Privacy Policy

1. Data Controller

The Data Controller within the meaning of the UAE PDPL and other applicable data protection legislation is:

2. Scope of This Policy

This Privacy Policy describes what personal information we collect and why, how we obtain and use it, and the legal grounds for processing. It explains how long we retain your data, with whom we may share it, and the measures we take to protect it. It also covers cross-border transfers — including to Switzerland, where our servers are hosted — your rights as a data subject, and our use of cookies and similar technologies.

Section 15 explains how we handle personal data inside CoreLedger Go (the web application at go.coreledger.org and the CoreLedger Go mobile app): the Go account, KYC information and the accounting documents and records uploaded to it.

3. Personal Information We Collect

We may collect the following categories of personal information:

3.1 Information You Provide Directly

• Name (first name, last name);
• Email address;
• Telegram username / handle;
• Any other information you voluntarily submit via our website forms.

3.2 Information Collected Automatically

• IP address and approximate geographic location;
• Browser type, version, and operating system;
• Pages visited, time spent, referral sources, and clickstream data;
• Cookie identifiers and session data (see Section 8 on Cookies);
• Device identifiers.

3.3 Information Collected in the Course of Business

• Communications and correspondence with us;
• Information provided when onboarding as a client or partner;
• Financial and transactional data necessary to provide our services;
• Professional background information relevant to our engagement;
• Any other information you provide in the course of your relationship with us.

4. How We Obtain Your Personal Information

We collect your personal information through website contact and subscription forms, the WPS Generator and similar interactive tools, and direct communication with us by email, phone, or other channels. We also collect data automatically via cookies and analytics tools when you visit our website, from third-party sources such as public registries or partners where lawful, and in the course of providing our services — including during client onboarding and ongoing engagement.

5. How We Use Your Personal Information

We use the personal information we collect for the following purposes:

• To respond to your enquiries and requests submitted via our website forms;
• To provide you with access to tools and features on the website (e.g., WPS Generator);
• To send you communications you have requested, including newsletters and updates;
• To provide, manage, and improve our services;
• To administer and manage our relationship with you as a client, partner, or prospect;
• To monitor and improve the performance, security, and user experience of our website;
• To fulfil our legal, regulatory, and contractual obligations;
• To defend or establish legal claims;
• For internal analytics and business development purposes.

6. Legal Grounds for Processing

We process your personal information on one or more of the following legal bases under the UAE PDPL:

• Consent — where you have given us your explicit consent (e.g., by submitting a form on our website);
• Contractual necessity — where processing is required to enter into or perform a contract with you;
• Legal obligation — where we are required to process your data to comply with applicable law or regulation;
• Legitimate interests — where we have a legitimate business interest that is not overridden by your rights and interests, such as improving our services, fraud prevention, and direct marketing;
• Vital interests — in rare circumstances, where necessary to protect the vital interests of an individual.

7. Retention of Personal Information

We retain personal information for as long as is necessary to fulfil the purposes for which it was collected, including satisfying any legal, regulatory, accounting, or reporting requirements. Retention periods are determined by the nature of the data, the purpose of processing, and applicable statutory limitation periods.

Where you ask us to delete your data, we will do so unless we are required or permitted by law to retain it — for example, to comply with a legal obligation, resolve a dispute, or enforce our agreements.

8. Cookies and Similar Technologies

Our website www.coreledger.org uses cookies and similar tracking technologies. Cookies are small text files stored on your device that help us operate our website, understand usage patterns, and deliver a personalised experience.

8.1 Types of Cookies We Use

• Necessary Cookies — essential for the website to function. They cannot be switched off and are set in response to your actions, such as setting your privacy preferences or completing forms.
• Marketing Attribution Cookies — first-party cookies that record the marketing source from which you arrived (e.g., the advertising campaign, channel, or referring search). They allow us to attribute leads submitted via our website to the correct source so we can evaluate marketing effectiveness. They do not track you across other websites.
• Analytics Cookies — allow us to count visits and understand how visitors use our website via Google Analytics (Google LLC) and Yandex Metrica (Yandex LLC). Information collected is aggregated and partially anonymised (we enable IP anonymisation in Google Analytics).
• Advertising Cookies — set by Google when you arrive via a Google Ads click (the GCLID identifier and related Conversion Linker cookies). They allow us to measure the effectiveness of our Google Ads campaigns and avoid showing repeated ads to people who already interacted with us.

8.2 Cookie Table

The following cookies are currently in use on this website:

Necessary

Cookie	Duration	Purpose
cl_cc_consent	1 year	Stores user cookie consent preferences (the action chosen in our cookie banner).
cl_lang_seen	1 year	Marks that a language-detection check has already run for your browser, so we do not redirect you to the localised site (EN ↔ RU) more than once.
PHPSESSID	Session	PHP server session identifier.

Marketing Attribution

Cookie	Duration	Purpose
cl_first_touch	180 days	Records the first marketing source that brought you to the site (UTM parameters, landing page, timestamp). Sent with your form submission so we can attribute leads correctly.
cl_last_touch	180 days	Records the most recent marketing source for ongoing attribution.
cl_gclid	180 days	Stores the Google Ads click identifier (GCLID) so that conversions can be linked back to specific Google Ads clicks.

Analytics

Cookie	Duration	Purpose
_ga	2 years	Google Analytics — distinguishes users, tracks sessions and campaigns.
_ga_*	2 years	Google Analytics — persists session state for the GA4 property.
_gid	24 hours	Google Analytics — distinguishes users on a daily basis.
_gat	1 minute	Google Analytics — throttles request rate to GA servers.
_ym_uid	1 year	Yandex Metrica — unique user identifier.
_ym_d	1 year	Yandex Metrica — date of the user's first visit.
_ym_isad	1 day	Yandex Metrica — detects ad blocker usage.
_ym_visorc	30 minutes	Yandex Metrica — WebVisor session replay data.

Advertising (Google Ads)

Cookie	Duration	Purpose
_gcl_au	90 days	Google Ads Conversion Linker — links website conversions to Google Ads clicks for accurate measurement.
_gcl_aw	90 days	Google Ads — stores conversion attribution data.
NID, _gads, _gac_*	Up to 2 years	Google — used for ad personalisation and frequency capping; set by Google's advertising domains only when you have given consent (or where local law permits) and have interacted with a Google Ads campaign.

Local Storage (browser storage, not cookies)

In addition to cookies, our website uses your browser's local storage for a small number of strictly functional purposes. Local storage entries are not transmitted with HTTP requests and are accessible only to scripts served from our domain.

Key	Duration	Purpose
tb-ct-{year}, tb-einv-{year}	7 days	Remembers that you dismissed our deadline reminder bar (corporate tax filing / e-invoicing notices) so it does not reappear in the same week.

8.3 Google Consent Mode v2 and Regional Differences

Our website uses Google Consent Mode v2 — a Google technology that adjusts how analytics and advertising tags behave based on your consent state and your jurisdiction:

• Visitors from the European Economic Area (EEA), United Kingdom, Switzerland and Gibraltar: analytics and advertising cookies are set to a "denied" state by default. You will see a full consent banner on your first visit with options to Accept All, Reject All, or Customise. Cookies in those categories are loaded only after you provide explicit consent. You can revisit your choice at any time via the "Cookie preferences" button in the page footer or the floating button in the lower-left corner of the screen.
• Visitors from all other jurisdictions (including the UAE, CIS countries, Asia and the Americas): analytics and advertising cookies are activated by default in accordance with applicable local data protection laws, which permit implied consent for analytics purposes (UAE Federal Decree by Law No. 45 of 2021 and equivalent legislation). A minimal informational notice is displayed on your first visit. You may opt out at any time via the "Cookie preferences" link in the page footer or through your browser settings.

Even where cookies are loaded by default, our Google Analytics integration is configured to anonymise IP addresses and to redact advertising identifiers where appropriate. We do not sell or rent cookie data to third parties.

8.4 Managing Cookies

You can control and manage cookies through any of the following methods:

• Cookie preferences link in the footer of every page — opens the full settings panel with category-level toggles.
• The consent banner displayed on your first visit (EEA visitors only).
• Your browser settings — most browsers let you view, delete and block cookies from specific sites. Refer to the help section of your browser (Chrome, Safari, Firefox, Edge) for instructions.
• Google Analytics opt-out browser add-on — available at tools.google.com/dlpage/gaoptout.
• Google Ads personalisation controls — manage at adssettings.google.com.
• Yandex Metrica opt-out — available at yandex.com/support/metrica/general/opt-out.html.

Disabling certain cookies may affect the functionality of the website (for example, the WPS Generator and contact forms rely on session cookies to operate).

9. Sharing Your Information

We may share your personal information with trusted third parties in the following circumstances:

• Technology and IT service providers supporting our website and operations;
• Analytics and advertising providers — including Google LLC (Google Analytics, Google Tag Manager, Google Ads) and Yandex LLC (Yandex Metrica) — for measuring site usage and the effectiveness of our marketing campaigns;
• Professional advisers including legal, financial, and compliance consultants;
• Regulatory authorities, courts, and law enforcement agencies where required by law;
• Business partners or counterparties in the course of delivering services, with your knowledge;
• Successors or acquirers of our business in the event of a merger, acquisition, or restructuring.

We do not sell, rent, or otherwise make your personal information commercially available to third parties without your prior consent.

10. International Data Transfers

Our website is hosted on servers located in Switzerland. This means that when you submit any form on our website — including contact forms, the WPS Generator, subscription forms, or any other data entry tool — your personal information is transferred to and processed on servers in Switzerland.

Switzerland is recognised as a jurisdiction providing an adequate level of data protection. The Swiss Federal Act on Data Protection (nFADP) has been assessed as offering protection equivalent to leading international standards and is compatible with the requirements of the UAE Federal Decree by Law No. (45) of 2021 (PDPL). Accordingly, the transfer of your personal data to our Swiss-hosted servers does not require additional safeguard mechanisms beyond the protections already in place under this Policy.

In addition to Switzerland, your data may in certain circumstances be processed by third-party service providers — such as analytics or communications platforms — operating in other jurisdictions. In such cases, we apply appropriate safeguards in accordance with Article 23 of the UAE PDPL, which may include contractual data protection clauses and data processing agreements.

We do not transfer your personal data to countries that do not provide an adequate level of data protection, unless the transfer is necessary for the performance of a contract, the establishment or defence of legal claims, or is subject to your explicit consent.

11. Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, alteration, or disclosure. These measures include:

• Encrypted data transmission (SSL/TLS);
• Access controls and role-based permissions;
• Regular security reviews and vulnerability assessments;
• Contractual obligations on third parties who process data on our behalf.

While we take significant steps to protect your data, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security, and we encourage you to take reasonable steps to protect your own personal information online.

12. Your Rights

Under the UAE PDPL and other applicable legislation, you have the following rights in relation to your personal information:

• The right to access the personal information we hold about you;
• The right to rectification of inaccurate or incomplete information;
• The right to erasure ('right to be forgotten'), subject to legal retention obligations;
• The right to restrict or object to certain processing activities;
• The right to data portability, where technically feasible;
• The right to withdraw consent at any time, without affecting the lawfulness of prior processing;
• The right to lodge a complaint with the UAE Data Bureau.

To exercise any of these rights, please contact us at: privacy@coreledger.org. We will respond to your request within the timeframe prescribed by applicable law.

13. Third-Party Links

Our website may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties and encourage you to review their privacy policies independently.

14. Children's Privacy

Our website and services are not directed at children under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such information, please contact us immediately and we will take appropriate steps to delete it.

15. CoreLedger Go

This section explains how we handle personal data inside CoreLedger Go (the web application at go.coreledger.org and the CoreLedger Go mobile app): your account, our due-diligence (KYC) checks, and the accounting documents and records you upload. The rest of this Policy applies to Go as well, except where this section says otherwise. The Go subscription itself is governed by Part 4 of our Terms and Conditions.

15.1 Our Two Roles

• Controller. We decide how and why your account data, due-diligence data, billing data, support correspondence and security logs are processed. For due diligence we act under our own legal obligations as a designated non-financial business and profession under UAE anti-money-laundering law.
• Processor on your behalf. The documents you upload often contain personal data of other people: your customers, suppliers, employees or tenants. We process that data only to keep your books and prepare your tax filings, on your instructions under Part 4 of our Terms and Conditions. You remain responsible for having a lawful basis to share it with us.

A Go client may be a company or a natural person (a freelancer or an individual). Where the client is a natural person, the personal data described here is theirs directly.

15.2 What We Collect in Go

• Account: name, email address, phone number, interface language, and the role of each user. Phone numbers are stored encrypted.
• Business or personal profile: company or personal name, licence or freelance-permit details, registered address, VAT and Corporate Tax registration numbers, industry, and a description of the business activity.
• Due diligence (KYC/AML): your answers to our questionnaire; identity documents of owners, directors and signatories (passport, Emirates ID, visa); licence, memorandum of association, title deed or Ejari where relevant; declarations about politically exposed persons (PEP) and sanctions; the results of our sanctions and PEP checks; and your electronic signature on the questionnaire (a drawn signature confirmed by a code sent by email, or UAE PASS). Identity-document numbers are stored encrypted.
• Accounting documents and records: invoices, receipts, bank statements and other files you upload (PDF, photos, CSV), and the transactions, journal entries, reports and tax returns produced from them.
• Payments: card payments are handled by Stripe. We never receive your full card number; we keep the card brand, its last four digits, your payment history, and whether you have consented to filing fees being charged to your card.
• Usage and security: an audit log of actions in your account, and technical server logs (such as IP address, time and request) used to keep the service secure and working; and error reports you choose to send us (with a screenshot only if you attach one).
• Your browser: Go stores your theme, language and session tokens in your browser’s local storage, which are strictly necessary for the application to work. Go uses no advertising or analytics trackers.
• Mobile app: the camera is used only when you photograph a document or scan the QR code to sign in, and the app opens only the photos and files you pick to upload. Before upload it removes location (GPS) data from photos where the file format allows. Your session is kept in the device’s secure storage. The app has no advertising identifiers and shows no ads, and we do not track you across other apps or websites.

15.3 Why We Use It and on What Basis

• To provide the Subscription: keeping your books, preparing and filing returns, registrations, electronic invoicing, support: performance of our contract with you.
• To meet legal obligations: customer due diligence, sanctions and PEP screening, record keeping and reporting under UAE anti-money-laundering and tax law.
• To secure and improve Go: preventing misuse, investigating incidents, fixing errors: our legitimate interests.
• To send service emails: password resets, a daily summary of tasks for your company, and notices about your Subscription. We do not send marketing from the application.

15.4 Artificial Intelligence

• Reading your documents. To recognise and classify your accounting documents, Go sends their content to our AI service provider (section 15.5). The output is a draft: a CoreLedger accountant reviews and confirms every entry before it is posted, and no tax return is filed on the strength of AI output alone.
• The in-app assistant. When you write to the assistant, your message and the parts of your company’s records needed to answer it are sent to our AI service provider. The assistant changes your records only on your instruction; actions that cannot be undone wait for your confirmation, and every action is logged.
• Identity documents are not sent to AI. Passports, Emirates IDs, licences and similar documents are read on our own servers.
• PEP screening. To check whether owners, directors or signatories are politically exposed persons, we send to our AI service provider their names, their roles and ownership shares, and the company’s name, legal form, licensing authority and licensed activity. The check uses web search, so these names may appear in search queries. Dates of birth, nationalities, document numbers, photos and contact details are not sent. A CoreLedger officer reviews the result; no decision about you is taken by AI alone.
• Sanctions screening is done on our own servers against official lists we download (United Nations, OFAC, the United Kingdom and the UAE local terrorist list). No personal data is sent to the publishers of those lists.

15.5 Who We Share Go Data With

We do not sell personal data. We share it only with the service providers we need to run Go, under contracts that require them to protect it and to use it only on our instructions:

• Contabo GmbH: hosting of the application, its database and uploaded files (European Union).
• Google (Google Workspace): storage of our backups; backup archives of due-diligence files are encrypted.
• Anthropic, PBC: AI processing for document recognition and PEP screening (United States).
• Stripe: card payments (United States and Ireland).
• Fornex: relay of service emails from noreply@coreledger.org (Switzerland).
• An accredited e-invoicing service provider: when we connect you to electronic invoicing; the provider is named in the application before you are connected.

Data from Go is also available to CoreLedger’s own internal systems, which our staff use for due diligence, client service and accounting; this is CoreLedger itself, not a third party. We disclose data to the Federal Tax Authority when we file on your behalf, and to other authorities (including the UAE Financial Intelligence Unit) where the law requires. We will update the list above when providers change.

15.6 International Transfers of Go Data

Go’s application data is currently hosted in the European Union. We intend to move the hosting of CoreLedger Go to data centres in the United Arab Emirates and will update this section when we do. Some of the providers above process data in the United States, Ireland and Switzerland. Where data leaves the UAE we rely on the grounds the PDPL permits for cross-border transfers, including contractual safeguards with each provider, and transfer only what each service needs.

15.7 How Long We Keep Go Data

• Accounting documents and records: for the life of your Subscription and then for as long as UAE tax law requires: at least seven (7) years for Corporate Tax records and at least five (5) years for VAT records (fifteen (15) years for records relating to real estate).
• Due-diligence records: for at least five (5) years after our relationship ends, as required by UAE anti-money-laundering law. They are not deleted automatically.
• Account and billing data: for the life of your Subscription and as long as needed afterwards for accounting, tax and dispute purposes.
• Backups: database backups are kept on a rolling basis of about 30 days.

After you close your account you can export your records for 30 days. We then delete your data, except records we must keep by law, which we delete when the retention period ends.

15.8 Security in Go

• Encrypted connections (TLS) for all traffic.
• Field-level encryption of phone numbers and identity-document numbers.
• Strict separation between clients: a client sees only its own company. Our staff sign in through CoreLedger’s internal system with two-factor authentication.
• Two-factor authentication is available for client accounts.
• Daily backups, and an audit log of actions in each account.

15.9 Your Rights in Go

Your rights under section 12 apply to Go data. You can also export your accounting records yourself at any time. Some data cannot be deleted while the law requires us to keep it (section 15.7). Write to privacy@coreledger.org; we reply within 30 days. If you are not satisfied, you may complain to the UAE Data Office.

If you are a customer, supplier or employee of one of our Go clients and your data appears in their documents, please contact that client first: they decide how their records are used, and we will help them respond.

We will tell Go users of material changes to this section by email or in the application before they take effect.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The current version will always be available on our website. We will notify you of material changes by email or via a prominent notice on our website prior to the changes taking effect.

17. Contact