Privacy Policy

E-Tally is operated by Iuvora, a business based in India that is currently completing its registration and licensing. Privacy questions, requests and security reports all go to anas.shareef@outlook.com. [TO CONFIRM: the registered entity name, its registration details and a registered address, once registration completes.]

This policy is written in plain English and describes what the service does today. It does not claim that we comply with any particular data protection law, and we hold no security certification.

Because E-Tally serves businesses in the UAE while being operated from India, hosted primarily in Singapore, and backed up in encrypted form to the United States, more than one country's rules may be relevant. [TO CONFIRM: which data protection laws apply here, in particular the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and what it requires of us. Legal research suggests it reaches providers outside the UAE who handle data about people in the UAE; that reading, and what follows from it, needs UAE-qualified counsel. Nothing in this policy should be read as a legal conclusion.]

It covers the E-Tally website, the signup and login process, and the workspace we provide to a business customer.

It does not cover what a customer does inside their own workspace with their own records. For that information we act on the customer's instructions; see our data processing terms.

Account and workspace information you give us:

• company name and the workspace address derived from it
• the administrator's email address
• language preference (English or Arabic)
• country, and optionally tax registration number, street, city and postal code, used to configure the workspace

Team member information:

• the email address a workspace owner invites, and the role assigned to it
• for people who accept, the account created inside that workspace

Technical and security information:

• the IP address a signup request came from, kept with the signup record
• web server and application logs, which record IP addresses, times, and the pages or interfaces requested; sign-in tokens are removed from these logs automatically
• records of administrative actions on a workspace, such as suspension or deletion

Support information:

• anything you choose to tell us when you ask for help, including the content of your messages

Customer data inside a workspace (your contacts, products and invoices) is handled under our data processing terms rather than this policy. Note that this can include personal information about your own customers and staff, which remains yours.

We do not collect payment card details. No payments are taken through the service today.

• to confirm an email address really belongs to whoever is signing up, before anything is created
• to create and configure a workspace, and to make it reachable at its own address
• to sign people in and keep sessions secure, including one-time sign-in links
• to send service messages: confirmation, "your workspace is ready", and team invitations
• to protect the service, for example by limiting how many signups or login attempts one address or network can make
• to investigate faults and to answer support requests
• to keep an internal record of administrative actions on a workspace

We do not sell personal information, we do not share it for advertising, and we do not use customer data to build profiles.

E-Tally sets no advertising or analytics cookies, and loads no analytics, tracking or social media scripts. There are no third-party requests from the pages you visit: fonts and scripts are served from E-Tally's own servers.

The cookies we do set are needed for the service to work:

• language: remembers whether you chose English or Arabic. Kept for one year.
• workspace claim: a short-lived cookie that lets the browser that just completed signup open the new workspace. Kept for five minutes, readable only by the server.
• session: identifies you to your workspace after you sign in. Kept for up to seven days, readable only by the server, sent only over HTTPS.

Your workspace application may store small amounts of data in your browser to remember interface preferences.

We keep the number of providers deliberately small. The ones that can hold or transmit personal information are:

• DigitalOcean — cloud hosting. Our servers and databases run here, in DigitalOcean's Singapore region.
• Backblaze B2 — storage for encrypted backup copies of workspace databases, in the United States (us-east region). Each backup is encrypted on our own server, using a key we control, before it is uploaded; Backblaze cannot read its contents.
• Resend — delivery of service emails such as confirmation, workspace-ready and invitation messages. It handles recipient addresses and message content, processed in Resend's EU region (eu-west-1).
• Hostinger — DNS for etally.ai, and the mailbox provider for our own business email.
• No analytics, advertising or error-tracking provider is used. If one is ever added, this list changes first.
• deSEC — a small DNS zone used only to prove domain ownership when renewing security certificates. It holds no personal information.
• Let's Encrypt — issues the certificates that secure connections to the service. It holds no personal information.

The workspace software itself is the Odoo platform, which we run on our own servers. It is not a third party that receives your data, and E-Tally itself is proprietary hosted software rather than open-source software.

[TO CONFIRM: written data processing agreements with DigitalOcean, Backblaze, Resend and Hostinger, and whether any further providers, for example analytics or support tooling, will be introduced.]

The servers that run E-Tally and store workspace databases are hosted by DigitalOcean in their Singapore region. That is where your workspace data lives day to day.

Encrypted backup copies of workspace databases are stored separately, with Backblaze B2 in the United States (us-east region). We encrypt each backup on our own server before it leaves us, using a key we control, so the storage provider cannot read its contents. Your data therefore lives in more than one country: Singapore day to day, and the United States in backup form.

Our email provider, Resend, processes outgoing service emails in its EU region (eu-west-1). [TO CONFIRM: whether hosting should move closer to UAE customers.]

Because hosting, backups and email are all outside the United Arab Emirates — servers and live databases in Singapore, encrypted backup copies in the United States, and service emails processed in the EU — information about you and your workspace crosses borders in the ordinary course of running the service.

Hosting your workspace outside the UAE, and keeping an encrypted, off-site backup copy outside the region your servers run in, is how the service is delivered and protected: without it there is no workspace to use, and no way to recover one if something goes wrong.

[TO CONFIRM: the mechanism that makes these transfers lawful. Legal research points to contractual safeguards with each provider, and to customer authorisation, under the UAE data protection law; it also notes there is no adequacy decision for Singapore or the United States. Whether contractual clauses are required, and in what form, must be confirmed by UAE-qualified counsel and put in place with each provider. No safeguard is claimed here until that is done.]

Workspace and account records are kept while the workspace exists. Unconfirmed signups expire on their own and the links they contain stop working; invitations and sign-in links are short-lived by design.

[TO CONFIRM: retention periods for server logs, administrative records, closed-workspace records and backups. None are published because none are enforced yet. Legal research also raises a possible minimum retention duty for system logs under Indian cyber-incident rules; whether that applies to us, given the operating entity is still being registered and the servers are in Singapore, needs legal confirmation. Today's logs are kept for shorter periods than that, so no period is promised either way.]

You can ask us to close your workspace. When it is deleted, the workspace database and its stored files are removed from the live system, and its web address stops working.

Copies may remain in operational backups until those backups age out, and some records of administrative actions are kept. [TO CONFIRM: backup retention period and the point at which all copies are destroyed.]

You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete your workspace. Much of it you can view and change yourself inside your workspace or on the settings page.

If you are an employee or a customer of a business that uses E-Tally, your information is under that business's control. Please contact them; we will pass on requests we receive and support them in answering.

Whatever the legal position, we will act on these requests in practice: tell us at anas.shareef@outlook.com and we will respond as quickly as we reasonably can.

[TO CONFIRM: which statutory rights apply and their exact scope, any response deadline we must meet, and how we verify identity before answering. Legal research describes rights of access, correction, erasure, restriction, objection and data portability under the UAE data protection law. We are not asserting those rights here as a legal statement until counsel confirms the position.]

Measures in place today:

• every connection uses HTTPS; plain HTTP is redirected and browsers are told to use HTTPS only
• each workspace has its own separate database; a session for one workspace has no access to another
• passwords are stored only as hashes, by the workspace software; we never see them
• email sign-in links work once, expire quickly, and are removed from logs
• session cookies are restricted to the server and sent only over encrypted connections
• workspace administrators do not receive technical system administration rights
• machine interfaces and the database management screen are not reachable from the internet; application and database ports are closed to outside connections
• the server applies security updates automatically and blocks repeated failed access attempts
• administrative access to servers is restricted to the operators of the service
• backup copies of workspace databases are encrypted on our own server, with a key we control, before being sent to off-site storage, so the storage provider cannot read them

No system is perfectly secure. We do not claim to be fully secure, and we hold no security certification. [TO CONFIRM: independent security assessment, an enforced backup schedule and retention period, alerting, and a written incident response procedure. These are not in place yet.]

If we become aware of a security incident affecting your information, we will investigate, take steps to contain it, and inform affected customers without undue delay.

[TO CONFIRM: any fixed notification deadline we commit to, and any duty to report to a regulator in the UAE or India. Research describes both, with different timeframes; we are not adopting a specific number until counsel confirms which applies.]

E-Tally is a business product, intended for people acting for a business and aged 18 or over. We do not knowingly create accounts for children. If you believe a child's information has reached us through an account, contact us and we will remove it.

We may update this policy as the service develops. The date at the top shows when it last changed, and we will tell workspace owners by email about material changes.

Privacy questions, requests and security reports: anas.shareef@outlook.com. Service emails are sent from a no-reply address, which is not a contact channel. [TO CONFIRM: a dedicated privacy address and a postal address, once registration completes.]