Who this draft covers
Example Accounting Software Private Limited is the example operator used in this draft. The intended notice covers visitors to the Accounttally marketing website and people using its accounting service. Business records entered for a company can contain information about that company’s customers, vendors and staff. Responsibilities for those records must be set out in the final customer agreement.
Information involved
Do not place passwords, one-time codes, provider credentials or financial documents in the public inquiry form. Provide only the information needed for the conversation.
- Website inquiries: name, company name, email address, optional phone number, selected topic and message.
- Account use: identity and sign-in details, company membership, roles and security-related session information.
- Business use: documents, contact records, tax details, payment records and attachments entered by authorized users.
- Technical operations: request and security information needed to deliver the service, investigate errors and reduce abuse.
How information is used
Inquiry details are used to respond to the request. The current inquiry endpoint forwards a message to the configured team mailbox; it does not store the contact message in the application database. Short-lived duplicate-request and rate-limit records support reliable delivery and abuse prevention.
Within the accounting service, information supports account access, company permissions, document workflows, reports and user-requested services. The final notice must identify the lawful basis, applicable notices and choices for each purpose. Submitting a demo inquiry should not be treated as permission for unrelated advertising.
Service providers and access
Configured providers can process information for email delivery, hosting, payments or explicitly enabled product services. A selected AI or document-extraction feature may send the information needed for that request to its configured provider. Availability and processing depend on the enabled feature; this draft does not assert zero provider retention.
Before publication, the operator must confirm the provider list, processing locations, transfer arrangements and contractual responsibilities. Authorized workspace access should be limited to the company and role required for the task.
Retention and protection
Different records have different purposes. Inquiry messages remain subject to the receiving mailbox’s retention practices; accounting records can be subject to business and statutory retention requirements. Account closure does not necessarily mean every financial record can be immediately erased. The final policy must specify the applicable retention periods and deletion process.
The product design uses access controls and protections for credentials and sensitive records. These controls reduce risk; this draft makes no guarantee that any system is immune from incidents. The operator must verify deployed controls and incident procedures before finalizing the notice.
Questions, corrections and privacy requests
For this draft, privacy@example.com is a dummy privacy contact and must not be used for real requests. Use the website inquiry form for an initial product question and avoid including sensitive evidence. The final notice must provide the real operator’s privacy and grievance channels, explain identity checks and set out applicable access, correction, erasure and complaint procedures.
This draft was prepared on 21 October 2026. Replace the example identity, verify current processing and obtain approval before treating it as the operative notice.