Privacy Policy

Last updated: 1 May 2026

Plain-English summaryLedger collects only what we need to do bookkeeping for your business. We host your data in Singapore. We send receipt images to Google Gemini in the United States so the AI can read them — by uploading a receipt you agree to that. We keep your accounting records for 5 years (as Singapore law requires) even if you close your account, after which we delete them.

Operator: Code&Canvas Pte Ltd (Singapore)
Service: ledger.codeandcraft.ai
Data Protection Officer (DPO): dpo@codeandcraft.ai
Security disclosure: security@codeandcraft.ai
Support: hello@codeandcraft.ai

1. Who this policy applies to

This Privacy Policy applies to anyone who creates an account on Ledger or uses the service through their employer's account. It is written to comply with Singapore's Personal Data Protection Act 2012 (PDPA). If you are a tenant administrator using Ledger to process your own customers' data, your organisation is the data controller and you must give those individuals an appropriate privacy notice; we act as your data intermediary.

2. What we collect

Account data — your email address, display name, and optional avatar. We do not store passwords; we authenticate you with one-time codes.
Tenant / company data — company name, UEN, GST registration status, financial year, base currency.
Bookkeeping content you upload — receipt images and PDFs, transaction descriptions, vendor names, amounts, categories, and any notes you write.
Usage / session data — your IP address, browser type, and timestamps for sign-in events; for security and abuse detection.
Billing data — handled directly by Stripe; we receive a customer ID and subscription state, not your card details.

3. Why we collect it (purposes)

To provide bookkeeping, receipt OCR, and tax-filing-related features you request.
To authenticate you and protect your account.
To meet our statutory record-keeping obligations under the Companies Act and the GST Act.
To bill you and prevent payment fraud.
To respond to your support requests.
To improve service reliability (aggregated, anonymised metrics only).

4. AI processing — Google Gemini

Important cross-border transfer. When you upload a receipt, we send the image and a small amount of context (your existing categories and projects, so the AI can match) to Google Gemini API operated by Google LLC in the United States. Google processes the image, returns extracted fields, and per Google's API terms does not use it to train models or share it with other parties.

This is a transfer of personal data outside Singapore. We rely on Google's adherence to industry-standard contractual safeguards (including Standard Contractual Clauses) for that transfer. By uploading a receipt to Ledger, you consent to this transfer. If you do not consent, do not upload the receipt; Ledger's OCR features will be unavailable to you, but you can still enter transactions manually.

The structured output (extracted vendor, date, amount, GST, category) is stored in your Singapore-hosted tenant. We do not retain raw Gemini API requests or responses beyond the one-shot processing window.

5. Other processors we use

Hostinger — application infrastructure located in Singapore. Your tenant database and uploaded files are stored on a Singapore VPS.
Resend (United States) — sends transactional email (sign-in codes, account notifications). We send only the email address and the message body required for delivery.
Stripe (United States / Ireland) — handles subscription billing. We send customer email, subscription tier, and an internal customer ID; Stripe handles card data directly.
Anthropic (United States) — used internally by our automated QA harness and developer tooling. No customer data is sent to Anthropic. We disclose this for transparency only.

Each processor is bound by its own contractual safeguards for the cross-border transfer. We will publish a Data Processing Agreement (DPA) for B2B customers on request to dpo@codeandcraft.ai.

6. How long we keep it (retention)

Singapore law (Companies Act, Income Tax Act, GST Act) requires accounting records to be kept for 5 years from the end of the relevant financial year. While your account is active, we retain your data until you delete it. After you close your account:

Bookkeeping records (transactions, receipts, filings) — retained for 5 years, then deleted.
Account profile data — deleted within 30 days of closure.
Backup copies — purged on the rolling backup schedule (typically within 60 days).
Audit-log entries — retained for 5 years for compliance defence, then deleted.

7. Your rights under PDPA

You have the right to:

Access the personal data we hold about you.
Correct any inaccurate data.
Withdraw consent for further processing (we will close your account, subject to the 5-year statutory retention above).
Export a full machine-readable copy of your data via the Settings page.
Lodge a complaint with the Personal Data Protection Commission (PDPC) of Singapore at pdpc.gov.sg.

To exercise any of these rights, email dpo@codeandcraft.ai. We respond within 30 days.

8. Security

All traffic is encrypted in transit using TLS 1.2+ via Let's Encrypt.
Tenant data is isolated at the database row level using PostgreSQL Row-Level Security policies.
Sign-in is via one-time email codes; we do not store passwords.
We are working toward CSA Cyber Essentials certification.

Found a vulnerability? Please report it to security@codeandcraft.ai — we acknowledge within 72 hours.

9. Data breach notification

If a data breach causing significant harm or affecting 500 or more individuals occurs, we will notify the PDPC and affected users within 72 hours of becoming aware of the breach, as required by PDPA.

10. Changes to this policy

We may update this policy. Material changes will be announced by email at least 14 days before they take effect. The current version is always at /docs/privacy_policy with the "last updated" date at the top.

11. Contact & governing law

Code&Canvas Pte Ltd, Singapore. Governing law: Singapore. Disputes are subject to the exclusive jurisdiction of the Singapore courts.

DPO: dpo@codeandcraft.ai · Security: security@codeandcraft.ai · Support: hello@codeandcraft.ai

This document is a first draft for compliance posture. Review by a Singapore-qualified solicitor is recommended before relying on it in a contractual dispute.