This policy explains what personal data RareMargin collects, why, who else handles it, how long it is kept, and the rights you have. It is written to stand on its own, so you can read it without the terms.
In short: we collect what is needed to run accounting software for your business, we don’t sell it, nothing in your books is used for advertising, and nobody trains AI on it. Our public website (not the app) uses Reddit’s ad pixel to see which visits come from our ads, and you can turn it off.
01Who is responsible
RareMargin is run by Sudip Kumar, an individual based in India, at Kalikapur, Haltu. Email support@raremargin.com.
We have two roles, depending on the data:
- Accounts, billing, support and website visits: we decide how this data is used, so we are its controller (a “data fiduciary” under India’s Digital Personal Data Protection Act, 2023).
- A company’s books: the customers, vendors, transactions and other records a business keeps in RareMargin, including details about people. That business decides what goes in and is the controller; we process it on its behalf under our data processing terms. If your details are in a company’s books, contact that company first.
02What we collect, and why
| Data | Why we use it |
|---|---|
| Account: name, work email, password (stored only as a salted scrypt hash), whether the email is confirmed, the companies you belong to and your role in each | To create and secure your account, sign you in, confirm your address and control what you can see and do. |
| Two-factor sign-in, if you turn it on: the authenticator secret and your recovery codes (stored only as hashes) | To check the code you enter when you sign in. |
| Company: its name, base currency, settings and plan | To run the company’s books the way it chose. |
| Books: accounts, entries, customers, vendors, contracts, invoices, bills, bank transactions and attachments you add or import | To provide the service to the company, which decides what goes in. |
| Assistant: your questions, its answers, conversation threads, prompts for AI dashboards, and how many messages each person sends | To answer you, let you return to a thread, and keep to the company’s monthly allowance. |
| Activity: who did what in a company and when (the audit log), API keys (stored only as hashes) and webhook settings | To keep a trustworthy record of changes, which accounting needs, and to run your integrations. |
| Billing: Dodo Payments’ customer and subscription references, the plan’s status and dates, and the payment notices Dodo sends us (which include the buyer’s name, email, country and amount) | To know whether the company has paid, show billing in the app, and keep billing records. We never see full card numbers. |
| Emails: the ones we send you and the ones you send us | To deliver the messages the service needs (confirmations, resets, invitations, trial and billing notices) and to help you. |
| Website visits, through Reddit’s ad pixel on the public pages and the sign-up page: the pages you view, the ad you came from, your IP address and browser details, and whether you signed up | To see which of our ads on Reddit bring visitors and sign-ups, and decide where to advertise. Never collected inside the app, or once you turn it off (see cookies). |
| Technical: IP address, browser details and times of requests | To keep the service secure and limit abuse. IP addresses are used in memory to slow down repeated sign-in attempts and appear in our host’s short-lived request logs. |
You give us account details yourself when you sign up or accept an invitation; without them we can’t provide an account. We don’t collect special categories of data (such as health or religion), and we don’t ask for them. The service isn’t meant for anyone under 18, and we don’t knowingly collect their data.
03Legal grounds
Where the GDPR or UK GDPR applies, we rely on:
- contract: to provide the service you or your company signed up for (accounts, books, assistant, emails it needs);
- legitimate interests: to keep the service secure, prevent fraud and abuse, keep audit records, answer you and improve the service from usage counts; we have weighed these against your rights, and you can object (see your rights);
- legal obligation: to keep records or disclose data when the law requires;
- consent: for Reddit’s ad pixel, which the website asks about before it runs; you can withdraw it at any time under “Your privacy choices” at the foot of the website.
Under India’s DPDP Act, we process account data for the purpose you gave it to us for (section 7(a)) or with your consent given at sign-up, which you can withdraw by deleting your account. Withdrawing doesn’t affect processing done before.
We don’t sell personal data, show advertising in the service, or make decisions about you by automated means that have legal or similarly significant effects. The only advertising technology we use is Reddit’s pixel on the public website (see cookies).
04Who else handles it
We share personal data only with these providers, each bound by a contract that limits what it can do with the data, and only as needed for what it does for us:
| Provider | What it does | Where |
|---|---|---|
| Cloudflare, Inc. | Runs the app and its network: hosting (Workers and Containers), protection from attacks, and sending and forwarding our email. All traffic to the service passes through it. | Its global network; a company in the United States |
| Databricks, Inc. (Neon) | The database that stores accounts and books, with its backups. | Amazon Web Services, United States (US East) |
| OpenAI, L.L.C. | The AI model behind the assistant and AI-built dashboards. Receives your question and the parts of your books the assistant reads to answer it. Not used to train models; kept up to 30 days for abuse monitoring. | United States |
| Google LLC (Gmail) | The inbox our support, billing and other addresses forward to: the emails you send us. | United States |
| Dodo Payments | Merchant of record: checkout, payment, invoices, sales tax and refunds. It decides what it collects at checkout under its own privacy policy, as an independent controller. | Where Dodo Payments and its payment partners operate |
Besides them, data goes:
- to the people in your company, according to the roles its owners assign;
- to the places your company tells us to send it, such as its webhook endpoints and API clients;
- to Reddit, Inc., through its ad pixel on the public website if it runs for you (see cookies), which uses that data under its own privacy policy, including to show you ads;
- to authorities, courts or others when the law requires it, or to protect people from harm;
- to whoever takes over the service, if it is transferred, under this policy.
We will update this list before adding a provider, and email account owners when a change matters.
05Where data is processed
We run the service from India. The database is in the United States (Amazon Web Services, US East), Cloudflare serves requests from its data centres around the world, and OpenAI, Google and Reddit process data in the United States. So your data is transferred outside your country, including outside India and the European Economic Area.
Where the GDPR or UK GDPR requires safeguards, transfers are covered by the European Commission’s standard contractual clauses and the UK addendum: in our providers’ data processing terms, and, for data your company sends us, in our own data processing terms. Under India’s DPDP Act, data may be transferred abroad except to countries the Government restricts.
06How long we keep it
| Data | Kept |
|---|---|
| Account and the company’s books | While the account is open. When an owner deletes a company, it goes from the live service at once and from backups within 7 days, with every account left with no other company. |
| Companies without a subscription | Kept read-only so you can come back. After 12 months with no subscription and no sign-in, we may delete them, after emailing the owners 30 days ahead. |
| Sign-in sessions | 14 days, or until you sign out. Changing your password or two-factor settings signs out your other sessions. |
| Emailed links and two-factor steps | Until they expire (5 minutes to 7 days) or are used, then deleted within a day. |
| Assistant conversations | Until someone in the company deletes them, or the company is deleted. OpenAI keeps the requests up to 30 days for abuse monitoring. |
| Request logs at our host | Up to 7 days. |
| Reddit’s pixel | Its cookies last 90 days, or until you turn it off or clear them. Reddit keeps what it receives under its own privacy policy. |
| Emails with us | As long as needed to help you, and no more than 3 years. |
| Payment records | Dodo Payments keeps them as tax and payment laws require. |
07Security
Data is encrypted in transit (HTTPS) and stored encrypted at rest by our database provider. Passwords, recovery codes, API keys and emailed links are stored only as hashes. Sign-in attempts are rate limited, two-factor sign-in is available to everyone, and access inside a company follows the roles its owners assign. Posted entries are sealed into a tamper-evident hash chain, and changes proposed by the AI or by API clients wait for a person to approve them.
No system is perfectly secure. If a breach affects your personal data, we will tell the affected companies and people without undue delay, with what happened and what to do, and notify the authorities the law requires (in India, the Data Protection Board).
08Your rights
Depending on where you live, you can ask us to:
- tell you what personal data we have about you and how we use it, and give you a copy (in a portable format where the GDPR applies);
- correct, complete or update it;
- delete it (owners can delete a company and its accounts themselves in Settings → Company);
- restrict or object to how we use it, including where we rely on legitimate interests;
- withdraw consent you gave, without affecting what was done before.
In India you can also nominate someone to exercise these rights if you die or become unable to, and, after first raising a grievance with us, complain to the Data Protection Board of India. In the EU or UK you can complain to your data protection authority. Residents of US states with privacy laws have the rights those laws give. Reddit’s pixel on the public website may count as “sharing” personal data or “targeted advertising” under those laws: you can opt out under “Your privacy choices” at the foot of the website, and we treat a Global Privacy Control signal from your browser as an opt-out. We don’t sell personal data.
To use a right, write to support@raremargin.com from your account’s email address. It’s free. We may ask you to confirm who you are, and we reply within 30 days. For data in a company’s books, we pass your request to that company and help it respond.
09Grievance Officer
As India’s IT Rules and DPDP Act require, our Grievance Officer handles complaints and questions about how we process personal data:
Sudip Kumar, Grievance Officer, RareMargin
Kalikapur, Haltu
support@raremargin.com
We acknowledge a grievance within 2 business days and resolve it within 30 days.
11Changes to this policy
If we change this policy in a way that matters, we will email account owners at least 30 days before it applies, unless the law requires a faster change, and update the date above.