Privacy notice
Draft wording. The practice must supply or approve this text before sign-ups open to the public.
Who we are
Gold Standard ComSec operates Accounts to XBRL. [registered name, address and the contact for data requests go here]
What we collect, and why
- Your username, email address and a scrambled form of your password, to make your account, let you sign in, and send you the links that confirm your email or reset your password. The password itself is never stored.
- The documents you upload and the files made from them, to do the conversion you asked for.
- Your purchases: the package, the amount, the date and the tax invoice number, because the law requires us to keep sales records. Card and bank details go to Stripe and never reach us.
- A shortened network address and the time when you register and agree to these terms, as a record of that agreement.
- A record of each conversion and sign-in, so you and we can see who did what.
Who else handles it
- Stripe processes payments.
- Postmark (ActiveCampaign) delivers our emails.
- Our hosting provider runs the server the service is on.
Stripe and Postmark are outside Malaysia, so your email address and purchase details are transferred abroad for these purposes. We do not sell your data or use it for advertising.
How long we keep it
- Uploaded documents and conversions: fourteen days.
- Your account: until you ask us to close it.
- Sales records: seven years, as tax law requires, even after an account is closed.
- A sign-up that is never confirmed: 24 hours.
- To stop free sign-up tokens being claimed twice, a one-way fingerprint of an email address that received them is kept after the account closes.
Your rights
You may ask to see the personal data we hold about you, to correct it, to withdraw your consent, or to have your account closed and your data deleted (except records the law makes us keep). Write to [the contact address]; we answer within 21 days.
Security
Passwords are stored only in a scrambled form, every page is served over an encrypted connection, and each conversion can be opened only by the account and browser that made it.