Privacy Policy

1. Who We Are

Rakam is an AI accounting platform for UAE small and medium businesses, operated by Rakam Technologies FZC (راكام تيكنولوجيز), a free zone company registered in Ajman Free Zone, United Arab Emirates. In this policy, "Rakam", "we", "us" and "our" refer to Rakam Technologies FZC.

Rakam Technologies FZC is the data controller responsible for the personal data described in this policy. For any privacy question or to exercise the rights set out in section 6, contact us at info@rakamai.ae.

2. What Data We Collect

We collect only what is necessary to provide the service:

• Account data - email address, business name, WhatsApp number, password (encrypted)
• Financial data - invoices, receipts, transaction amounts, VAT figures you upload
• Usage data - when you sign in, which features you use
• Device data - browser type, IP address (for security only)

We do not collect payment card numbers, bank account details or UAE ID numbers.

3. How We Use Your Data

• To read and extract invoice data using AI
• To calculate UAE VAT and generate reports
• To save your transaction history securely
• To send account-related emails (confirmation, password reset)
• To improve the accuracy of our AI extraction

We do not sell your data. We do not use your financial data for advertising.

4. Where Your Data Is Stored

Your data is stored on Supabase infrastructure hosted on AWS in the Mumbai (ap-south-1) region - the closest available to the UAE. When you send a receipt or invoice, the image is processed by Anthropic's Claude AI to extract the data - Anthropic does not store the image itself beyond that processing request. Rakam separately keeps a copy of the original image in a private, access-controlled storage bucket, linked to the ledger entry it created, so every transaction can be traced back to its source document for audit purposes. Only your company's authorized users can view it.

Receipts and messages you send by WhatsApp reach Rakam through Meta's WhatsApp service and our messaging provider Twilio. Both necessarily handle the message and any attached image in transit before it reaches us. Account emails, including your confirmation and welcome messages, are delivered by Resend, which receives your name and email address for that purpose only.

5. Data Retention Policy

We retain your data for as long as your account is active, plus:

• Transaction records - 7 years (required by UAE Federal Tax Authority)
• Account data - deleted within 30 days of account deletion request
• Invoice/receipt images - kept alongside the transaction record they support, for the same 7-year retention period, as proof of the original source document
• Backup snapshots - retained for 30 days, then permanently deleted

6. Your Rights (UAE PDPL)

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), you have the right to:

• Access - request a copy of all data we hold about you
• Correct - update inaccurate personal data
• Delete - request deletion of your account and all associated data
• Export - download your transaction data as CSV at any time
• Withdraw consent - stop using the service at any time

To exercise any of these rights, email us at info@rakamai.ae

7. Cookies & Local Storage

We keep you signed in using your browser's local storage, not cookies - it holds only your session token. We do not use tracking cookies, advertising cookies or third-party analytics.

8. Third-Party Services

• Supabase - database and authentication (supabase.com/privacy)
• Anthropic Claude - AI invoice reading (anthropic.com/privacy)
• Cloudflare - web hosting (cloudflare.com/privacypolicy)
• Twilio - WhatsApp message delivery (twilio.com/legal/privacy)
• Meta (WhatsApp) - the messaging platform receipts arrive on (whatsapp.com/legal/privacy-policy)
• Resend - account and notification emails (resend.com/legal/privacy-policy)
• Zoho Books and QuickBooks - only if you connect them, and only for the approved transactions you choose to sync

9. Security

We protect your data using:

• Row Level Security - each user can only access their own data
• JWT authentication - every request is verified
• Encrypted connections - HTTPS everywhere
• Daily encrypted backups
• API keys stored in secure server vaults, never in client code

10. Changes to This Policy

We will notify you by email if we make material changes to this policy. Continued use of Rakam after changes means you accept the updated policy.