Sirah (Sirah) — Privacy Policy
Effective date: [1 November 2026] Last updated: [1 November 2026]
1. Who we are
This Privacy Policy explains how [Legal entity name] ("Sirah", "we", "us") handles personal information when you use the Sirah financial-operations software, also called Sirah. That includes:
the web application at sirah.co.in;
the vendor portal;
the supplier onboarding forms;
the related emails.
Together these are the "Service".
Registered address: [Registered address]
Privacy contact: [privacy@sirah.co.in]
Data Protection Officer / Grievance Officer (if required): [Name, email]
2. Our role: controller and processor
The Service is used by businesses (our "Customers") to run accounts payable: purchase orders, invoices, approvals, payments, budgets, vendor records and reconciliation.
For Customer business data, we act as a processor (service provider). This covers the data a Customer and its users put into the Service, for example vendor records, invoices, employee lists and documents vendors upload. We process it only on the Customer's instructions, under our agreement with that Customer. If you are a vendor or employee of one of our Customers, that Customer is responsible for your data, and you should contact them first.
For our own data, we act as a controller. This covers account and sign-in data we use to run, secure and bill for the Service, and our own website and enquiry data.
3. Information we collect
3.1 Account and sign-in information
Name, work email address, job title, role and permissions, and the companies or subsidiaries you can access.
Your password. We never store it in readable form: it is protected with a one-way scrypt hash. We never send passwords by email. New users set their own password through a single-use link.
Session records: the date and time you signed in, your IP address and your browser/device description (user agent).
Failed sign-in attempts and account lock-outs, for security.
3.2 Business data entered by Customers and vendors
Depending on how a Customer uses the Service, this may include:
Vendor details:
business and legal name, contact names, email addresses, phone numbers and addresses;
tax identification numbers;
bank account details (account numbers, routing/IBAN/SWIFT codes).
Vendor documents, such as tax forms (W-8, W-9 or local equivalents), contracts and amendments, certificates, credit notes, statements and ledgers. Tax forms may contain government identification numbers.
Invoices, purchase orders, payments, credit notes, budgets and related attachments.
Employee records a Customer chooses to keep in the Service (name, email, title, department).
Approval decisions, comments and notes.
3.3 Activity and audit information
The Service keeps an audit trail of significant actions: who created, changed, approved, rejected, paid, exported or deleted what, and when. This trail is an accounting control and is designed to be append-only.
3.4 Technical information
Server logs: IP address, request time, page or API endpoint requested, response status and error messages. We use them to keep the Service running and secure.
We do not use advertising or third-party analytics trackers, and we do not sell personal information.
3.5 Cookies and local storage
We use only what the Service needs to work:
| Name | Purpose | Duration |
|---|---|---|
verity_sid | Keeps you signed in (session cookie, HTTP-only, secure) | Until sign-out or session expiry |
verity_csrf | Protects forms against cross-site request forgery | Session |
| Browser local storage (appearance) | Remembers your display preferences, e.g. light/dark theme | Until you clear it |
These are strictly necessary or preference items, and no marketing cookies are used.
4. How documents are read
When an invoice or document is uploaded, the Service can read its text with optical character recognition (OCR) to fill in fields automatically. This happens on our own servers, using open-source software (Tesseract). Documents are not sent to any generative-AI service or third-party OCR provider for this purpose.
5. Why we use information (and our legal bases)
| Purpose | Legal basis (where GDPR/UK GDPR applies) |
|---|---|
| Providing the Service to Customers and their users | Performance of our contract with the Customer; legitimate interests |
| Creating accounts, signing in, password resets | Performance of contract |
| Sending service emails: invitations, approval requests, payment notices, statement requests, vendor-portal links | Performance of contract; legitimate interests |
| Security: preventing fraud and unauthorised access, rate-limiting, audit trail | Legitimate interests; legal obligation |
| Keeping accounting records and audit trails | Legal obligation (the Customer's and ours); legitimate interests |
| Billing and subscription management | Performance of contract |
| Customer support | Performance of contract; legitimate interests |
| Complying with law and responding to lawful requests | Legal obligation |
We do not use personal information for automated decisions that have legal or similarly significant effects on individuals. Approval rules in the Service are configured and applied by Customers.
6. Who we share information with
We share personal information only as follows:
Within the Customer's organisation, according to the roles and permissions the Customer's administrators set. A vendor sees only its own records in the vendor portal.
Integrations a Customer chooses to connect. These are switched off until the Customer connects them:
Intuit QuickBooks Online, to import and sync vendors, bills and payments;
Google (Google Forms / Sheets), for supplier onboarding forms and exports.
Data sent to these services is governed by their own privacy policies.
Email delivery providers that send the Service's emails on our behalf: [Resend / SendGrid / Brevo / our SMTP provider — keep the ones you use].
Hosting provider: [Hosting provider name], which runs our servers in [country/region].
Professional advisers and authorities, where required by law, court order or to protect rights, safety and security.
A successor business, if Sirah is merged, acquired or sells its assets. You will be told of any change in how your information is handled.
We require our service providers to protect personal information and to use it only to provide services to us. We do not sell or rent personal information.
7. International transfers
Your information is stored in [country/region]. Where it is transferred to another country, we use appropriate safeguards where the law requires them, such as the European Commission's Standard Contractual Clauses.
8. How long we keep information
Customer business data is kept for as long as the Customer's account is active and as the Customer directs.
Deleted records first go to Trash. They can be restored there, and are then permanently removed after the retention period the Customer's administrator sets (1 to 3,650 days, or never).
Accounting records that have been approved, paid or synced, such as invoices, are voided rather than deleted, to keep the accounting history intact.
The audit trail is kept for the life of the Customer's account, or longer where the law requires accounting records to be kept.
Account and session records are kept while the account is active, and for up to [24 months] afterwards for security and legal purposes.
When a Customer's subscription ends, we delete or return Customer data within [90 days], unless the law requires us to keep it.
9. How we protect information
Encrypted connections (HTTPS/TLS) with strict transport security.
Bank account details and integration tokens are encrypted at rest (AES-256-GCM).
Passwords are hashed with scrypt. Sign-in attempts are rate-limited, and accounts lock after repeated failures.
Role-based permissions enforced on the server, with each Customer's data kept separate.
Security headers and a strict Content Security Policy.
An append-only audit trail of significant actions.
No system is perfectly secure. If a personal-data breach affects you, we will notify you and the relevant authorities as the law requires.
10. Your rights
Depending on where you live, you may have the right to:
access your personal information or get a copy of it;
correct it or delete it;
restrict or object to how it is used;
data portability;
withdraw consent where processing is based on consent;
complain to a data-protection authority.
These rights come from laws such as the EU/UK GDPR, India's Digital Personal Data Protection Act 2023, and US state laws such as the CCPA/CPRA.
How to use them:
If your data was entered by a business that uses Sirah (for example, you are its vendor or employee), please contact that business. We will help it respond.
Otherwise, email [privacy@sirah.co.in]. We will reply within the time the law allows, usually 30 days. We may need to verify your identity first.
We will not discriminate against you for exercising your rights.
California residents: we do not sell or share personal information for cross-context behavioural advertising. We do not use or disclose sensitive personal information for purposes other than providing the Service.
11. Children
The Service is for businesses. It is not directed at children under 18, and we do not knowingly collect their personal information.
12. Changes to this policy
We may update this policy from time to time. If the changes are significant, we will notify Customers' administrators by email or in the Service before they take effect. The "Last updated" date above shows when it last changed.
13. Contact us
[Legal entity name]
[Registered address]
Email: [privacy@sirah.co.in]
Grievance Officer (India): [Name, email, address]
EU/UK representative (if required): [Name, contact]