AquaLedger Privacy Policy

Depending on how AquaLedger is used, the application may hold:

• Account information — name, email address, phone number, and role assignments for users who log in.
• Business and company records you or your organization enter — customer/company details, fish master data, boats, trips and catches, invoices, payments, purchase bills, and expenses.
• Documents you upload — files such as receipts or contracts that you attach to a business record.
• Audit information — a record of who performed which action on which record and when, kept for accountability of business and financial records.
• Technical and log information — data such as login timestamps, IP address, and browser/user-agent information associated with requests to the application.

• To provide and operate the AquaLedger service.
• To authenticate users and enforce role-based access permissions.
• To maintain business and financial records you create in the system.
• To generate reports you request.
• For security monitoring and audit purposes.
• For backups and disaster recovery, so business records are not lost.
• To operate, maintain, and troubleshoot the service.

Business data you enter into AquaLedger — companies, invoices, payments, trips, and related records — is stored in a database operated as part of the AquaLedgerapplication infrastructure. Documents you upload are stored in file storage that is part of the same infrastructure. We do not sell or share this data with third parties for advertising or marketing purposes.

Database backups are created on a regular schedule and stored in secured, access- controlled off-site storage, separate from the primary application server, so business records can be recovered in the event of a failure. One backup copy is encrypted before it leaves our infrastructure. As part of this process, backups may be stored using a third-party cloud storage provider (Google Drive). We do not disclose encryption keys, credentials, or other infrastructure configuration in this policy or elsewhere publicly.

The following protections are in place today:

• The application is served over an encrypted HTTPS connection.
• User passwords are never stored in plain text — they are hashed using Argon2id.
• Authentication uses short-lived session tokens with a separate, revocable refresh mechanism.
• Access to business data is governed by role-based access control (RBAC).
• Off-site database backups include an encrypted copy, and backup files are kept under restricted, access-controlled storage.

We do not claim certification against any specific security or compliance standard (for example, ISO 27001, SOC 2, or GDPR) unless a certificate or attestation is published separately.

Issued invoices and ledger entries are part of the permanent business/financial record and are not deleted; corrections are made through credit notes or reversing entries rather than by altering history. We have not defined a fixed general retention period for account or business data beyond what is needed to operate the service. Off-site backups are retained on a rolling schedule (currently the most recent several weekly backups at each backup location) and older backups are removed as newer ones are confirmed successful.

If you have questions about your data, or would like to request access to or correction of information held about you, contact us at chandansolanki618@gmail.com.

We use a third-party cloud storage provider (Google Drive) solely to store encrypted and access-controlled off-site database backups for disaster recovery. This service is not used to collect or process end-user data submitted through the application itself, and no application credentials or OAuth tokens are disclosed publicly.

We may update this policy as the application or our practices change. The “Last updated” date above reflects the most recent revision.

For any privacy-related questions about AquaLedger, contact chandansolanki618@gmail.com.