Privacy Policy

Quincom Ecommerce - FZCO
Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, Vereinigte Arabische Emirate
Email: hello@emirabooks.com
Represented by: Quincom Ecommerce - FZCO

• Account & contact data: name, email address, phone number, login information.
• Company & accounting data: company details, invoices, receipts, bank statements, transactions, tax figures.
• ID & identity data: Emirates ID, passport, visa/residency data and, where applicable, data of dependants — to the extent you upload or enter it for compliance purposes.
• Payment data: subscription and payment information (processed via our payment service provider).
• Usage & access data: technical logs, device/browser data; tracking data only after consent.

• Providing the software (bookkeeping, invoices, compliance): Art. 6(1)(b) GDPR (performance of contract).
• Processing ID/visa data & AI extraction of documents: Art. 6(1)(b) GDPR as well as your consent (Art. 6(1)(a)) for particularly sensitive uploads.
• Billing & payments: Art. 6(1)(b) and (c) GDPR.
• Security, operation & improvement: Art. 6(1)(f) GDPR (legitimate interest).
• Reach measurement, usage analysis & marketing (Meta Pixel, Microsoft Clarity): only on the basis of your consent (Art. 6(1)(a) GDPR), revocable at any time. Microsoft Clarity may record sessions (mouse movements, clicks, scrolling) to visualise site usage.

The application is provided via Vercel (Hosting der Web-App); database, authentication and file storage run via Supabase (Datenbank, Authentifizierung, Datei-Speicher). Storage region: Indien (Mumbai, AWS ap-south-1). Data processing agreements (Art. 28 GDPR) are in place with our providers.

We use carefully selected service providers as processors:

• Supabase — Datenbank, Authentifizierung & Datei-Speicher (Belege, Ausweise)
  Region: Indien (Mumbai)
• Vercel Inc. — Hosting & Auslieferung der Web-App, Serverless-Funktionen
  Region: USA / global (Edge)
• Stripe Payments Europe, Ltd. — Abo- & Zahlungsabwicklung
  Region: EU / USA
• Resend — Versand von E-Mails (Login-Links, Rechnungen, Benachrichtigungen)
  Region: USA
• OpenAI — KI-Auslesung hochgeladener Dokumente/Belege (inkl. Ausweis-/Visadaten) zur automatischen Erfassung
  Region: USA
• Meta Platforms Ireland Ltd. (Meta Pixel) — Reichweitenmessung von Werbung — nur nach Einwilligung
  Region: EU / USA
• Microsoft Ireland Operations Ltd. (Microsoft Clarity) — Analyse der Seitennutzung, Heatmaps & Sitzungsaufzeichnung — nur nach Einwilligung
  Region: EU / USA

Our database and file storage (including uploaded receipts and, where applicable, ID/visa data) are hosted with Supabase (Datenbank, Authentifizierung, Datei-Speicher) in the region Indien (Mumbai, AWS ap-south-1). Under data protection law, India is considered a third country without an adequacy decision by the EU Commission. Processing therefore takes place on the basis of EU standard contractual clauses (Art. 46(2)(c) GDPR) and additional safeguards (including encryption).

Other service providers (including Vercel, Resend, OpenAI, Meta) in part process data outside the EU/EEA, in particular in the USA. This transfer likewise takes place on the basis of EU standard contractual clauses (Art. 46 GDPR) or — where applicable — the EU-US Data Privacy Framework. In particular, uploaded documents (possibly including ID/visa data) are transmitted to OpenAI (USA) for automatic extraction. You can opt out of the AI extraction and enter data manually.

Accounting and tax-relevant data is stored for the duration of the statutory retention periods (in the UAE typically up to several years). Data beyond that is deleted or anonymised as soon as the purpose no longer applies and no retention obligation remains.

You have the following rights:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdrawal of consent given (Art. 7(3) GDPR)

To exercise these, an email to hello@emirabooks.com is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority.

We use technically necessary cookies (e.g. login session, language setting) to provide the service. Analytics and marketing technologies such as the Meta Pixel and Microsoft Clarity (usage analysis, heatmaps and session recording) are only loaded after your explicit consent via our consent banner. You can change your choice at any time via Cookie settings in the website footer or in our cookie policy.

To ease data entry we use AI-assisted extraction of uploaded documents and receipts. No automated decision with legal effect within the meaning of Art. 22 GDPR takes place; you can review and correct all results.

If you are located in the United Arab Emirates, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) may apply in addition to this policy. We process personal data lawfully, fairly and transparently for the purposes described above. You may request access, correction, erasure or restriction of your data and object to certain processing by contacting hello@emirabooks.com. Cross-border transfers (e.g. to India, the USA or the EU) take place only with appropriate safeguards such as contractual clauses and encryption. Complaints may be submitted to the UAE Data Office.