Privacy Policy

Etienne Camilleri, a self-employed sole trader in Malta, trading as Ledgerol, is the data controller for personal data processed through Ledgerol. This policy explains what we collect, why, and your rights under the EU General Data Protection Regulation (GDPR).

Data we collect and why

• Account data (email address, password hash, Google sign-in identifier) — to create and secure your account. Legal basis: contract.
• Financial figures you enter (account names, balances, notes, holdings, net worth history) — to provide the service. Legal basis: contract.
• Settings (display currency, plan) — to provide the service. Legal basis: contract.
• Technical and usage data (IP address, device and browser type, sign-in times, pages visited) — for security, fraud prevention and improving the product. Legal basis: legitimate interests.
• Support messages — to answer you. Legal basis: contract / legitimate interests.

We never connect to your bank and never ask for bank logins or card numbers. Payment details are collected directly by Paddle, not by us.

How we protect your data

Balances, account names, notes, holdings and net worth history are encrypted with AES-256 before they are stored. Anyone who obtained a copy of the database would see only encrypted text. Each user can only access their own records, administrators see aggregate counts only, and all traffic is encrypted in transit (HTTPS). We apply access controls and least-privilege practices to our systems.

Who we share data with

• Paddle.com — our Merchant of Record, for selling subscriptions, payments, subscription management, tax compliance and invoicing.
• Service providers — hosting, database and authentication providers that process data on our behalf, and market data providers (who receive only ticker symbols, never your data).
• Professional advisers — legal and accounting, where needed.
• Authorities — where required by law.

We do not sell your personal data.

International transfers

Some providers may process data outside the EEA. Where this happens we rely on adequacy decisions or the European Commission's Standard Contractual Clauses.

Retention

We keep your data while your account is active. When you delete your account (Settings → Delete account), your financial data and account are permanently deleted straight away. Billing records are kept by Paddle as required by tax law. Security logs are kept for a limited period and then deleted or anonymised.

Cookies and local storage

We use only essential storage: to keep you signed in and remember your theme preference. We do not use advertising cookies. Paddle may set cookies needed for checkout.

Your rights

You have the right to access, correct, erase, restrict or object to processing of your data, to data portability, and to withdraw consent at any time. You can delete your account yourself in Settings, or contact us at [contact email]. We respond within one month. You may also complain to the Maltese supervisory authority, the Information and Data Protection Commissioner (idpc.org.mt), or the authority in your country.

Changes

We will post updates here and notify you of material changes.

Contact

Etienne Camilleri · Malta · [contact email]