Privacy Policy

1. Who We Are and Scope

mGrog provides cloud accounting software, including invoicing, bills, bank statement reconciliation, reporting, document handling, and an AI assistant. This policy applies to people who visit or use mGrog, including account holders and users invited to a workspace.

2. Our Role: Organization and Data Intermediary

For information about you as a user (your account, sign-in, and use of the product), mGrog acts as the organization responsible for that personal data.

For the content customers put into their workspace, such as the names and contact details of their own customers, suppliers, and employees on invoices, bills, and bank statements, the customer decides what is collected and why. mGrog processes that data on the customer’s behalf to provide the service, acting as a data intermediary (processor). If your personal data appears in a business’s records and you have a question about it, please contact that business first. We will help the business respond.

3. Personal Data We Collect

• Account and profile data: name, email address, role, organization details, and your choice about marketing communications.
• Workspace and accounting data you enter: contacts (customers and vendors), invoices, bills, payments, credit notes, journal entries, items and inventory, bank accounts, tax settings, and reports.
• Uploaded files: receipts, invoices, bank statements, and other supporting documents, and the text extracted from them.
• Chat and voice content: messages you send to the AI assistant, attachments, and audio recordings you submit.
• Billing data: subscription plan, invoices, payment status, and proof-of-payment files you upload. We do not collect card numbers through the service.
• Support and privacy requests: messages, attachments, and the details of requests you send us.
• Usage and security data: audit log entries for material actions (such as who changed a record and when), and operational and security logs.
• Notification data: if you opt in to browser push notifications, a push subscription identifier for your browser.

4. How and Why We Use Personal Data

• to create and secure your account, verify your email, and authenticate you;
• to provide the accounting features, store your records, and produce reports;
• to process documents and run AI-assisted features you ask for;
• to manage subscriptions, issue invoices, and confirm payments;
• to send service emails, such as confirmation, password reset, billing, and trial reminders;
• to provide customer support and handle privacy requests;
• to maintain audit trails, detect misuse, investigate incidents, and keep the service secure;
• to meet legal obligations; and
• to send you marketing communications only if you have opted in. You can withdraw this consent at any time.

We rely on your consent where required, on the need to perform our contract with you, on our legitimate interests in running and securing the service, and on legal obligations. We do not sell personal data.

5. AI and OCR Processing

When you use AI features, the content you submit (prompts, relevant workspace context, document text and images, and audio) is sent to third-party AI and OCR providers so they can generate a response, extract text, or transcribe speech. We configure AI requests to route only to providers that do not store prompts for training or other use. Output is a draft for you to review, and you decide what is posted to your books.

Please avoid submitting personal data that is not needed for your accounting task.

6. Who We Share Data With

We share personal data only as needed to run the service, with the following types of service providers:

Within a workspace, data is visible to the users that the organization’s administrators have granted access to. Our authorized support and platform staff may access workspace data only where needed to provide support, maintain security, or meet legal duties. We may also disclose personal data where required by law or a competent authority, or to a successor in a merger or sale of the business, subject to this policy.

7. International Transfers

Our providers may process personal data outside Singapore and outside your country. Where we transfer personal data, we take steps to ensure the recipient protects it to a standard comparable to the PDPA, for example through contractual terms with our providers. If you are in the European Economic Area, the United Kingdom, or another region with transfer rules, we rely on appropriate safeguards where those rules require them.

8. Retention

We keep personal data only as long as needed for the purposes in this policy or as required by law. In practice:

• Accounting records (invoices, bills, journals, bank statement records, and their supporting documents) are kept for as long as the workspace is active and generally for at least five years, to support Singapore business record-keeping requirements.
• Chat sessions, attachments, and audio you delete are permanently purged about 30 days after deletion.
• Extracted document text kept for diagnostics is reduced to metadata after about 30 days.
• Audit logs are kept for accountability and security, with the content stored in them limited to what is necessary.
• Account and profile data are kept while your account is active and until a deletion request is processed, subject to the records we must keep.
• Privacy requests and our response are kept as evidence that we handled them.

Where data must be kept to meet a legal duty, a deletion request will apply once that period ends.

9. Security and Breach Notification

We protect personal data with authentication, role-based access controls that separate organizations’ data, private storage with time-limited access links for uploaded files, audit logging, and encrypted connections. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

If a data breach occurs that is notifiable under applicable law, we will assess it promptly and notify the Personal Data Protection Commission (PDPC), and affected individuals or customers, within the time the law requires.

10. Cookies and Browser Storage

The app stores your sign-in session and display preferences (such as light or dark theme) in your browser so that it works as expected. If you enable push notifications, your browser stores a service worker and a notification subscription. You can clear this storage or disable notifications in your browser settings, but signing in and some features will then not work.

11. Your Rights and Choices

Subject to applicable law, you may:

• ask for access to the personal data we hold about you;
• ask us to correct data that is inaccurate or incomplete;
• withdraw consent for purposes that rely on it, such as marketing. This does not affect processing needed to provide the service or meet legal obligations, and may limit the features available to you;
• ask about retention or request deletion of your personal data, subject to records we must keep.

Signed-in users can submit a request through the Privacy Request form. If you cannot sign in, email [email protected]. We may need to verify your identity first. We aim to respond as soon as reasonably possible, and if a response will take longer than 30 days we will tell you when to expect it.

We take reasonable steps to keep personal data accurate. If you tell us that your data is wrong, we will correct it as soon as practicable and, where relevant, tell other organizations we disclosed it to.

12. Users Outside Singapore

mGrog is designed first for Singapore businesses but can be used from other countries. If data protection law in your country (for example the GDPR in the EEA or UK) gives you additional rights, such as objection, restriction, erasure, or data portability, you may exercise them by using the contact details below. You may also complain to your local data protection authority.

13. Children

The service is intended for businesses and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided personal data, please contact us so we can remove it.

14. Changes to This Policy

We may update this policy as our service or the law changes. We will revise the date above and, for material changes, notify you in the product or by email where appropriate.

15. Contact and Complaints

For data protection questions, requests, or incidents, contact our Data Protection Officer at [email protected].

If you are not satisfied with how we handle your personal data, you may lodge a complaint with the Personal Data Protection Commission (PDPC) of Singapore, or with the data protection authority in your country.