Privacy Policy

Last updated: 19 June 2026

Bookless ("Bookless", "we", "us") provides accounting software for businesses. This Privacy Policy explains how we collect, use, disclose, and protect personal data when you use the Bookless accounting platform and website (the "Service"). Bookless operates from Singapore and handles personal data in line with the Singapore Personal Data Protection Act 2012 (PDPA) and, where they apply to you, other data-protection laws.

1. Who we are

Bookless is the data controller for personal data processed through the Service. If you have any question about this Policy or your personal data, contact us at edmund@basedapp.io.

2. The data we collect

  • Account data: name, email, business name, role, and login credentials.
  • Financial & accounting data you put into the Service: chart of accounts, invoices, bills, contacts, bank transactions, tax figures, payroll inputs, and similar records — including data you import from Xero or other systems.
  • Connection data: information from third-party services you connect (for example payment providers, bank feeds, or Xero) strictly to provide the features you enable.
  • Usage & device data: log data, IP address, browser/device information, and product analytics used to operate and improve the Service.
  • Communications: messages you send us (support, sales, feedback).

3. How we use it

We use personal data to: provide and operate the Service; import and process your accounting data; calculate figures and prepare reports and tax returns for your review; secure your account; provide support; send service communications and (with your consent where required) marketing messages; and comply with legal obligations. We process personal data on the bases permitted by applicable law, including performance of our contract with you, your consent, our legitimate interests in operating and improving the Service, and compliance with legal obligations.

4. How we share it

We do not sell your personal data. We share it only with:

  • Service providers / sub-processors who help us run the Service, under contractual confidentiality and security obligations. Our current hosting sub-processor is Vercel. We will keep this section updated as we add processors (for example payment processing, email delivery, and analytics).
  • Connected services you authorize (for example Xero migration or payment gateways) to deliver the features you turn on.
  • Legal / safety recipients where required by law or to protect rights, safety, and the integrity of the Service.
  • Business transfers in connection with a merger, acquisition, or asset sale, subject to this Policy.

5. International transfers

Your data may be processed outside Singapore. Where it is, we use the safeguards required by applicable law — including the PDPA Transfer Limitation Obligation — so that your data receives a comparable standard of protection.

6. Security

We use technical and organizational measures appropriate to the sensitivity of financial data, including access controls and permission enforcement. No system is perfectly secure; we work to protect your data and to notify you and the relevant regulator of data breaches where the law requires.

7. Retention

We keep personal data for as long as your account is active and as needed to provide the Service, and afterwards as required to meet legal, accounting, tax, and dispute-resolution obligations. Where Singapore law requires accounting and tax records to be retained (generally for at least five years), we keep the relevant records for that period.

8. Your rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal data, and may withdraw consent to certain processing. To exercise these rights, contact us at edmund@basedapp.io. You may also have the right to complain to your data-protection authority — in Singapore, the Personal Data Protection Commission (PDPC).

9. Cookies & analytics

We use cookies and similar technologies to operate the site, remember your preferences, and understand usage so we can improve the Service. You can control non-essential cookies through your browser settings. Where consent is required for analytics or marketing cookies in your jurisdiction, we will ask for it.

10. Children

The Service is for businesses and is not directed to children. We do not knowingly collect personal data from children.

11. Changes

We may update this Policy and will post the new version here with an updated date. We will communicate material changes as required by law.

12. Contact

Questions or requests about this Policy or your personal data: edmund@basedapp.io.