This Privacy Policy explains how Midnight Labs ("we", "us"), United Arab Emirates, handles personal data in connection with Midnight Ledger (the "Service"). We handle personal data in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where it applies to you, other data-protection laws such as the GDPR.
1. Our role
For account and usage data, we act as a data controller. For the financial records, contacts, employee details and documents you enter into your company's books, you (or your company) act as the controller and we act as your processor, handling that data on your instructions to provide the Service.
2. Data we collect
- Account data: name, email, hashed password, company membership and role, notification preferences.
- Financial data: invoices, expenses, bank transactions, journal entries, VAT and tax figures, and the company details needed for compliant tax invoices (legal name, TRN, address, licence details).
- Contacts: names and details of your customers and suppliers.
- Payroll data: employee names, salaries, bank and identification details needed for WPS files and payslips.
- Documents: receipt images, bank statement files and the invoice PDFs we generate.
- Technical data: session, security and error information needed to run the Service.
3. How we use data
- to keep your books, produce reports and generate documents such as invoices and payslips;
- to send deadline reminders, invitations and account emails;
- to secure, maintain and improve the Service;
- to comply with legal obligations.
4. AI receipt processing
When you ask the Service to read a receipt, the image and a short prompt are sent to Anthropic's API and the extracted fields are returned to you as a suggestion. Under Anthropic's commercial terms, API inputs and outputs are not used to train their models. We store the extracted result alongside the expense so you can review it. Receipt processing happens only when you trigger it.
5. Legal bases
We rely on: performance of a contract (to provide the Service); legitimate interests (to secure and improve the Service); consent (where required, for example for optional reminder emails); and legal obligation.
6. Sharing and sub-processors
We share data with service providers who help us run the Service: hosting and storage, email delivery, error monitoring, Google Analytics on our public website only (it never sees Service data), and Anthropic for AI receipt processing. We require sub-processors to protect personal data and to act only on our instructions. We do not sell personal data and we do not share your books with any tax authority; filings are made by you.
7. International transfers
Our infrastructure and some sub-processors are located outside the UAE. Where personal data is transferred across borders we put appropriate safeguards in place, such as contractual data-protection terms.
8. Retention
UAE tax law requires businesses to keep accounting records for at least seven years. Because of that, the Service prevents posted invoices, expenses and journal entries from being deleted individually. Your data is retained while your company exists in the Service. When you delete a company, or delete your account, the associated data is removed from our live systems promptly and from backups within a reasonable period. Export your records first if you need to keep them.
9. Your rights
You may have rights to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. You can update your name and email, and delete your account, from your Profile. Company owners can export every table as CSV from the Exports page and delete the company from Settings. Where we process data on behalf of a company, please direct requests about that content to the company; we will assist them as their processor. For anything else, contact [email protected].
10. Security
We use technical and organisational measures to protect personal data, including encryption in transit, hashed passwords, per-company data isolation, access controls and private storage for uploaded documents. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
11. Cookies and analytics
In the Service we use strictly necessary cookies to keep you signed in and to protect against cross-site request forgery. We do not use advertising cookies, and no analytics or advertising script runs inside the Service, so your books, invoices and customer records are never exposed to one.
On our public website at midnightledger.ae we use Google Analytics to see which pages people read and which sources bring them to us. It sets cookies and sends your IP address, the pages you view and basic device information to Google, who process that data on our behalf. For visitors in the EEA, the UK and Switzerland it runs in cookieless mode and sets no cookies. On desktop browsers you can opt out of Google Analytics everywhere with Google's opt-out browser add-on, and on any device you can block or clear cookies in your browser settings.
12. Children
The Service is not directed to children and is intended for use by adults running a business.
13. Changes
We may update this Policy and will provide notice of material changes.
14. Contact
For privacy questions or to exercise your rights, contact [email protected].