Ismeen Privacy Policy

Last updated: 18 October 2026

1. Who we are

Ismeen is a cloud accounting service run by SMBDM Technology L.L.C, Dubai Economy and Tourism licence 1652369, Office C-11, Al Khabaisi, Deira, Dubai, United Arab Emirates ("we", "us").

Contact for privacy questions: legal@ismeen.com. General support: support@ismeen.com.

2. What this policy covers

This policy explains what personal data we handle when you use Ismeen (web app, firm console, and any connection to QuickBooks Online or Xero), and your rights over it. It follows UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). Where another law applies to you (for example the EU GDPR), we respect the rights it gives you too.

3. Our role: controller or processor

• Your account data (your name, email, login and security settings, how you use the app): we decide why and how this is used, so we are the controller.
• Your books (ledgers, invoices, bills, customers, suppliers, bank lines, VAT figures, and any personal data inside them): the business that owns the books decides what goes in and why. That business is the controller; we are its processor and use the data only to provide Ismeen to it.
• Accounting firms. When a firm uses the firm console to keep a client's books, the client business is the controller of its books. The firm acts for the client (as processor or as a separate controller under its own engagement terms), and we are a processor (or sub-processor) to them. Each firm is responsible for having its client's authority to put that client's data into Ismeen.

4. What we collect

• Account data: name, work email, phone (optional), company, role, language (English/Arabic), password hash, two-factor setup.
• Books data you add or import: chart of accounts, journals, invoices, bills, payments, customer and supplier details (names, addresses, emails, phone numbers, tax registration numbers), bank account names and statement lines, VAT returns, attachments.
• Data from connected systems: if you connect QuickBooks Online or Xero, the accounting records you authorise (see section 6).
• Technical data: IP address, browser and device type, login times, security and audit logs.
• Support messages you send us.

We do not ask for special-category data (health, religion, biometrics). Please do not put it in notes or attachments.

5. Why we use it (and our legal basis)

We do not sell personal data. We do not use your books to train AI models.

6. Connections to QuickBooks Online and Xero (read-only)

• You can connect a QuickBooks Online company or a Xero organisation to Ismeen. You sign in with Intuit or Xero and approve the connection yourself; we never see your Intuit or Xero password.
• Ismeen only reads from these systems. It never creates, changes or deletes anything in QuickBooks Online or Xero. (Note: Intuit's accounting permission covers both reading and writing; Ismeen's code only makes read calls.)
• We read: company profile, chart of accounts, customers, suppliers, items, tax rates, transactions (invoices, bills, payments, journals, bank transactions) and standard reports (trial balance, ageing, VAT, bank reconciliation).
• We use that data only to move your books into Ismeen and to compare the two systems side by side.
• We store the connection tokens encrypted. You can disconnect at any time from Ismeen or from inside QuickBooks Online / Xero; we then delete the tokens and stop reading straight away.
• Data obtained through the Xero API is never used to train AI or machine-learning models (a Xero developer condition we follow for all sources).
• You can also give us exports (CSV/XLSX) taken by hand; these are treated the same way.

7. Where your data is kept

• Main location: Amazon Web Services, Frankfurt, Germany (eu-central-1).
• Backup copies: nightly backups, encrypted, copied to AWS Ireland (eu-west-1) for disaster recovery.
• Our website front door (content delivery and attack filtering) runs on AWS's global network, so pages may pass through servers near you; your books are not stored there.
• Sending data outside the UAE: we rely on the PDPL rules for cross-border transfer (countries with adequate protection and/or contract safeguards with AWS).

8. Who we share it with

Only these service providers, under contract, to run Ismeen:

Intuit and Xero are not our processors: they are the systems you choose to connect, under your own agreements with them.

We may also disclose data if a UAE court or authority lawfully requires it. We will tell the affected customer unless the law forbids it.

Inside a company, users see data according to the roles the company's admin gives them. An accounting firm sees only the clients that have given it access. One customer's data is never shown to another customer.

9. How we protect it

• Encryption in transit (TLS 1.2+) and at rest (AWS KMS keys).
• Two-factor sign-in for every user.
• Least-privilege access for our staff; access is logged.
• Each company's data is kept apart in the database by tenant controls.
• Nightly backups, tested restores.
• If a breach puts your personal data at risk, we notify the affected controller and the UAE Data Office as the PDPL requires, without undue delay.

10. How long we keep it

• While your subscription is active: as long as you keep it.
• After you close your account or ask for deletion: we delete or anonymise your books and account data within 30 days; backup copies roll off within a further 35 days.
• Exception: where UAE law requires a record to be kept (for example tax records, usually 5 years), the controller (your business) is responsible for keeping its own copy. We give you a full export before deletion.
• Security and audit logs: kept up to 12 months.

11. Your rights

Under the PDPL you can ask us to:

• tell you what personal data we hold and give you a copy (access and portability);
• correct it;
• delete it;
• restrict or stop certain processing, or object to it;
• not be subject to decisions made only by automated means that seriously affect you.

Email legal@ismeen.com. We reply within 30 days. If the data is in a business's books and we are only its processor, we pass your request to that business and help it answer.

You may also complain to the UAE Data Office.

12. Deletion on request

Any company admin can ask us to delete the company's data. Steps: (1) we confirm the request with the company admin; (2) we offer a full export; (3) we disconnect QuickBooks/Xero and delete tokens; (4) we delete the data and confirm in writing.

13. Cookies

We use only cookies needed to sign you in and keep the session secure. No advertising cookies.

14. Children

Ismeen is a business service, not meant for anyone under 18.

15. Changes

We will post changes here and, for important changes, email company admins at least 14 days before they apply.

16. Contact

SMBDM Technology L.L.C, Office C-11, Al Khabaisi, Deira, Dubai, UAE — legal@ismeen.com