Privacy Policy

This Privacy Policy explains how ALFASIHUN (“we”, “us”, or “our”) collects, processes, protects, and retains your information across our websites and the ALFASIHUN Practice Operating System (ERP, Professional Advisor, Business Intelligence), as well as the free ALFASIHUN Money service.

Controllership Boundaries:

• Practice Identity & Subscriptions: ALFASIHUN acts as the Data Controller for your administrative user credentials, firm contact details, and billing transaction metadata.
• Client Workspaces: Your firm and your client entities act as the Data Controllers for the financial ledgers, customer/vendor master records, payroll data, and advisory dossiers maintained within client workspaces. ALFASIHUN operates strictly as a Data Processor executing your documented accounting instructions within isolated tenant perimeters.

We process only categories of information required to fulfill our software commitments:

• Practice Registration & Account Data: Full name, professional work email address, practice firm name, contact telephone, and operating country jurisdiction.
• Workspace Financial Records: General ledger accounts, journal entries, charts of accounts, customer invoices, supplier bills, bank reconciliation feeds, inventory valuations, and statutory tax identifiers entered into a workspace.
• Document Attachments: Invoices, receipts, contractual papers, and financial spreadsheets uploaded by users for document processing or advisory case working papers, stored in encrypted private vaults.
• Billing & Merchant Records: Transaction IDs, billing interval, and subscription tier tokens received from our Merchant of Record, Paddle.com. We do not store raw credit card numbers.

We recognize that accounting ledgers and corporate advisory files represent the most confidential assets of an enterprise. We enforce strict technical and contractual safeguards:

• No AI Foundation Training: Your financial data, journal entries, client dossiers, and uploaded documents are never used, shared, or retained to train, refine, or evaluate public or commercial AI models.
• Nothing Kept After Processing: Computational processing operates in transient, stateless execution environments. Once an automated calculation or parsing task completes, the ephemeral memory is immediately purged.
• Practitioner Confidentiality: Your firm’s strategic scenarios and legal working papers remain private to your authorized workspace users.

Our business model is transparent: we generate revenue solely through direct software subscriptions for our enterprise Practice Operating System.

We do not monetize user data. We never sell, lease, or license customer transaction histories, vendor pricing, client rosters, or margin analytics to data brokers, hedge funds, advertising networks, or third-party analytics firms.

To maintain 99.9% availability and global edge routing, we engage vetted enterprise infrastructure sub-processors adhering to stringent security benchmarks:

We implement defense-in-depth security controls to protect financial records:

• Encryption Standards: bank-grade encryption protects every transmission, and all stored records and backups are encrypted.
• Tenant Boundary Enforcement: Every query and report is restricted to the authenticated tenant partition, preventing cross-tenant access.
• Continuous Backups & Geo-Redundancy: Automated encrypted snapshots stored across geographically separated regions for disaster recovery.

Regardless of your jurisdiction (including the European Union under GDPR, the United Kingdom under UK GDPR, the United States under CCPA/CPRA, and Pakistan under PECA/Personal Data Protection regulations), you possess enforceable statutory rights:

• Right to Access & Portability: Request an export of your personal information and complete financial books in standard machine-readable formats.
• Right to Rectification: Update inaccurate firm details or financial records directly in Account Settings.
• Right to Erasure (“Right to be Forgotten”): Request the permanent deletion of your account and associated records, subject only to statutory tax retention requirements.
• Right to Restrict Processing: Request restrictions on specific automated processing activities.

To exercise any of these statutory rights, contact our Data Protection Office directly at: legal@alfasihun.com. We verify identity before processing requests and respond within statutory timeframes.

We retain Customer Data for the duration of your active subscription. If you cancel your subscription, your workspaces transition into export-only status for thirty (30) days, during which you can download full ledger archives.

Upon explicit account deletion, Customer Data is permanently purged from active production databases and phased out of encrypted backup cycles within sixty (60) days.

If you have questions, concerns, or regulatory compliance inquiries regarding this Privacy Policy, please reach our Data Protection Officer at: