---
title: "Privacy policy"
description: "Ledgeriano privacy policy: what data we collect, why, legal bases, processors, cookies, retention periods and your rights to access, export or delete data."
canonical: https://ledgeriano.com/privacy
language: en
publisher: "Ledgeriano"
updated: 2026-09-25
---

# Privacy policy

> Ledgeriano privacy policy: what data we collect, why, legal bases, processors, cookies, retention periods and your rights to access, export or delete data.

This policy explains what personal data Ledgeriano collects, why we use it, who helps us process it, how long we keep it and the choices you have. We have tried to write it in plain language.

## Who we are and what this policy covers

Ledgeriano ("we", "us") operates the website at ledgeriano.com, the Ledgeriano web application and the Ledgeriano API at api.ledgeriano.com (together, the "service"). This policy applies to personal data we process when you visit the site, create an account, use the service or contact us.

The service holds accounting records that you and your team enter, which can include personal data about other people, such as the names and contact details of your customers, suppliers or employees. For that data, you (or the business you work for) decide what is recorded and why, and we process it on your behalf to provide the service. Section 6 explains how we treat it.

## Data we collect

We collect only what we need to run an accounting service. Depending on how you use it, that includes:

**Account data:** your name, email address, password (stored only as a one-way hash), optional phone number and profile picture, preferred language and time zone, and whether two-factor authentication is on.

**Business and accounting data you enter:** business profiles and logos, charts of accounts, fiscal years, journal entries and attachments, parties (customers and suppliers) and their details, cost centers, projects, workflows and webhook settings.

**Team data:** the email addresses of people you invite, their roles and membership status.

**Billing records:** credit purchases and consumption, the package and payment method chosen, payment status and identifiers returned by our payment processor, and, for bank transfers, the reference and receipt you upload.

**Technical and security data:** sign-in times and IP addresses, the device or browser name attached to each session, audit trail entries (action, time, IP address, browser), API request logs (method, path, status, IP address, duration) and webhook delivery logs (payload sent and the response from your endpoint).

**Messages you send us,** for example support emails, and any details you include in them.

We do not ask for payment card numbers and never receive them.

## Cookies and local storage

We use a very small number of browser storage items, all needed for the site and app to work:

| Item | Purpose |
| --- | --- |
| `lgr_locale` cookie | Remembers your interface language preference. |
| Session token (local storage) | Keeps you signed in to the app. It is removed when you sign out and stops working when it expires after 30 days. |
| Selected business (local storage) | Reopens the business you last worked in. |

We do not use advertising cookies. If we add analytics or other optional cookies in the future, we will update this policy and ask for your consent where the law requires it.

## How we use data and our legal bases

Where data protection law requires a legal basis, we rely on the following:

**To provide the service you signed up for** (performance of our contract with you): creating your account, storing and processing your accounting data, running reports, workflows, API calls and webhooks, and charging credits for actions.

**To send service messages** (contract): email verification, password resets, team invitations, payment confirmations and low-credit notices.

**To keep the service secure and reliable** (our legitimate interest in protecting you, other customers and the service): sign-in throttling, audit trails, request logs, fraud and abuse prevention, debugging and backups.

**To keep billing and financial records** (legal obligation, and contract): recording purchases and credit transactions as tax and accounting rules require.

**To answer your messages** (contract, or our legitimate interest when you are not a customer).

**To improve the product** (legitimate interest): understanding which features are used, based on service records, without selling or sharing your data for advertising.

**Optional communications** (consent): we do not send marketing emails unless you have agreed to receive them, and you can withdraw that consent at any time.

## Who we share data with

We do not sell personal data. We share it only with service providers that help us run Ledgeriano, and only as much as their task requires:

- **Hosting and infrastructure providers** that run our servers, database and file storage.
- **An email delivery provider** that sends verification, password reset, invitation and billing emails.
- **NowPayments,** if you pay with cryptocurrency. It receives the order amount, currency and order reference, and handles the payment under its own terms and privacy policy.
- **Your bank,** if you pay by bank transfer, as part of the transfer you make.

These providers may only use the data to provide their services to us. We also disclose data when the law requires it, to protect the rights and safety of our users or the service, or as part of a merger or sale of the business, in which case this policy continues to protect your data.

Workflows that call a URL and webhooks you configure send data to destinations **you** choose. Those recipients are under your control, not ours.

## Accounting data you enter about others

For accounting records you enter about your customers, suppliers, employees or other people, we act as your service provider (a "processor" under laws such as the GDPR). We:

process that data only to provide the service and according to your instructions and settings;

do not sell it or use it for advertising;

limit access by our staff to what is needed to operate the service, answer your support requests, or investigate security issues and abuse. When support staff sign in as a user to help, that access is time-limited and recorded in our audit log;

help you respond when someone asks you to access, correct or delete their data.

If someone asks us directly about data held in your books, we will refer them to you where we can.

## International data transfers

Our servers and service providers may be located in a country other than yours. When personal data is transferred across borders, we rely on the safeguards that applicable law requires, such as contractual protections with our providers.

## How long we keep data

We keep data only as long as it is needed for the purposes above or as the law requires:

| Data | Retention |
| --- | --- |
| Account data | While your account exists. |
| Accounting data and its audit trail | While the business exists in your account, and afterward only as long as needed to meet record-keeping duties. |
| Deleted businesses | Archived and hidden from the app first. You can ask us to erase an archived business permanently. |
| Billing and credit records | As long as tax and accounting law requires us to keep them. |
| API request logs | 90 days. |
| Webhook delivery logs | 30 days. |
| Workflow run history | 180 days. |
| Expired session tokens | Deleted about one day after they expire. |
| Unpaid payment requests | Crypto invoices expire after 2 days and bank transfer requests without proof after 7 days. The expired record stays in your billing history. |

Deleted data can remain in backups for a limited time until those backups are replaced in the normal cycle.

## How we protect data

We use HTTPS, bcrypt password hashing, optional two-factor authentication, hashed API keys, role-based permissions for each business, private file storage and a full audit trail. The [security page](https://ledgeriano.com/security) describes these controls in detail. No system is perfectly secure, so please also protect your password and API keys.

## Your rights and choices

Depending on where you live, you may have the right to:

- **Access** the personal data we hold about you and receive a copy.
- **Export** your data. Reports can be exported to CSV in the app, the API gives programmatic access to your ledgers, and we can provide a copy of your account data on request.
- **Correct** inaccurate data. Most account details can be edited in your profile.
- **Delete** data. Owners can delete a business in the app. To close your account and erase your data, email us.
- **Object to or restrict** processing based on our legitimate interests.
- **Withdraw consent** where we rely on it, without affecting earlier processing.
- **Complain** to your local data protection authority.

To use any of these rights, email [support@ledgeriano.com](mailto:support@ledgeriano.com?subject=Privacy%20request) from the address linked to your account. We may need to confirm your identity, and we will answer within the time the law allows. We may keep some records where the law requires it, for example billing records.

## Children

- Ledgeriano is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

## Changes to this policy

We may update this policy when the service or the law changes. The date at the top shows the latest version. If a change materially affects how we use your personal data, we will tell you by email or in the app before it takes effect.

## Contact

Questions about this policy or your data: [support@ledgeriano.com](mailto:support@ledgeriano.com?subject=Privacy%20question). To report a security issue: [security@ledgeriano.com](mailto:security@ledgeriano.com). You can also use the options on our [contact page](https://ledgeriano.com/contact).