Privacy Policy

This policy explains how AccountFUN processes personal data when you visit AccountFUN.com, create an account, or use our bookkeeping Service.

Plain-language promise: we do not sell personal data or bookkeeping records, and we do not use User Data to train general-purpose AI models.

1. Who we are

AccountFUN is the controller/business responsible for personal data used to operate your account and the Service. The controller is XOMG Limited, 50 Bonham Strand, Sheung Wan, Hong Kong. If your organisation subscribes to AccountFUN, it may be the controller of personal data it enters, and AccountFUN generally processes that data on its instructions. For privacy requests, contact support [at] accountfun [dot] com. The contact above handles privacy requests. Your rights under applicable privacy law are not limited by the governing-law clause in our Terms of Service. Our Data Processing Addendum describes our obligations when processing personal data for an organisation.

2. Information we collect

• Account data: name, email, phone, organisation, login provider identifiers, MFA and profile settings.
• Bookkeeping data: transactions, invoices, bills, receipts, contacts, bank-feed data, uploaded files, tax identifiers, currencies, and ledger records. This may contain personal data about people you enter.
• Billing data: subscription, tax, invoice, payment status, and limited payment-method metadata from Stripe. We do not store full card numbers or CVV.
• Technical and security data: IP address, browser/device information, language, timestamps, logs, audit events, cookie identifiers, error reports, and information about suspicious activity.
• Communications: support requests, feedback, and email preferences.
• Integration data: information received from Google, Microsoft, Stripe, or another service when you authorise a connection. For bank feeds, this includes the account name, account type, account and routing numbers, and transaction history received through Plaid when you connect an account.

We receive data from you, members of your organisation, people who contact us, services you connect, and your browser or device. Account identification and authentication information is needed to create and secure an account. Activating a Free organisation requires a verified email, the owner’s first and last name, and the organisation name; we cannot activate Free without these details. No credit card is required for Free activation. Billing information is needed for a paid subscription. Without information needed for a feature, we cannot provide that feature. Other optional profile details and integrations are voluntary.

3. How we use it

We use data to provide and secure the Service; authenticate users; import, reconcile, calculate, and display records; process billing; send transactional and security messages; provide support; prevent fraud and abuse; maintain backups and audit trails; comply with law; resolve disputes; and improve reliability and features. We do not use customer User Data for general-purpose model training.

Our support team may use AI-assisted tools to help investigate questions and prepare helpful responses. We limit the information used to what is needed to address your request.

4. Legal bases

For EEA/UK users, we rely on performance of a contract where necessary to perform a contract with you; legitimate interests for security, support, product reliability, business administration, and providing accounts to representatives of business customers; legal obligation for tax, accounting, and compliance records; and consent where required for optional cookies or marketing. You may withdraw consent at any time without affecting earlier processing. For Hong Kong users, we process personal data for purposes notified at collection and in accordance with the Personal Data (Privacy) Ordinance (PDPO), including the data-protection principles. For US users, the relevant state notice and rights are described below.

5. Sharing and processors

We share data only as needed to provide the Service, at your direction, or as permitted by law. Categories include cloud hosting/database, authentication, payment processing (Stripe), email delivery, support tools, security and abuse prevention (including Cloudflare Turnstile), and integrations you enable such as Google, Microsoft, Stripe, and bank connections through Plaid. When you connect a bank feed, Plaid retrieves account details and transaction history from your institution to provide the connection. Plaid also has its own responsibilities for personal data under its applicable terms; you can review how Plaid handles your information in Plaid's End User Privacy Policy. Providers process data under contracts and confidentiality/security obligations. We may disclose data to advisers, authorities, or a successor in a merger or asset sale where lawful. We do not sell data or share it for cross-context behavioural advertising. See our Cookie Policy for the current cookie inventory.

External applications and AI assistants you authorise through API or MCP connections receive data within the access you grant. Their processing is governed by their own terms and privacy notices. Revoking a connection prevents future authorised access through it but does not recall data already disclosed. Accepting these documents does not itself enable an optional customer-directed integration or authorise data sharing with an external application or AI assistant you connect.

6. International transfers

Our production application and database are hosted by OVHcloud in the United States. Our live file storage and recovery backups are held in Cloudflare R2 buckets configured with the United States jurisdiction restriction. This describes our current primary hosting, file storage and backup arrangements; it does not mean that all access or processing takes place only in the United States. We operate from Hong Kong, Cloudflare edge services operate globally, and support, email, payments and integrations may involve other countries.

AccountFUN and its providers may process data outside your country, including in the US and other countries that may not provide equivalent protection. Storage and processing locations may change as we operate the Service. We do not commit to storage or processing exclusively in any particular country unless required by applicable law or expressly agreed in writing. Any location changes remain subject to applicable data-protection and transfer requirements and our contractual commitments. Where EEA/UK transfer rules apply, a valid transfer mechanism and any necessary supplementary measures must be in place before a restricted transfer takes place. These may include an adequacy decision, the EU Standard Contractual Clauses, and the UK transfer addendum or International Data Transfer Agreement, as appropriate. This policy does not itself execute those instruments. Contact us for the destinations and safeguards applicable to your use of the Service, and how to obtain a copy.

7. Retention and security

Organisation records remain while the organisation exists, including after subscription cancellation or non-payment. An authorised administrator can delete the organisation or request deletion through support. Deleting an individual user account removes that account and its memberships, but records belonging to a continuing organisation remain with that organisation. Export records you need before requesting deletion.

You may request deletion through support. After verifying your identity and authority, we delete the applicable data from active systems, subject to lawful retention requirements. Restricted backup copies expire under our backup retention schedule. We respond within applicable legal time limits.

Our retention schedule provides for subscription billing and tax records to be kept for seven years after the relevant financial year, Terms acceptance evidence for the life of the user account plus seven years, and support tickets for three years after their last activity. Operational logs are normally kept for 30 days; security events not tied to an organisation for three years. Organisation audit and security records are generally deleted with the organisation. A legal hold or another applicable legal requirement may extend retention for the specific records concerned.

Encrypted recovery backups expire on a rolling schedule: daily database backups within 30 days, monthly archives after about 12 months, point-in-time recovery archives within 42 days, and backup copies of deleted files within 45 days. Deleted data can remain in these restricted backups until expiry. Backups are used for recovery; completed deletions must be reapplied if a backup is restored into production.

We use access controls, encryption in transit and at rest where supported, monitoring, backups, and least-privilege practices, but no system is risk-free. If we become aware of a personal data breach affecting an organisation’s User Data, we notify that organisation without undue delay and assist its response. We notify individuals and regulators where required by applicable law.

8. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent, and may complain to your data-protection authority. You may disconnect a bank feed in the Service at any time, after which we stop retrieving data through Plaid. We may verify identity and may need to contact the organisation controlling the data. Contact support [at] accountfun [dot] com; we respond within applicable legal time limits and explain any permitted extension or refusal. If an applicable US state law gives you a right to appeal a refusal, reply to our response requesting an appeal.

9. Regional notices

EEA and UK

You may complain to your local supervisory authority. We do not make solely automated decisions producing legal or similarly significant effects. If your organisation is the controller, direct requests about its User Data to that organisation.

California and other US states

We have collected the categories listed above during the preceding 12 months. We use them for the purposes in this policy, disclose them to the processor categories listed above, do not sell or share them for targeted advertising, and do not discriminate for exercising privacy rights. California residents may request to know, access, correct, or delete personal information and may use an authorised agent. We will not charge more or provide less service because you exercise a right.

Hong Kong

You may request access to and correction of personal data under the PDPO. We will not use personal data for direct marketing unless permitted and, where required, you have been informed and consented. Requests and complaints may be sent to our contact above. You may also complain to Hong Kong’s Privacy Commissioner for Personal Data. We respond to access and correction requests within the applicable PDPO time limits, normally 40 days.

10. Children

The Service is for businesses and adults. Account holders must meet the minimum age in our Terms. Organisations may include information about minors in their bookkeeping records only where lawful and necessary, and remain responsible for the required notices and permissions. Contact us if a child has created an account or you believe children’s data has been provided unlawfully.

11. Changes and contact

We may update this policy and will publish the new version and date. Material changes will receive reasonable notice. The notice will identify when the updated policy takes effect and give you a reasonable opportunity to review it. To the extent permitted by applicable law, continued use of the Service after that effective date constitutes acknowledgement of the updated policy, including use through the API, MCP, connected applications, AI assistants and automated integrations acting on your behalf. The app may also request and record an express acknowledgement together with acceptance of the Terms. Continued use does not replace any notice, consent or approval required by applicable law or a separately signed agreement. That acknowledgement is not consent to every processing activity; optional cookies, marketing, integrations, and AI sharing require their own choices where applicable. For requests, complaints, or questions, contact support [at] accountfun [dot] com.