Privacy Policy
How Sentribooks collects, uses, shares and protects personal information, and the choices and rights you have.
Privacy at a glance
- Your business data belongs to you. We process the records you enter (invoices, stock, customers, payroll) only to run Sentribooks for you.
- We do not sell personal information, and we do not use your business data for advertising or to train AI models.
- We use a small set of trusted providers (such as Google, Supabase, Stripe and Amazon Web Services) to host, secure and operate the service. They are listed in section 8.
- We protect accounts with sign-in monitoring, device recognition, security alerts and role-based access.
- You have choices and rights, including access, correction, export and deletion. See section 14, or email info@sentribooks.com.
1. Who we are and what this policy covers
Sentribooks is cloud business software for wholesale, trading and distribution companies. It covers inventory, purchasing, sales, invoicing, delivery, bank reconciliation, accounting, VAT reporting and payroll. In this policy, "Sentribooks", "we", "us" and "our" mean the company that operates Sentribooks.
This policy applies to personal information we handle when you:
- visit sentribooks.com and its pages, including our blog, docs and videos (the "Website");
- sign up for, sign in to or use the Sentribooks application (the "Service");
- contact us, ask for support, or otherwise interact with us; and
- watch or interact with Sentribooks content we publish, such as on our YouTube channel.
"Personal information" means any information that identifies, or could reasonably identify, a person. It does not include information that has been anonymized or aggregated so that it no longer identifies anyone.
If you use Sentribooks on behalf of a company, your company's agreement with us also applies. If that agreement conflicts with this policy about the business data your company enters, the agreement takes precedence.
2. Our role: controller and processor
Data protection laws distinguish between a "controller", who decides why and how personal information is used, and a "processor", who handles it on someone else's instructions.
- We are the controller for information about our account holders, Website visitors, people who contact us, and sign-in and security records.
- We are a processor (service provider) for the business data our customers enter into the Service, such as the details of their own customers, suppliers, employees and contacts. Our customer, the company using Sentribooks, is the controller of that data and decides what goes in and how it is used. We process it only to provide the Service, under our customer's instructions and our agreement with them. See section 16.
3. Information we collect
3.1 Information you give us
| Category | Examples |
|---|---|
| Account and sign-in details | Name, email address, password (held by our sign-in provider in protected form, never in plain text), the account you belong to, your role and permissions. |
| Company profile | Company name, legal and trading details, address, phone, tax registration numbers (such as a VAT/TRN number), logo, currency, invoice terms, numbering and document preferences. |
| Team members | Names and email addresses of colleagues you invite, and the roles you give them. |
| Subscription and billing | Plan, billing contact, billing address, and payment status. Card details are collected and stored by Stripe, not by us; we receive limited details such as card brand, last four digits and expiry date. |
| Support and correspondence | Messages, emails, screenshots and files you send us, and any details you give when you ask for help or a demo. |
| Preferences | Display, notification, dashboard and security alert settings. |
3.2 Business data you enter into the Service
The Service stores the records you and your team create or import, which may include personal information about other people:
- Customers and suppliers: names, contact people, email addresses, phone numbers, addresses (including address suggestions, see section 8), tax numbers, credit terms and balances.
- Transactions: quotes, sales orders, invoices, delivery notes, purchase orders, bills, expenses, credit notes, payments, cheques and inquiries.
- Inventory: products, stock levels, warehouses and stock movements.
- Banking: bank account names and numbers you add, and bank statements you import (for example MT940 or spreadsheet files), including transaction descriptions and counterparties.
- Payroll and service providers: employee or provider names, pay details, salaries, allocations and payslips.
- Documents and files: letters, attachments, logos and other files you upload.
- Accounting and tax: journals, chart of accounts, VAT returns and reports.
You decide what to enter. Please only enter personal information you are allowed to share with us, and avoid entering sensitive information (such as health data) that the Service does not need.
3.3 Information collected automatically
| Category | Examples |
|---|---|
| Sign-in and security activity | Sign-in times, IP address, approximate location worked out from the IP address (city, region, country), browser, operating system and device type, a device identifier stored in a cookie, active sessions, failed sign-in attempts and security events. |
| Audit records | Which user created or changed records and when, to keep an accurate history of your books. |
| Usage and technical data | Pages and features used, actions taken, errors, performance data, and server logs (including IP address, date and time, page requested and browser type). |
| Website analytics | On the Website and sign-up pages, Google Analytics collects pages viewed, time on page, how you arrived (such as from a search engine or link), device and browser, and approximate location. |
| Cookies | See section 7. |
3.4 Information from other sources
- Payment provider: Stripe tells us whether payments succeeded, failed or were refunded, and about subscription changes.
- Location lookup services: approximate location derived from IP addresses, for sign-in security.
- Your colleagues: an account owner or administrator may add you to their company's account, giving us your name, email address and role.
- Public sources: publicly available business information, such as a company's website, when you ask us about our services.
4. How we use information
We use personal information to:
- Provide the Service: create and run your account, store and process your business data, generate documents and reports, send the documents you choose to email, and run the features you use.
- Keep accounts and the Service secure: verify sign-ins, recognize devices, detect unusual or suspicious activity, send security alerts, let you review and sign out of sessions, prevent fraud and abuse, and investigate incidents.
- Manage subscriptions and billing: process payments, apply plan limits, and handle refunds, failed payments and invoices for our fees.
- Communicate with you: send service, security, billing and policy messages, reply to questions, and provide support.
- Improve Sentribooks: understand how the Website and Service are used, fix bugs, measure performance, and design new features. Where possible we use aggregated or de-identified information for this.
- Publish helpful content: produce and share guides, articles and videos, and understand which content is useful.
- Meet legal obligations: keep records required by tax, accounting and other laws, respond to lawful requests, and enforce our terms.
- Protect rights and safety: protect Sentribooks, our customers and others, and establish, exercise or defend legal claims.
We do not:
- sell personal information, or share it for cross-context behavioral advertising;
- use the business data you enter for advertising, or look at it except as needed to provide, support or secure the Service, or as required by law;
- use your business data to train generalized artificial intelligence models.
If we want to use personal information for a purpose that is not compatible with those above, we will tell you first and, where required, ask for your consent.
5. Legal bases for processing
Where the law requires a legal basis (for example under the UAE Personal Data Protection Law, the Saudi Personal Data Protection Law, or the EU and UK General Data Protection Regulation), we rely on the following:
| Purpose | Legal basis |
|---|---|
| Providing the Service, managing your account and subscription | Performance of a contract with you or your company |
| Account security, fraud prevention, sign-in monitoring | Legitimate interests in keeping accounts and the Service secure; legal obligations to protect data |
| Service, security and billing communications | Performance of a contract; legitimate interests |
| Website analytics and non-essential cookies | Consent, where required by law; otherwise legitimate interests in understanding and improving our Website |
| Product improvement | Legitimate interests in improving Sentribooks |
| Marketing emails (if we send them) | Consent, or legitimate interests where the law allows, always with an easy way to opt out |
| Keeping tax, accounting and business records; responding to authorities | Legal obligation |
| Legal claims and protecting rights | Legitimate interests; legal obligation |
Where we rely on legitimate interests, we balance them against your rights and interests. Where we rely on consent, you can withdraw it at any time; this does not affect processing that already happened.
6. Automated decisions
Sentribooks uses automated checks for security, such as flagging a sign-in from a new device or unusual location and asking you to confirm it, or temporarily blocking repeated failed attempts. These checks protect your account. They do not make decisions that have legal or similarly significant effects on you, and you can always contact us to review a security decision.
7. Cookies and similar technologies
Cookies are small text files stored by your browser. We use the following:
| Cookie or technology | Type | Purpose | Duration |
|---|---|---|---|
session | Strictly necessary | Keeps you signed in and protects forms against forgery. | Until you sign out or the session expires |
sb_device | Strictly necessary (security) | Recognizes a browser you have used before, so we can alert you about sign-ins from new devices and let you manage sessions. | Up to 2 years |
Google Analytics (_ga, _ga_*) | Analytics | Measures Website and sign-up page visits and how people use them. | Up to 2 years |
| Browser storage | Functional | Remembers interface choices such as table layouts and filters on your device. | Until cleared |
| YouTube embeds | Third party | When you play an embedded video, YouTube may set cookies. We use privacy-enhanced embeds where available. | Set by YouTube |
Your choices: you can block or delete cookies in your browser settings. Strictly necessary cookies are needed for the Service to work. You can opt out of Google Analytics with Google's opt-out browser add-on, or by blocking analytics cookies in your browser.
We do not currently respond to "Do Not Track" browser signals, as there is no common standard for them. Because we do not sell personal information or share it for cross-context behavioral advertising, there is nothing to opt out of in that sense.
8. How we share information
We share personal information only as described here.
8.1 Service providers
We use carefully selected providers to host, operate and secure Sentribooks. They may only use personal information to provide their services to us, under contracts that require them to protect it.
| Provider | Purpose | Information involved |
|---|---|---|
| Google (Firebase Authentication and Cloud Firestore) | Sign-in, account and settings storage | Account details, sign-in and session records, settings |
| Supabase | Database and file storage for business records | Business data and uploaded files |
| Stripe | Subscription payments and billing | Billing contact, payment details, subscription status |
| Amazon Web Services (Amazon SES) | Sending emails | Email addresses, email content (such as documents you choose to send, invitations, password resets and security alerts) |
| Cloud hosting provider | Running the application servers | All information processed by the Service |
| Google Analytics | Website analytics | Usage and device data, cookie identifiers, approximate location |
| Google Maps Platform (Places) | Address suggestions when entering customer, supplier and inquiry addresses | The address text you type; your IP address |
| Google Charts | Drawing charts on dashboards and reports | Your IP address and browser details when the chart library loads |
| IP location services (such as ipapi.co and ipwho.is) | Approximate sign-in location for security alerts | IP address |
| Content delivery networks (such as jsDelivr and jQuery CDN) | Delivering website code and libraries quickly | Your IP address and browser details |
| Google (YouTube) | Hosting and embedding our videos | Viewing data collected by YouTube when you play a video |
We may change providers over time. We will keep this list current and, where our agreement with a customer requires it, tell that customer before adding a provider that processes their business data.
8.2 Within your company account
Information you enter is visible to other users of the same company account, according to the roles and permissions your administrator sets. Account owners and administrators can see team members' activity and sign-in sessions for security purposes.
8.3 People you choose to share with
When you email an invoice, statement or other document from Sentribooks, or share a link, we send it to the recipients you choose.
8.4 Legal reasons
We may disclose information if we believe in good faith that it is required by law, regulation, court order or a lawful request from a government or tax authority; or that it is needed to protect the rights, property or safety of Sentribooks, our customers or others, or to detect and prevent fraud or security issues. Where allowed, we will tell the affected customer about requests for their business data.
8.5 Business transfers
If Sentribooks is involved in a merger, acquisition, financing, reorganization or sale of assets, personal information may be transferred as part of that transaction. We will require the recipient to honor this policy and will tell you of any change in control of your information.
8.6 With your consent
We may share information for other purposes with your consent or at your direction.
8.7 Aggregated information
We may share aggregated or de-identified information that cannot reasonably be used to identify you or your company, for example overall usage statistics.
9. Emails and communications
- Service emails: we send messages needed to run your account, such as invitations, password resets, security alerts, sign-in confirmations, billing notices and important changes. You cannot opt out of these while you have an account, but you can adjust some security alert settings in the app.
- Documents you send: emails you send to your own customers or suppliers through Sentribooks are sent on your behalf and show your company's details. Replies go to the address you set.
- Marketing: if we send newsletters or product news, we will do so only as the law allows, and every marketing email will include an unsubscribe link.
10. YouTube API Services and our videos
Sentribooks publishes tutorials and product videos on YouTube and embeds them on our Website.
- We use YouTube API Services through an internal tool to upload and manage videos on Sentribooks' own YouTube channel. The tool is used only by the Sentribooks team.
- The tool does not access, collect, store or share data from other YouTube users or their channels, and it is not offered to our customers.
- The only YouTube data the tool handles is information about our own uploads, such as video IDs, titles, descriptions, captions and links, which we use to publish our content and embed it on our Website.
- The sign-in token that authorizes the tool is stored privately and securely by our team, and access can be revoked at any time through Google's security settings.
When you watch a video on YouTube or in an embedded player on our Website, YouTube (Google) may collect information about you as described in the Google Privacy Policy. Your use of YouTube is subject to the YouTube Terms of Service.
11. International data transfers
Sentribooks and our service providers operate in several countries. Your information may be stored and processed in countries other than the one you live in, including countries whose data protection laws differ from yours.
When we transfer personal information across borders, we take steps required by applicable law to protect it. Depending on where the data comes from, these may include transferring only to countries recognized as providing adequate protection, using standard contractual clauses or similar contracts approved by the relevant authority, relying on our providers' certifications and security commitments, or other lawful transfer mechanisms. You can contact us for more information about the safeguards we use.
12. How long we keep information
We keep personal information only as long as needed for the purposes in this policy, unless the law requires or allows us to keep it longer.
| Information | How long |
|---|---|
| Account and company profile | While the account is active, then deleted or anonymized after closure, except as below. |
| Business data in the Service | While the account is active. Customers can export their data before closing an account. After closure, we delete it within a reasonable period unless the customer asks us to keep it longer or the law requires otherwise. |
| Our own billing and tax records | As long as tax and accounting laws require. For example, UAE tax law generally requires records to be kept for at least five years. |
| Sign-in sessions and security records | As long as needed to protect accounts and investigate incidents, then deleted or anonymized. |
| Support correspondence | As long as needed to resolve your request and keep a record of it. |
| Website analytics | According to our Google Analytics data retention setting, which keeps detailed data for no more than 14 months. |
| Backups | Deleted data may remain in backups for a limited time until they are overwritten. |
Remember that as a business, you may have your own legal duty to keep accounting and tax records. Please export what you need before closing your account.
13. How we protect information
We use administrative, technical and physical safeguards suited to the sensitivity of the information we handle, including:
- encryption of data in transit (HTTPS/TLS), and encryption at rest provided by our hosting and database providers;
- passwords managed by a dedicated sign-in provider and never stored in plain text by us;
- role-based access controls, so each user sees only what their role allows;
- sign-in monitoring, device recognition, new-device and unusual-sign-in alerts, the ability to review and revoke sessions, and protection against repeated failed attempts;
- audit trails of who created and changed records;
- separation of each company's data, and limits on staff access to customer data to what is needed for support, security or legal reasons;
- reputable infrastructure providers with strong security programs.
No method of transmission or storage is completely secure. You help protect your account by using a strong, unique password, keeping sign-in details private, removing users who no longer need access, and telling us right away at info@sentribooks.com if you suspect unauthorized access.
14. Your choices and rights
14.1 Choices in the app
- View and update your account, company profile and preferences in Settings.
- Review active sign-in sessions and sign out of other devices.
- Manage security alert settings.
- Add, change or remove team members (administrators).
- Export business records and reports.
- Delete your user account, if you are not the primary account holder. Primary account holders can ask us to close the company account.
14.2 Your privacy rights
Depending on where you live, you may have some or all of these rights over your personal information:
- Access: to know whether we process your information and to get a copy of it.
- Correction: to have inaccurate or incomplete information corrected.
- Deletion: to have your information deleted, subject to legal exceptions.
- Portability: to receive your information in a structured, commonly used format, or have it sent to another provider.
- Restriction: to ask us to limit how we use your information.
- Objection: to object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent: where processing is based on consent.
- Automated decisions: not to be subject to decisions based solely on automated processing that significantly affect you.
- Complaint: to complain to your data protection authority.
14.3 How to use your rights
Email info@sentribooks.com with the subject "Privacy request", from the email address on your account where possible. We may need to verify your identity before acting, and may ask for more information to do so. You can use an authorized agent where the law allows; we may ask for proof of their authority.
We will respond within the time the law requires, usually within 30 days. If we need more time, or cannot fully meet your request (for example because we must keep records by law), we will explain why. We do not charge for requests unless they are clearly unfounded or excessive, and we will not treat you differently for using your rights.
If your request is about business data a company entered into Sentribooks (for example, you are one of their customers or employees), we will refer you to that company, as it controls that data, and help it respond.
15. Additional information for specific regions
United Arab Emirates
We handle personal information in line with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and related regulations, as they apply. UAE residents have the rights described in section 14, including access, correction, deletion, restriction, objection, portability, and the right to complain to the UAE Data Office. Where personal information is transferred outside the UAE, we do so as the PDPL permits. Users in free zones with their own data protection laws, such as the DIFC or ADGM, have the rights given by those laws.
Saudi Arabia and other GCC countries
Where the Saudi Personal Data Protection Law or another GCC data protection law applies, we handle personal information in line with it, including its rules on legal bases, data subject rights and cross-border transfers. Residents may use the rights in section 14 and complain to their national authority, such as the Saudi Data & AI Authority (SDAIA).
European Economic Area, United Kingdom and Switzerland
Where the GDPR, UK GDPR or Swiss data protection law applies, we rely on the legal bases in section 5 and protect transfers as described in section 11. You have the rights in section 14 and can complain to your local supervisory authority, for example the Information Commissioner's Office in the UK.
United States (including California)
Some US state laws, such as the California Consumer Privacy Act, give residents rights to know, access, correct and delete personal information, and to opt out of its sale, sharing for cross-context behavioral advertising, or use for targeted advertising. In the past 12 months we have collected the categories of personal information described in section 3 (identifiers, commercial information, internet activity, approximate geolocation and professional information) from the sources in section 3, for the purposes in section 4, and disclosed them to the service providers in section 8 for business purposes. We do not sell personal information or share it for cross-context behavioral advertising, and we do not knowingly sell or share the personal information of anyone under 16. We do not use sensitive personal information to infer characteristics about people.
India and other countries
Where other data protection laws apply, such as India's Digital Personal Data Protection Act, we follow their requirements and you can use the rights they give you by contacting us.
16. Information about your customers, suppliers and employees
If you are a customer, supplier, employee or contact of a company that uses Sentribooks, that company entered your information into the Service and controls it. The company's own privacy notice explains how it uses your information. We process it only on the company's behalf, to provide the Service.
Companies using Sentribooks are responsible for having a lawful basis to enter that information, giving any notices required, and answering requests from the people concerned. We help our customers meet these obligations where needed. If you contact us about such information, we will pass your request to the relevant company where we can identify it.
17. Children
Sentribooks is a business service for adults. It is not intended for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.
18. Third-party websites and services
Our Website and Service may link to, or let you connect with, websites and services run by others, such as YouTube, Google Maps, payment pages and bank files you import. Those third parties have their own privacy practices, and this policy does not cover them. Please read their privacy notices.
19. Security incidents
If a security incident affects personal information we are responsible for, we will investigate, take steps to limit harm, and notify affected customers, individuals and authorities as the law requires and without undue delay.
20. Changes to this policy
We may update this policy as Sentribooks, the law or our practices change. When we do, we will change the effective date at the top. For significant changes, we will give account holders notice by email or in the app before the changes take effect, and ask for consent where the law requires it. Please review this policy from time to time.
21. Contact us
For questions, requests or complaints about this policy or your personal information, contact us:
- Email: info@sentribooks.com (subject "Privacy request")
- Website: www.sentribooks.com
We will try to resolve any concern you raise. If you are not satisfied with our response, you can contact the data protection authority where you live or work.