Privacy Policy

1. Who is responsible for your data

Code Nation LLC operates Account Trail and is the data controller for the account data described below.

806 NW 16TH AVE STE 648, GAINESVILLE, FL 32601, United States

Privacy enquiries: [email protected]

There is a second relationship worth naming up front, because it changes who is responsible for what. For your own account we are the controller. For the records you enter about your customers and suppliers, you are the controller and we act as your processor - we hold that data on your instructions and do not decide what happens to it.

2. What we collect

Account data. Your name, email address and a hashed password. We never store your password itself.

Business profile. Business name, contact details, address, logo, currency, country, tax identifiers and invoice preferences - whatever you choose to enter.

The records you create. Customers and suppliers you add (name, email, phone, address), invoices, bills, expenses, inventory items, stock movements and any files you upload such as receipts and logos.

Technical data. For each session we store an IP address and browser user-agent string, used to keep you signed in and to detect suspicious access. Administrative actions in our internal panel are logged with an IP address for audit purposes.

Support and contact. If you use the contact form we store your name, email, message, the page you were on, your browser user-agent and your IP address. The IP is used to rate-limit abuse of a form that requires no account.

Payment data. Handled by our merchant of record - see section 4. We do not receive or store card numbers.

3. Why we use it, and on what basis

• To provide the service - creating your account, storing your records, generating invoices and reports, sending mail you ask us to send. Basis: performance of our contract with you.
• To take payment for a paid plan. Basis: performance of contract.
• To keep the service secure - session records, audit logs, rate limiting, abuse investigation. Basis: our legitimate interest in a service that is not abused.
• To support you - answering messages and tracking the resulting issue to resolution. Basis: legitimate interest, or contract where it concerns your account.
• To meet legal obligations, including tax and accounting record-keeping. Basis: legal obligation.

We do not sell your data, and we do not use it to train machine-learning models. We do not run behavioural advertising.

4. Payments and card details

Paddle.com Market Ltd is our merchant of record. When you subscribe, it collects your payment details inside its own secure frame, charges you in its own name, handles tax, and issues your invoice.

Your card details never reach our servers - we are not given them and we store no card reference. What we receive back is limited to what we need to run your subscription: a customer and subscription identifier, plan status, billing dates, amounts, and the brand and last four digits of the card so we can display which card is on file.

Our merchant of record is an independent controller of the payment data it collects.

5. Who else processes your data

We use a small number of service providers to run Account Trail. Each is bound by contract to process data only on our instructions:

• Paddle.com Market Ltd: Payment processing, tax collection and invoicing as merchant of record.
• Resend: Transactional email: invoices you send, payment notices and account mail.
• Amazon Web Services (S3): Storage for files you upload, such as receipts and logos.
• Upstash: Caching and abuse rate-limiting.
• Atlassian (Jira): Tracking issues raised through the contact form.

We may also disclose data where we are legally required to, or to establish or defend a legal claim. If our business is transferred, your data may move with it; you will be told before that happens.

Some of these providers operate outside your country. Where data leaves the UK or EEA we rely on an adequacy decision or on standard contractual clauses.

6. How long we keep it

We keep your account and its records for as long as your account is open, and then as described here.

• On deletion, your businesses, customers, suppliers, invoices, bills, expenses, items, stock movements and uploaded files are permanently erased. This cannot be undone.
• Support history is kept but de-identified. Messages you submitted are retained so we do not lose the record of an issue, with the personal details on them scrubbed.
• Payment records are retained by our merchant of record for as long as tax and financial-reporting law requires. That obligation is not ours to waive.
• Session records expire automatically. Audit logs are kept for security review.

7. How we protect it

• All traffic is encrypted in transit over HTTPS.
• Passwords are hashed, never stored in readable form.
• Sensitive integration credentials are encrypted at rest with AES-256-GCM.
• Every record is scoped to its owning business, and access is checked on the server on every request rather than hidden in the interface.
• Our internal administration panel is deliberately walled off from customer financial records: staff can manage accounts and subscriptions without being able to read your invoices, bills or expenses. This is enforced automatically and tested on every change.

No system is perfectly secure. Please keep your own exports of anything you cannot afford to lose, and tell us at once if you suspect a problem.

8. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you, and receive a copy;
• correct data that is inaccurate or incomplete;
• have your data erased;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent where processing relies on it;
• complain to your data protection authority.

Write to [email protected]. We respond within one month. Note that where a request concerns data you entered about your own customers, we will refer the request to you, since you are the controller of it.

9. Cookies

We use cookies that are strictly necessary to run the service: one to keep you signed in, one to remember which business you have selected, and one to remember your light or dark theme preference. These require no consent because the service cannot function without them.

Our merchant of record sets its own cookies within its payment frame when you reach checkout. Blocking cookies entirely will prevent sign-in from working.

10. Children

Account Trail is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe we have, contact us and we will delete it.

11. Changes to this policy

We will update this page when our practices change, and the "last updated" date above always reflects the current version. Material changes will be notified by email or in the application before they take effect.

12. Contact

Privacy: [email protected] · General: [email protected]

Code Nation LLC, 806 NW 16TH AVE STE 648, GAINESVILLE, FL 32601, United States