Privacy Policy

This Privacy Policy describes how Socotra Enterprises Inc., a corporation doing business as SocotraLedger ("we," "us," "our," or "the Platform"), collects, uses, stores, and protects information about you when you use the SocotraLedger platform available at socotraledger.com.

By accessing or using the Platform, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this policy, do not use the Platform.

2.1 Information You Provide Directly

When you create an account or use the Platform, we collect:

• Identity data: Full name, email address, phone number, and username
• Authentication data: Encrypted password credentials managed through our authentication provider
• Billing data: Billing address and payment information (processed by our payment processor; we do not store full payment card details)
• Property and financial data: Building information, income records, expense records, budget data, tenant information, lease details, rent payment records, and other financial ledger data you enter into the Platform
• Uploaded files: Documents, images, receipts, invoices, leases, and other files you upload to the Platform's document storage feature
• Communications: Messages and information you submit through our contact form or by emailing us directly

2.2 Information Collected Automatically

When you use the Platform, we automatically collect certain technical information:

• Log data: IP address, browser type, operating system, pages visited, timestamps, and referring URLs
• Device data: Device type, screen resolution, and general hardware information
• Usage data: Features accessed, actions performed, and session duration
• Location data: General geographic location derived from your IP address, used strictly to detect and block unauthorized or suspicious foreign login attempts. We do not track precise physical location.

2.3 What We Do Not Collect

We do not collect:

• Social Security Numbers (SSNs) or government-issued identification numbers
• Credit scores or creditworthiness data
• Biometric data of any kind
• Data through advertising trackers, pixels, or social media plugins
• Any data from children under 18 years of age

We use the information we collect to:

• Provide, operate, and maintain the Platform and its features
• Create and manage your account and user sessions
• Process subscription payments and manage billing
• Send transactional emails including account notices, security alerts, and platform notifications
• Send automated property-related alerts on your behalf (such as lease expiry notices and late rent alerts) to recipients you designate
• Detect, investigate, and prevent fraudulent transactions, unauthorized access, and other security incidents
• Comply with legal obligations
• Respond to your support requests and inquiries
• Improve and optimize Platform performance and user experience

We do not use your data for advertising, marketing profiling, or sale to third parties under any circumstances.

We do not sell, trade, rent, or share your personal information with third parties for their marketing purposes. We share data only in the following limited circumstances:

• Infrastructure providers: We use cloud hosting and database services (including Supabase) to store and process Platform data. These providers are contractually bound to protect your data and may not use it for their own purposes.
• Payment processors: When billing is active, payment processing is handled by Stripe. Your payment information is transmitted directly to Stripe and is subject to their privacy policy. We do not store full card numbers.
• Email delivery: Transactional and notification emails are sent through our SMTP service provider. Email content may pass through their servers for delivery purposes only.
• Legal requirements: We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred to the acquiring entity, subject to the same privacy commitments.

We retain your data for as long as your account is active and for a period of 12 months following account termination or deactivation. This retention window exists to allow users to access and export historical records for tax, accounting, and auditing purposes.

After the 12-month retention period, your data may be permanently and irreversibly deleted from our systems. You are responsible for exporting any data you wish to retain before this period expires.

Uploaded files stored in our document storage system are subject to the same 12-month retention policy following account deactivation.

Certain data may be retained for longer periods if required by applicable law or for legitimate business purposes such as fraud prevention or dispute resolution.

We implement industry-standard technical and organizational security measures to protect your data, including:

• Encrypted data transmission (TLS/HTTPS) for all Platform communications
• Row-level security (RLS) policies ensuring users can only access data they are authorized to view
• Encrypted password storage managed through our authentication provider
• Access controls restricting internal access to user data on a need-to-know basis
• IP-based login monitoring to detect and block unauthorized access attempts
• Two-factor authentication (2FA) available to all users

No method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach that affects your rights, we will notify affected users in accordance with applicable law.

The Platform uses cookies and similar tracking technologies to maintain user sessions and provide core functionality. For detailed information about the cookies we use and how to manage them, please see our Cookies Policy.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete personal data
• Deletion: Request deletion of your personal data, subject to our retention obligations
• Portability: Request your data in a portable, machine-readable format
• Objection: Object to certain processing of your personal data
• Restriction: Request that we restrict processing of your personal data in certain circumstances

To exercise any of these rights, please contact us at [email protected]. We will respond to verified requests within 30 days. We may need to verify your identity before processing your request.

You may update your account information directly through your profile settings in the Platform at any time.

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete your personal information, and the right to opt out of the sale of your personal information.

We do not sell personal information. To exercise your CCPA rights, contact us at [email protected].

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, your personal data is processed under the General Data Protection Regulation (GDPR) or applicable equivalent legislation.

Our legal basis for processing your data includes: performance of a contract (providing the Platform service you requested), legitimate interests (security, fraud prevention, service improvement), and compliance with legal obligations.

You have the right to lodge a complaint with your local data protection authority if you believe we have not handled your data appropriately.

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing any personal information.

The Platform is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that a child under 18 has provided us with personal information, we will take steps to delete such information promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email at the address associated with your account. Your continued use of the Platform after any changes constitutes your acceptance of the updated policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Socotra Enterprises Inc. (doing business as SocotraLedger)
Email: [email protected]
Website: socotraledger.com

We aim to respond to all privacy inquiries within 30 business days.