AccountRio

Privacy Policy

Last updated 23 October 2026

Axceera (Pvt) Ltd provides AccountRio. We collect only what we need to run it, we don’t sell personal data, and we use no advertising or analytics trackers. Payments are handled by Paddle.com, our merchant of record, so we never see your card details. Questions: privacy@accountrio.app.

1. Who we are

AccountRio (accountrio.app and app.accountrio.app) is provided by Axceera (Pvt) Ltd, a company registered in Sri Lanka (“we”, “us”). This policy explains what personal data we handle, why, who we share it with, and the choices and rights you have. It applies to our website, the app, the waitlist and our emails.

  • We are the controller of the data about the people who use AccountRio and visit our website: account, sign-in, billing, waitlist and support data.
  • We are a processor for the data businesses put into AccountRio about their own clients and contacts (names, emails, addresses, invoices, estimates). The business that uses AccountRio is the controller of that data. If you are one of their clients, please contact that business first; we will help them answer you.

Privacy contact: privacy@accountrio.app.

2. What we collect

Your account

  • Your name, email address and password (stored only as a secure hash).
  • Two-factor sign-in settings and backup codes, if you turn them on; your sessions, with the IP address and browser they came from.

Your business and its work

  • Business details: name, legal name, address, tax numbers, logo, currency and the payment instructions you print on invoices.
  • Your team: members’ names, emails, roles and, if you set them, private hourly cost rates.
  • What you create: clients and contacts, projects, invoices, estimates, payments and payment proofs, time entries, expenses and receipts, recurring invoices and reminders.
  • When a client opens an invoice or estimate link we record that it was viewed; when they accept or decline an estimate we record the name they typed, the time, their IP address and browser, as evidence of the decision.

Billing

Paddle collects your payment details, billing address and tax number when you buy a plan. We receive from Paddle your customer and subscription identifiers, plan, seats, billing country, amounts and payment status. We never receive or store card numbers.

The waitlist

If you join the waitlist we collect your email address and, if you give them, your name and business, with where and when you joined.

Support and technical data

  • What you tell us when you email us.
  • Server logs kept by our hosting provider for security and troubleshooting: IP address, browser, the page or API address requested, the time and any error.
  • In-app guides (where they are switched on): a hashed form of your user id, your role, your plan and trial status, and which guide steps you complete.

3. Why we use it, and our legal bases

  • To provide AccountRio (create your account, store your work, send the invoices, estimates, reminders and statements you ask us to, run reports): performance of our contract with you.
  • To keep it secure (sign-in protection, two-factor sign-in, limiting repeated attempts, preventing fraud and abuse): our legitimate interest in protecting you, your data and the Service.
  • To bill you and keep financial records: our contract with you and our legal obligations.
  • Service emails (email confirmation, password resets, invitations, billing and important changes to the Service or these policies): our contract with you.
  • Waitlist and launch news: your consent, which you can withdraw at any time with the unsubscribe link or by emailing us.
  • In-app guides and improving the product: our legitimate interest in helping people learn and use AccountRio.
  • Legal reasons: to comply with the law, respond to lawful requests, and establish or defend legal claims.

We do not sell or rent personal data, we do not share it for advertising, and we do not use it for automated decisions that have legal or similarly significant effects on you.

4. Who we share it with

  • Paddle (Paddle.com Market Limited and its affiliates), our merchant of record and online reseller: it processes payments, taxes, receipts, refunds and subscription management as an independent controller under its privacy notice.
  • Cloudflare, Inc.: hosting of the website, app, database and files, email delivery, protection against attacks, and server logs.
  • Brevo (Sendinblue SAS): our waitlist list and launch emails.
  • PlayStep: in-app guides, where switched on (the hashed id and traits above, never your business data).
  • The people you choose to share with: your team members, and the clients you send documents to.
  • Professional advisers, authorities or courts where the law requires it, and a buyer or successor if our business is reorganized or sold, under the same protections.

Our service providers act on our instructions under contracts that require them to keep the data confidential and secure. Exchange rates are fetched from a public rate service without any personal data.

5. Where your data is stored

AccountRio’s database and files are hosted by Cloudflare in the United States, and our providers may process data in other countries. When personal data from the European Economic Area, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (and the UK addendum) or another approved safeguard. Ask us for a copy at privacy@accountrio.app.

6. How long we keep it

  • Account and business data: while your account or organization is open. When you ask us to close it, we delete it within 30 days, and it leaves our backups within a further 30 days.
  • Billing records: as long as tax and accounting law requires (typically up to 7 years); Paddle keeps its own transaction records.
  • Waitlist entries: until you unsubscribe or ask us to remove you.
  • Server logs: a few days, unless needed to investigate a security incident.
  • Support emails: up to 2 years after the conversation ends.

7. Security

Everything is served over HTTPS. Passwords are hashed, two-factor sign-in is available to every user, access inside an organization follows each member’s role, receipts and payment proofs are only served to signed-in members of their organization, and client links use long random tokens. No system is perfectly secure; if a breach affects your personal data we will tell you and the relevant authorities as the law requires.

8. Your rights

Depending on where you live (for example under the GDPR in the EU, the UK GDPR, Sri Lanka’s Personal Data Protection Act No. 9 of 2022, or US state laws such as California’s), you may have the right to:

  • access the personal data we hold about you and get a copy of it;
  • have it corrected, or deleted;
  • receive it in a portable format;
  • object to or restrict how we use it, and withdraw consent at any time;
  • not be treated differently for using these rights.

Most of your data can be viewed, changed and exported in the app. For anything else, email privacy@accountrio.app. We will answer within one month (sooner where the law requires) and may need to confirm your identity first. You also have the right to complain to your data protection authority, such as your local supervisory authority in the EU, the Information Commissioner’s Office in the UK or the Data Protection Authority of Sri Lanka, though we would like the chance to help first.

9. Cookies

We use only cookies that are strictly necessary for AccountRio to work, so we don’t ask for consent to them, and no advertising or analytics cookies:

  • better-auth.session_token and better-auth.session_data (with a __Secure- prefix on HTTPS): keep you signed in.
  • ar_org: remembers which of your organizations is open.
  • ar_db: makes sure you always see your own latest changes.
  • ar_theme: your light, dark or system appearance choice.

The app also keeps a short list of recently visited pages in your browser’s session storage for its back button. Paddle’s checkout sets its own cookies when you open it; see Paddle’s privacy notice.

10. Children

AccountRio is a business tool for adults. It is not meant for anyone under 18, and we do not knowingly collect their personal data.

11. Changes to this policy

We will post any change here with a new date and, if it is significant, tell account Owners by email or in the app before it takes effect.

12. Contact

Axceera (Pvt) Ltd, Sri Lanka. Privacy: privacy@accountrio.app. Everything else: support@accountrio.app. See also our Terms of Service and Refund Policy.