Privacy Policy

The Service collects only the following.

• Account: email, name, password (stored only as an Argon2id hash)
• Security: two-factor secrets (AES-256-GCM encrypted), and the IP address and browser info in login records
• Work: workspace and expense-request contents, connected wallet addresses, evidence files, audit logs

We use no ad trackers or marketing cookies. To understand how the website is used, we use Google Analytics, which sets its own cookies and receives usage data such as the pages viewed and the browser type. Apart from that, the only cookie we set keeps your login session.

Collected information is used only for login and account protection, recording and proving the approval flow, preventing abuse, and meeting legal obligations. We never sell it to third parties or provide it for marketing.

When a transfer executes, the receiving address, amount and transaction hash are recorded permanently on the public blockchain. This is intrinsic to blockchains and the Service cannot delete or modify it. Please consider this before approving a payout request.

Account information is destroyed without delay upon withdrawal. However, audit logs and approval records serve as a team's accounting evidence, so they are retained until the workspace is deleted, and where law imposes a retention duty, that period is followed.

To operate the Service, storage is entrusted to cloud infrastructure (hosting, database). Entrustment is limited to what is necessary to provide the Service, and the data is not used for any separate purpose.

Users may request access to, correction of, deletion of, or suspension of processing of their information. Send requests to [email protected] and we will handle them without delay.