Privacy Policy

1. Introduction

This Privacy Policy explains how PERIS ONE collects, uses, stores, discloses, and protects information when you use our cloud-based accounting and bookkeeping platform.

PERIS ONE operates as a sole proprietorship in Karachi, Pakistan, under the business name PERIS ONE (“PERIS ONE,” “we,” “us,” or “our”). PERIS ONE is a trading name and is not represented as a separate incorporated company.

This Policy applies to account holders, authorized users, and individuals whose information is included in records uploaded to or maintained in PERIS ONE.

Because customers may use PERIS ONE internationally, privacy rights and obligations may vary depending on the individuals involved, the customer’s location, and the laws that apply. This Policy does not replace mandatory rights under applicable law.

2. Information We Collect

2.1 Account and Contact Information

We may collect your name, email address, login credentials in protected form, account preferences, verification status, and information needed to administer your account.

2.2 Business and Accounting Information

Depending on how you use the service, Customer Data may include:

• Business and financial account details.
• Accounting entries, transactions, journals, vouchers, bills, and receipts.
• Supplier, customer, employee, and other contact information entered by you.
• Financial reports, account balances, and accounting configurations.
• Receipt photographs, attachments, and supported CSV or Excel files.
• User roles, permissions, and information associated with activity in a business account.

Customers are responsible for ensuring they have the necessary authority and lawful basis to provide information about other individuals.

2.3 Technical and Usage Information

We may collect limited technical information such as IP address (used, for example, to limit repeated sign-in attempts), timestamps, device or browser information, error reports, service-performance information, and usage events. This information helps operate the service, protect accounts, investigate technical issues, and improve product performance.

We may use properly anonymized, aggregated statistics for product analytics. We will not analyze customer accounting records for product improvement.

2.4 Subscription and Payment Information

We may process subscription plan, billing status, renewal preference, payment confirmation, transaction references, and related administrative records.

Payment gateways or banks may process payment information under their own privacy terms. We do not claim to store complete payment-card details unless that capability is separately implemented and disclosed.

2.5 Information You Provide to Support

If you contact us, we may process your email, the information you include in your message, and relevant information you choose to provide for troubleshooting or support.

Please avoid sending passwords or unnecessary sensitive financial documents in support messages.

3. How We Use Information

We use information as reasonably necessary to:

1. Create and administer accounts.
2. Provide accounting features, reports, file imports, and other requested functionality.
3. Keep each business’s data accessible only to appropriately authorized users.
4. Manage subscriptions, payments, renewals, and customer support.
5. Authenticate users, protect accounts, detect misuse, and investigate security incidents.
6. Diagnose errors, maintain service performance, and improve the product using technical and usage data and properly anonymized, aggregated statistics.
7. Respond to lawful requests and comply with legal obligations.
8. Establish, exercise, or defend legal claims.
9. Send service-related communications, including verification, security, billing, and material service notices.

We do not sell customer accounting records. We do not use those records for product improvement or for training general-purpose AI models.

4. Our Role in Processing Data

The role PERIS ONE plays depends on the information and purpose of processing.

For information used to administer our own customer relationship—such as account registration, billing, security, and support—we determine the relevant purposes and means of processing, subject to applicable law.

For accounting information a business customer uploads or maintains about its customers, suppliers, employees, and transactions, the business customer generally determines why that information is collected and how it should be used. PERIS ONE processes that information to provide the service and follow the customer’s authorized instructions, subject to applicable law.

Customers are responsible for establishing the necessary rights and permissions to provide such information. Where required by law or appropriate for the customer relationship, we may enter into a separate Data Processing Agreement (“DPA”) addressing processing instructions, confidentiality, security, subprocessors, incident handling, and deletion.

5. User Access and Business Data Separation

A business account may have multiple users with different roles:

• Admin: Can manage accounting records, business settings, users, roles, exports, and subscription billing.
• Staff: Can create and edit accounting records and export supported data, and can void documents where an Admin has allowed it, but cannot change business settings or manage users, roles, or billing.
• Accountant (read-only): Can view all records and reports and export supported data, but cannot create, edit, or void accounting records, or manage settings, users, or billing.

Only the Admin can invite users, assign roles, remove users, and request business-account deletion. A read-only Accountant can access multiple businesses only when each business’s Admin separately authorizes that access.

Customers are responsible for granting access only to appropriate individuals and removing access when it is no longer needed.

6. Access by PERIS ONE Personnel

PERIS ONE personnel do not browse your business records. Support access to your business inside the application is off by default. It is available only while your Admin allows it in Settings, for a limited period (1, 3 or 7 days), at the level your Admin chooses: view only, or view and fix. Support access cannot manage your users, change roles or billing, or export your data.

While support access is on, support's access to that business inside the application is recorded in the business's Audit Log, including when support opened it and any change made. Your Admin can turn support access off at any time.

Separately, as the operator of the service, PERIS ONE and our hosting and database providers can technically reach stored data. We limit any such access to situations reasonably necessary for security, maintenance, backup, or legal obligations, and we do not use it to review your accounting records. We do not promise that access of that kind, outside the application, is recorded in a customer-visible audit log.

7. Service Providers and Disclosure

We may disclose or make information available to service providers where reasonably necessary to operate PERIS ONE. Our current providers are:

• Neon, for the managed PostgreSQL database that stores account and business data.
• Vercel, for hosting and deployment of the application.
• Resend, for sending service emails such as account verification, password reset, billing reminders, and documents (for example invoices or statements) that you choose to email to your own customers and suppliers. Resend receives the recipient’s email address and the email content.
• Cloudflare (Turnstile), for a bot check on sign-in and sign-up. Cloudflare receives technical information about the visitor’s browser and IP address for that purpose.
• Sentry, for error monitoring. Error reports are configured to exclude business data and personal details and to describe the error and where it happened.
• Zoho Mail, for our support and billing mailboxes, which hold the messages you send us.

If we add other providers, such as an online payment gateway, we will update this list before they handle your information.

Service providers may process information on our behalf under arrangements appropriate to the service and applicable law. We do not authorize providers to use Customer Data to train general-purpose AI models.

We may also disclose information where reasonably necessary to comply with law, respond to valid legal process, protect users or the service, investigate suspected fraud or abuse, or establish or defend legal claims.

If PERIS ONE undergoes a business transfer, reorganization, or sale of relevant assets, information may be transferred as part of that transaction subject to applicable confidentiality and legal requirements.

8. International Data Processing

PERIS ONE is intended for international use. Our infrastructure providers may store or process information in locations outside the country where a customer or an individual is located.

Our production database (Neon) and application hosting (Vercel) are located in Singapore. Our email-sending provider (Resend) operates from Tokyo, Japan. Our error-monitoring, bot-check, and mailbox providers may process limited information in other locations. We operate PERIS ONE from Karachi, Pakistan, and may access information from there to provide support and maintain the service.

We therefore do not promise that Customer Data is stored exclusively in any one country. Where the law requires safeguards or notices for transfers of personal information, we will put them in place and update this Policy.

9. Security

We use reasonable technical and organizational measures intended to protect information from unauthorized access, alteration, disclosure, or loss.

Current account-security features include email and password login, email verification, password reset, rate limiting of sign-in attempts, a bot check on sign-in and sign-up, and an audit log of changes made inside each business. We do not claim that multi-factor authentication is available unless it is implemented and enabled.

No system can guarantee absolute security. Customers should use strong, unique passwords, protect their email accounts, assign roles carefully, and notify us promptly of suspected unauthorized access.

If a security incident affects Customer Data, we will investigate and take reasonable steps to contain and mitigate it. We will notify affected customers without undue delay where appropriate, subject to applicable law and the information reasonably available at the time.

10. Retention and Deletion

We retain account and Customer Data while the account remains open and until deletion is requested, subject to applicable legal obligations and limited retention needs relating to backups, security, disputes, and other legitimate purposes.

Subscription expiry or non-renewal does not automatically delete the business account or its data. After a trial or paid subscription expires and the grace period has passed, the account becomes read-only, allowing viewing and supported exports while preventing creation or editing of accounting entries until an eligible subscription is activated.

Only the business account’s Admin may request deletion, by emailing hello@perisone.com. We may verify the requester’s identity and authority before processing the request.

We will handle verified deletion requests within a reasonable period, subject to applicable law, technical constraints, and legitimate retention requirements. We do not promise a fixed deletion deadline or immediate removal from every backup, security record, or infrastructure system.

We use the recovery and backup features available through our infrastructure providers. A configured seven-day recovery period does not guarantee recovery from every incident or that every deleted item can be restored.

Customers should export records they need before requesting deletion. Available exports include Excel and PDF versions of reports and documents where supported by the application. We do not promise a full database backup export.

11. Your Rights and Requests

Depending on applicable law, you may have rights to request access to, correction of, deletion of, or information about the processing of your personal information, or to object to or restrict certain processing.

Requests may be sent to hello@perisone.com. We may ask for information necessary to verify your identity or authority before responding.

If your request concerns information maintained by a business customer—for example, a supplier or customer record in that business’s accounting system—we may refer the request to the relevant business Admin or assist that customer as appropriate. We may not be able to independently change records controlled by another customer.

We will handle requests in accordance with applicable law and may retain information where legally required or otherwise permitted.

12. Cookies and Similar Technologies

PERIS ONE may use essential cookies or similar technologies to support login sessions, security, and core service functionality. The bot check provided by Cloudflare may use its own technical cookies or storage for security purposes.

If analytics or other non-essential cookies are introduced, we will provide appropriate notice and obtain consent where required by applicable law. We do not claim to use advertising cookies or cross-site advertising trackers unless such functionality is actually introduced and disclosed.

13. Marketing and Service Communications

We may send necessary service communications concerning account verification, security, billing, service changes, and support.

We will not send promotional marketing without the required consent or other lawful basis. Where marketing is introduced, you may opt out using the available method, without affecting essential service communications.

14. Artificial Intelligence

PERIS ONE may introduce AI-powered features in the future. This Policy does not claim that such features are currently available.

Before introducing a feature that processes Customer Data using AI, we will assess the feature’s purpose, disclose relevant processing, and provide additional terms or controls where required. AI processing will be limited to what is reasonably necessary to provide the requested feature and will be subject to appropriate safeguards.

We will not permit AI providers to use Customer Data to train general-purpose models. We will update this Policy and any applicable DPA before introducing materially different AI processing.

15. Children

PERIS ONE is intended for users aged at least 18 or the age of legal majority in their jurisdiction, if higher. It is not intended for children. If we learn that an account has been created in violation of this requirement, we may take appropriate steps consistent with applicable law.

16. Third-Party Services

The service relies on third-party infrastructure providers, and future features may introduce other providers. A third-party service may have its own privacy policy and terms.

We are not responsible for independent processing by a third party acting as a separate controller. We will take reasonable steps to select and manage providers involved in processing data on our behalf, as appropriate to the service and applicable law.

17. Changes to This Policy

We may update this Privacy Policy as the service, our practices, or applicable legal requirements change.

We will revise the “Last updated” date and provide notice of material changes where reasonably appropriate. The updated Policy will apply from the stated effective date, subject to applicable law.

18. Contact

For privacy questions, data requests, security concerns, or deletion requests, contact:

PERIS ONE Email: hello@perisone.com Operator: PERIS ONE, a sole proprietorship operating in Karachi, Pakistan.