Privacy Policy

This policy explains how Lydec Services Pte. Ltd. (UEN 202645391N, Lydec, we) handles personal data in Zaccount (zaccount.app), including Zac, its AI assistant, and on this website. We follow Singapore's Personal Data Protection Act 2012 (PDPA).

1. Two roles

• Data in a customer's books — their contacts, staff and transactions — belongs to that customer. We process it only on the customer's instructions, as their data intermediary. The customer is responsible for having the right to collect it and for telling the people concerned.
• Our own data — enquiries through this website, and our customers' account and billing details — Lydec is responsible for.

2. What we collect

• Enquiries: your name, company, email and message when you contact us or book a demo.
• User accounts: name, email, sign-in details and the role each user has.
• Accounting records: contacts, invoices, bills, bank transactions and the other records customers enter.
• Employee records (where a customer uses payroll): identification numbers (NRIC / FIN), salaries, bank details, leave and expense claims. NRIC / FIN numbers are processed only for employee identification, payroll and statutory filing, and are never used for authentication, passwords or sign-in.
• Uploaded files: receipts, bills, contracts, bank statements and other documents — attached to records, or kept in ZacFile — each user's own folders, which no one else in the customer's company (administrators included) can open unless that user shares them. A deleted file stays in its Bin for 30 days; the unshared files of a user who leaves are removed 90 days later.
• Notes: notes and handovers users write in ZacNote — each user's own, which no one else in the customer's company (administrators included) can open unless that user shares a note with them by name. Notes are not on the audit trail. The unshared notes of a user who leaves are removed 90 days later.
• Zac conversations: the questions users ask Zac and its answers, kept with the customer's records until deleted.
• Audit trail: a record of the changes made in a customer's books — who made each change (their name and login, and whether through Zac), when, and what changed, with the old and new values. It covers documents and journals, contacts, items, accounts, settings, users and roles, and employee records, as well as invitations, access given or removed and payroll / employee exports. Viewing a record and signing in are not recorded, and NRIC / FIN, work pass and bank account numbers are recorded only as "changed", never their values. We also keep our own log of the changes we make to a customer's account (its status, modules, seats and Super Admins).
• Technical data: sign-in cookies and the logs needed to run and secure the Service.
• Ad measurement: if you accept cookies on our website, Google records that you arrived from one of our ads and whether you then sent us an enquiry. Your name, email and message are never sent to Google.
• Website visitor counts: on our website only, Vercel Web Analytics counts page views — the page, where you came from, and your country, browser and device type. It uses no cookies, keeps no IP address and doesn't recognise you from one day to the next, so it can't tell who you are.

3. Why we use it

To provide, secure and support the Service; to bill customers; to answer enquiries; and to meet legal obligations. We send marketing only where permitted, and we check Singapore numbers against the Do Not Call registry before marketing calls or messages. We don't sell personal data.

4. Zac and AI

• Zac is powered by Anthropic's Claude. To answer a question or read a document, the relevant records and files are sent to Anthropic, which processes them to produce Zac's answer.
• Under Anthropic's commercial terms, this data is not used to train AI models. Files attached in a Zac chat, or opened by Zac from the user's ZacFile when they ask, are kept with Anthropic until the chat is deleted; Anthropic may keep other records for a limited period under its own terms.
• Zac sees only what the signed-in user is allowed to see, and has no access to payroll or salaries. It opens a ZacFile file only when its user asks, and only one that user may open; a file it edits is saved as a new copy, never over the original.

5. Our service providers and where data is stored

• Supabase — database, sign-in and file storage, in Singapore.
• Vercel — hosts the application, and counts visits to our website (Web Analytics).
• Anthropic — the AI behind Zac, in the United States.
• Resend — sends emails such as invitations, enquiries and the invoices and other documents customers send from the Service, in the United States.

Each processes data only on our instructions, under a data processing agreement. Where data is processed outside Singapore, we rely on those agreements to give it protection comparable to the PDPA.

Google Ads. On our website only (never in the app), and only if you accept cookies there, Google measures which of our ads lead to enquiries. Google handles that data as its own controller, under the Google Ads data protection terms and Google's Privacy Policy, and may process it outside Singapore. Nothing in the app or in customers' books is shared with Google.

Banks a customer connects. When a customer connects its own bank account (Airwallex), we use the access key the customer gives us to fetch that account's balances and transactions into its books, and to send the bank the payments the customer releases. The bank holds the account under its own terms with the customer; the key is stored encrypted and only the customer's Super Admins can change or remove it.

6. How we protect it

• Each customer's records are kept in their own separate, isolated part of the database.
• Data is encrypted in transit and at rest.
• Access within a company follows the roles its Super Admin assigns; payroll data is restricted to people given payroll access.
• Users are signed out after 15 minutes without activity.
• Every change is recorded in an audit trail that can't be edited or deleted. A customer's users see it only if their role allows, and only for the parts of the books they can already see; payroll changes only with payroll access.

7. Cookies

We use only the cookies the Service needs: sign-in cookies and the company you have open, which end when you close your browser, and one that remembers your last company for a year so it's pre-selected next time. Your browser also stores display preferences, such as column widths, and a copy of a PDF you preview for up to 30 minutes, so it opens and saves under its own file name, and a question you're typing to Zac (until you send it or close the tab), so moving to another screen doesn't lose it — these never leave your device and are cleared at the sign-in page.

Our website only: if you accept the cookie notice on our website, Google Ads sets cookies (such as _gcl_au) for up to 90 days to tell us whether a visitor from one of our ads sent an enquiry, and the office map in our Contact Us form shows straight away. If you decline, nothing from Google loads, unless you choose Show map there, which loads Google Maps. Your choice is kept in your browser; change it any time with Cookie settings at the bottom of any page of our website. The app itself — sign-in and everything after — never uses advertising or analytics cookies. Our website's visitor counts (Vercel Web Analytics) use no cookies at all, whatever you choose.

8. How long we keep it

• Accounting records: for as long as the customer subscribes, then as set out in our Terms of Service (an export period or paid archive, then deletion; backups deleted within a further 90 days).
• Audit trail: for as long as the customer subscribes, as part of its accounting records — never shortened while it does — then deleted with the rest of its records, as above.
• Our log of changes to customer accounts: for five years after the customer leaves.
• Enquiries: as long as needed to respond and follow up, and no more than two years unless you become a customer.

9. Your rights

You may ask to access or correct your personal data, or withdraw consent to its use. For data in a customer's books, please contact that organisation — we'll help them respond. We aim to reply within 30 days.

10. Data breaches

If a data breach occurs, we assess it promptly, tell affected customers without undue delay, and notify the Personal Data Protection Commission and the people affected where the PDPA requires.

11. Changes

We may update this policy; the date at the top shows the latest version.

12. Contact our Data Protection Officer

Jonathan Tan, Data Protection Officer, Lydec Services Pte. Ltd., 60 Paya Lebar Road, #06-28, Paya Lebar Square, Singapore 409051 · jonathan@lydecservices.com