1. Information we collect
1.1 Information you give us
- Account information — name, work email address, password (stored only as a salted hash), preferred language and time zone.
- Organisation information — company or group name, the legal entities you set up inside the service, your chart of accounts, posting rules, warehouses and other master data you create.
- Accounting content — everything you or your team post into the ledger, including manual journal entries, opening balances, purchase records and any file you choose to attach to an entry.
- Billing information — company billing name, address, tax identification number, and the billing contact. Card details are entered directly with our payment processor and never reach our servers.
- Support communications — the content of emails and support requests you send us.
1.2 Information collected automatically
- Technical data — IP address, browser and operating system, device type, and the pages and actions performed within the application.
- Security and audit logs — sign-in attempts, permission changes, and a record of who created, modified or deleted an accounting entry, with a timestamp. These logs are part of the product's audit trail and are not optional.
1.3 Information from third parties
Where you authorise a connection to a marketplace, we receive data from that marketplace on your behalf. Section 2 describes this in detail. We also receive limited transaction status information from our payment processor.
We do not buy personal data from data brokers, and we do not enrich your records with information from external sources.
2. Marketplace API data
figuards processes marketplace data on your behalf for the selling accounts you tell us about. Amazon and Etsy are supported today, with further marketplaces planned.
Where you authorise a direct connection to a marketplace's API, we request it only for the specific selling account you nominate, only with the narrowest set of permissions the accounting function requires, and only until you withdraw that authorisation — which you can do at any time, either inside figuards or from the marketplace's own settings.
However your marketplace data reaches us, we may receive:
- order records, including order identifiers, dates, quantities, item prices, taxes and shipping charges;
- fee, refund, chargeback, adjustment and settlement records;
- product and inventory records, including SKU identifiers and stock movements;
- where a marketplace provides it and it is necessary to account for an order — limited buyer information such as a shipping destination (country, state or province, and postal code) and a marketplace-issued buyer identifier.
Where a marketplace offers a restricted-data or non-personally-identifiable variant of an endpoint, we use that variant. Personally identifiable information originating from a marketplace is encrypted at rest, is never written to application logs, and is deleted on the schedule set out in section 7.
3. How we use information
- To provide the service — creating accounting entries, valuing inventory, applying exchange rates, generating reports, and operating approvals, period locks and permissions.
- To authenticate and secure accounts — signing you in, sending one-time codes, detecting suspicious access, and maintaining the audit trail.
- To support you — answering questions and investigating problems you report.
- To bill you — issuing invoices and processing subscription payments.
- To operate and improve the service — diagnosing errors, monitoring performance and capacity, and understanding which features are used. Where we analyse usage for improvement we work with aggregated or de-identified data wherever it is sufficient.
- To communicate with you — service notices, security notices, and billing messages. Marketing emails are sent only where permitted and you can unsubscribe at any time; unsubscribing does not stop essential service notices.
- To comply with law — meeting accounting, tax and record-keeping obligations, and responding to lawful requests.
We do not sell personal information, and we do not share it for cross-context behavioural advertising.
4. Legal bases for processing
Where data protection law requires a legal basis, we rely on: performance of a contract (providing the service you subscribed to), legitimate interests (securing the service, preventing fraud, and improving the product), consent (optional cookies and marketing messages, and each marketplace authorisation), and compliance with a legal obligation (tax and accounting records).
5. How we share information
We disclose information only in the following situations:
| Recipient | Purpose and safeguards |
|---|---|
| Infrastructure and hosting providers | Running the application and its database. Bound by written contract, permitted to process data only on our instructions. |
| Payment processor | Taking subscription payments. Receives billing data directly from you; we receive only transaction status. |
| Email delivery provider | Sending sign-in codes, service notices and invoices. |
| Error monitoring and analytics | Diagnosing faults and measuring performance. Configured to exclude accounting content and marketplace personal data. |
| Professional advisers | Auditors and legal counsel, under a duty of confidentiality. |
| Authorities | Where disclosure is required by law or necessary to protect rights and safety. We notify you unless legally prohibited. |
| An acquirer | In a merger, acquisition or asset sale, subject to this policy continuing to apply. We notify you before your data becomes subject to a different policy. |
We never disclose one customer's data to another customer. Each customer's data is separated at the tenant level and every request is scoped to the tenant of the signed-in user.
6. Data security
- Encryption in transit using TLS 1.2 or higher; encryption at rest for databases and backups.
- Passwords stored only as salted hashes; one-time codes for sign-in; sessions expire automatically.
- Role-based access control inside the product, down to individual functions, plus period locks and approval chains that limit what any single user can change.
- Tenant isolation, so a request can only ever read data belonging to the signed-in user's organisation.
- Least-privilege internal access, reviewed periodically; administrative actions are logged.
- Regular backups, tested restores, and dependency and code review before deployment.
- An incident response process. If a personal data breach affects you, we notify you and, where required, the competent authority without undue delay and in any case within 72 hours of becoming aware of it.
No system is perfectly secure. You are responsible for keeping your credentials confidential and for removing users who leave your organisation.
7. Data retention and deletion
| Category | Retention period |
|---|---|
| Account and organisation data | For the life of the subscription, then 90 days after termination, then deleted. |
| Accounting entries and reports | For the life of the subscription. Exportable at any time. Deleted 90 days after termination unless you ask us in writing to delete them sooner. |
| Personal data originating from a marketplace | Deleted within 30 days of the point at which it is no longer required for the accounting purpose, and in any case within 30 days of you disconnecting that marketplace or asking us to stop processing it, unless a longer period is required by tax or accounting law. |
| Billing and tax records | As required by applicable tax law, typically 10 years. |
| Security and audit logs | 12 months, except entries forming part of the accounting audit trail, which are retained with the accounting data. |
| Support correspondence | 3 years from the last message. |
| Backups | Rolling 35 days; deletions propagate as backups age out. |
To request deletion of your data, or of specific marketplace data, email privacy@figuards.com. We acknowledge a request within 2 working days. We complete a verified deletion or access request within 20 days, and a request to withdraw consent within 15 days, in line with Vietnam's Law on Personal Data Protection. We will tell you if a legal obligation requires us to keep something, and what that obligation is.
8. International transfers
We are established in Vietnam and the primary data store for the service is hosted in Vietnam. Keeping accounting data in Vietnam means the data localisation requirements of Decree No. 53/2022/ND-CP are satisfied for our Vietnamese customers.
A limited number of sub-processors are located outside Vietnam — payment processing, email delivery and error monitoring. Where we transfer personal data to them we carry out a transfer impact assessment, notify the competent authority where notification is required under Law No. 91/2025/QH15 on Personal Data Protection and Decree No. 356/2025/ND-CP, and bind each recipient by written contract to process the data only on our instructions.
Vietnam is not covered by a European Commission adequacy decision. Where we process personal data of individuals in the European Economic Area or the United Kingdom, we therefore rely on Standard Contractual Clauses together with a transfer risk assessment. A copy of the relevant safeguards is available on request.
If we add a hosting region in future we will update this policy and notify customers before any data is moved.
9. Cookies and similar technologies
We use the smallest practical set of cookies:
- Strictly necessary — session and authentication cookies, and a cookie recording your interface preferences. These cannot be switched off without breaking the service.
- Analytics — aggregate usage measurement, used only with your consent where consent is required.
We do not use advertising or cross-site tracking cookies. You can clear or block cookies in your browser; blocking necessary cookies will prevent you signing in.
10. Your rights
Depending on where you live, you may have the right to access your personal data, to correct it, to delete it, to restrict or object to processing, to receive a portable copy, and to withdraw consent. To exercise any of these, email privacy@figuards.com. We acknowledge requests within 2 working days and respond within 20 days — sooner where the law requires it — and do not charge for a first request. We may need to verify your identity before acting.
If you are in the EEA or the UK you may also lodge a complaint with your local supervisory authority. If you are a California resident you have the rights described in the CCPA as amended by the CPRA, including the right to know, delete and correct, and the right not to be discriminated against for exercising them; we do not sell or share personal information as those terms are defined. As we are established in Vietnam, we process personal data in accordance with Law No. 91/2025/QH15 on Personal Data Protection and Decree No. 356/2025/ND-CP, which took effect on 1 January 2026. You may contact us at the address below to give, limit or withdraw consent, or to request access, correction or deletion.
Where you are an employee or team member of a figuards customer, that customer is the controller of the accounting data you enter, and we act as processor on their instructions. Please direct requests about that data to your own organisation first; we will assist them in responding.
11. Children's privacy
figuards is a business product and is not directed at children. We do not knowingly collect personal data from anyone under 16. If we learn that we have, we delete it.
12. Third-party links and services
The service links to marketplaces and other third-party sites. Their privacy practices are their own and this policy does not cover them. Review their policies before authorising a connection.
13. Automated decision-making
figuards classifies transactions and produces figures automatically, according to the posting rules you configure. These are accounting operations, not decisions about people, and they remain subject to your review, approval and correction. We do not carry out profiling that produces legal effects for individuals.
14. Changes to this policy
We may update this policy. If a change is material we notify you by email or in the application at least 30 days before it takes effect, and we update the "last updated" date above. Continuing to use the service after a change takes effect means you accept the updated policy.
15. Contact us
Figuards Joint Stock Company
Enterprise / tax code: 0111608435
No. 11, Lane 3, Alley 5, Den Ve Street,
Bac Lam 9 Residential Group, Phu Luong Ward,
Hanoi, Vietnam
(In Vietnamese: Số 11, ngõ 3, ngách 5, đường Đền Vẽ, tổ dân phố Bắc Lãm 9, Phường Phú Lương, Thành phố Hà Nội, Việt Nam)
Privacy enquiries: privacy@figuards.com
General enquiries: support@figuards.com