consent or an opt-out is provided.

Depending on the applicable law and context, our legal grounds may include performing the contract, taking requested pre-contract steps, complying with law, protecting legitimate interests such as service security and business administration, acting on the Customer's documented instructions, and consent where required. A Customer is responsible for identifying its own lawful basis for Customer-controlled workspace data.

We do not sell personal data. We do not use Customer Data for third-party behavioural advertising. We do not make decisions producing legal or similarly significant effects about individuals solely through automated processing on our own behalf.

5. When we disclose information

We disclose only what is reasonably necessary in these circumstances:

Customer and Authorised Users: workspace data is visible according to the Customer's roles, permissions, modules, public-document links, exports, and sharing choices.
Service providers: providers may support hosting and infrastructure, databases and backups, email delivery, payment processing, push notifications, security, error monitoring, customer support, and professional advice. They receive data required for their function and are subject to contractual or legal duties.
Stripe: payment and billing details are sent to Stripe for checkout, recurring billing, fraud prevention, payment status, invoices, and subscription management. Stripe handles payment-method data under its own privacy terms and as a payment provider.
Expo and platform push services: where mobile notifications are enabled, push tokens and notification-routing information pass through Expo and Google/Android platform services as needed to deliver the message.
Customer-selected recipients and integrations: when a user emails, exports, downloads, prints, shares, or integrates a record, the selected recipient or provider receives that information at the Customer's direction.
Legal, safety, and rights: we may disclose data to regulators, courts, law enforcement, advisers, insurers, or affected parties where reasonably necessary and lawful to comply with process, protect safety or rights, investigate wrongdoing, or establish and defend claims.
Business transfer: data may be disclosed under confidentiality in connection with financing, restructuring, merger, acquisition, or sale. A successor remains subject to applicable privacy obligations.

We do not allow a service provider to use Customer Data for the provider's unrelated marketing. The Subprocessor Register identifies current provider categories and must be updated when material production providers change.

6. Cookies, tokens, and similar storage

A cookie is a small value stored by a website in a browser. Similar technologies include secure mobile storage, application storage, and desktop token files.

Technology	Purpose	Typical duration
Web session cookie	Keep a user signed in, separate tenants, protect requests, and apply session security.	Session or configured authentication period; removed or invalidated on logout where supported.
Free-signup device cookie	Prevent automated or repeated abuse of Free signup. The server uses a one-way hash for rate limiting.	Up to one year in the browser, subject to browser controls.
Theme and preference storage	Remember the selected appearance and device behavior.	Until changed, cleared, or the application is removed.
Mobile secure storage	Store session tokens and saved account profiles for sign-in and account switching.	Until logout/removal, account removal, storage clearing, or app removal, depending on the operating system.
Mobile offline/application storage	Hold queued actions and device preferences.	Until synchronised, removed, cleared, or app storage is deleted.
Desktop protected token and window state	Restore an authorised session and remember window layout.	Until logout/removal or application data is cleared.

The current application baseline does not intentionally load third-party behavioural-advertising pixels on HisaBooks pages. If we introduce non-essential analytics or advertising technologies, we will update this Policy and provide consent controls where required. Blocking strictly necessary storage may prevent login, checkout, security, or saved-device features from working. See the Cookie and Local Storage Notice for more detail.

7. International processing and transfers

AARK is based in Singapore. HisaBooks and its providers may process data in Singapore and other countries where infrastructure, payment, email, notification, security, support, or backup providers operate. Those countries may have different privacy laws.

Where required, we use contractual, organisational, and technical measures intended to provide an appropriate or comparable level of protection, such as transfer contracts, data-processing terms, provider due diligence, access controls, and encryption in transit. Customers must also assess any international transfer they initiate through their users, recipients, integrations, or configuration. Market expansion remains subject to any applicable localisation or transfer requirements.

8. Retention, export, account closure, and deletion

We retain data only while reasonably needed for the purposes described above, considering the Customer's instructions, account status, type and sensitivity of data, security needs, contractual commitments, dispute periods, backup lifecycle, and legal accounting, tax, employment, and regulatory duties.

Active workspace data: generally retained while the workspace is active and until deleted by an authorised user, closed under the service process, or no longer needed.
Closed workspace grace window: after verified closure approval, HisaBooks targets a 30-day recoverable closure window before irreversible primary-system deletion begins.
Closed workspace purge target: after that grace window, HisaBooks targets primary-system purge or anonymisation within 90 days unless legal hold, statutory retention, customer-controller duties, disputes, security, or provider limitations require longer.
Business, tax, payroll, billing, payment, refund, and legal acceptance records: generally retained for at least 7 years from the relevant financial year, closure, or last transaction, or longer where local law, audit, dispute, or enforcement requires.
Security, audit, access, and admin-operation logs: generally retained for 2 years online and up to 5 additional years in restricted archive where needed for security, accountability, or legal response.
Support tickets and privacy-request evidence: generally retained for 7 years after final response so we can evidence verification, decisions, and completion.
Sessions, reset links, invite links, and push tokens: expire by their configured security lifetime, and stale tokens are targeted for purge within 30 days.
Local app data: remains on the mobile or desktop device until the relevant logout, account-removal, clear-storage, or uninstall action removes it, subject to operating-system behavior.
Backups: deleted data may remain in restricted rotating backups until those backups expire or are overwritten. The current rolling-backup target is 35 days unless disaster-recovery, legal hold, or provider constraints require longer. Backups are used for recovery and are not restored to avoid a valid deletion request except where technically necessary, after which the deletion process will resume.
De-identified data: may be retained where it can no longer reasonably identify a person.

Company Administrators can use available data-export tools before closure. Account, deletion, access, export, and correction requests can be submitted through the Data and Account Requests page or sent to support@hisabooks.com. We may verify the requester's identity and authority, coordinate with the Customer that controls the workspace, and explain data that must be retained. Removing an individual user does not necessarily delete business records the Customer must retain. Deleting an app from a device does not close the server account or cancel a subscription.

9. Security and incident response

We use administrative, technical, and organisational safeguards designed for the nature of the Service. Current controls include tenant-scoped access checks, role and permission controls, password hashing, session protections, HTTPS transport, CSRF protection for web requests, output encoding and content-security controls, login throttling, optional time-based one-time-password authentication with QR setup, audit and security events, restricted API origins in the desktop client, operating-system protected token storage where available, mobile secure storage, backup and recovery processes, and provider access controls.

No system can guarantee absolute security. Customers must use strong unique passwords, enable available multi-factor authentication, secure devices and email accounts, review permissions and activity, keep applications updated, and avoid placing unnecessary sensitive data in free-text fields.

If we confirm a personal-data incident, we will contain and assess it, preserve relevant evidence, notify affected Customers and regulators where required, and provide information reasonably needed for the Customer's own duties. Suspected vulnerabilities or unauthorised access should be reported promptly to support@hisabooks.com without accessing or changing other users' data. See the Security Overview for current security and vulnerability-reporting guidance.

10. Your rights and choices

Depending on your location and the context, you may have rights to request access, correction, completion, deletion or erasure, restriction, objection, portability, withdrawal of consent, information about use and disclosure, nomination of another person, or review of a privacy decision. You may also have a right to complain to a privacy regulator.

To exercise a right concerning Customer-controlled workspace data, contact the relevant Customer or Company Administrator. You may also contact us, and we will route or assist with the request as appropriate. For AARK-controlled account, billing, support, or security data, contact us directly. We may request information needed to verify identity, authority, company relationship, and scope. Rights can be limited by law, the rights of others, legal privilege, security, fraud prevention, or required record retention.

You can update many account or company fields in the Service, manage notification and device permissions through application or operating-system settings, remove saved app accounts, log out to remove active tokens where supported, and use workspace export tools if authorised. Consent may be withdrawn for future processing where consent is the basis, but withdrawal does not affect earlier lawful processing.

11. Regional information

11.1 Singapore

AARK is a Singapore company and handles personal data subject to the Singapore Personal Data Protection Act 2012 where applicable. Our privacy contact acts as the public data-protection contact for HisaBooks and coordinates access and correction requests, protection, retention, transfer, and breach-notification responsibilities. Direct Singapore privacy enquiries to the contact below with the subject "PDPA Request".

HisaBooks does not use full or partial Singapore NRIC or FIN numbers as passwords, default passwords, account authenticators, or document unlock codes. Customers must not configure workflows that use full or partial NRIC or FIN numbers for authentication.

11.2 India

India's Digital Personal Data Protection Act 2023 and Digital Personal Data Protection Rules 2025 have phased commencement dates from 13 November 2025, with additional obligations coming into force on later official timelines. As the relevant provisions become applicable, AARK and Customers must provide required notices, maintain appropriate security safeguards, support applicable Data Principal rights and grievance handling, and meet breach and processor-management duties for their respective roles. Direct India privacy grievances to the contact below with the subject "India Privacy Grievance".

11.3 European Economic Area and United Kingdom

Where the GDPR or UK GDPR applies, AARK's legal bases are described in Section 4. Customers ordinarily act as controllers for workspace data and should enter appropriate data-processing and international-transfer terms before production use involving those regions. Individuals may complain to their local supervisory authority. AARK has not represented in this Policy that it has an EU or UK establishment; applicability and representative requirements must be assessed before targeted expansion.

11.4 Other countries

Local privacy, employment, payroll, tax, consumer, localisation, and breach rules may apply even when HisaBooks does not provide local tax automation. The Customer is responsible for assessing its use, and AARK will review additional market requirements before actively launching a local paid offering.

12. Children

HisaBooks is not directed to children and accounts may be created only by adults acting for a business or organisation. Customers must not use the Service to collect children's personal data unless the feature is appropriate, the processing is lawful, and required parental or guardian authorisation and safeguards are in place. Contact us if you believe a child created an account without appropriate authority.

13. Privacy contact, complaints, and Policy updates

For privacy questions, rights requests, complaints, security concerns, or account/data deletion requests, use the Data and Account Requests page or contact:

AARK NETWORK PTE. LTD.
UEN 202505542N
Registered office: 22 Sin Ming Ln, #06-76 Midview City, Singapore 573969
Privacy contact for HisaBooks
Singapore
Email: support@hisabooks.com

Include your name, company code if applicable, relationship to the Customer, request type, and enough detail to locate the relevant information. Do not email passwords, full identity numbers, complete card details, or authenticator secrets. We will acknowledge and handle requests within the period required by applicable law and may first refer a Customer-controlled request to the Customer.

We may update this Policy when our products, providers, laws, or data practices change. We will post the revised version and update the date above. If a change materially affects how we use personal data, we will provide additional notice or request consent where required.