Privacy Policy

Last Updated: September 7, 2026

This Privacy Policy explains how DEVRAFTEL (PRIVATE) LIMITED ("Devraftel," "we," "us," or "our") collects, uses, stores, shares, and protects personal information when businesses and professionals visit or use Devraftel Finance, including its AI-powered finance and accounting employees, applications, APIs, integrations, websites, and related services (collectively, the "Services").

Devraftel's principal business address is:

DEVRAFTEL (PRIVATE) LIMITED
96 S, KB Colony
Lahore, Pakistan

The Services are designed for businesses, accounting firms, finance teams, and other professional users.

1. Scope and Our Role

This Privacy Policy applies to personal information processed through the Services and our related websites and business operations.

Our role depends on the information involved.

1.1 Information we collect for our own business purposes

For information such as account details, billing contacts, website analytics, business communications, and security information, Devraftel generally determines the purposes and means of processing and therefore acts as a controller, business, or similar responsible entity under applicable privacy law.

1.2 Customer-controlled information

When Devraftel processes financial, accounting, employee, vendor, customer, client, or other information on behalf of a Customer, the Customer generally determines why the information is processed.

For that information, Devraftel generally acts as a processor, service provider, or equivalent role under applicable privacy law.

Where required, our processing may also be governed by a separate Data Processing Agreement.

2. Information We Collect

2.1 Account and contact information

We may collect:

• name;
• business email address;
• company name;
• job title;
• telephone number;
• account identifiers;
• authentication-related information;
• organization membership and role information; and
• communications with Devraftel.

2.2 Billing and Subscription Information

We may collect billing contact details, subscription or plan information, invoice records, transaction records, usage information relevant to billing, and related payment information.

If online purchases are offered, the checkout will identify the payment provider or Merchant of Record before payment. That provider may process payment details, billing administration, applicable transaction taxes, refunds, and related payment information under its own terms and privacy practices.

Devraftel does not need to store full payment-card details in order to provide the Services.

2.3 Customer Accounting Data

When Customer connects an accounting or business system, the Services may process information such as:

• chart of accounts;
• general-ledger information;
• transactions;
• journal entries;
• invoices and bills;
• accounts receivable and accounts payable records;
• customer and vendor records;
• bank and reconciliation information;
• trial balances;
• financial statements;
• workpapers;
• supporting documents;
• purchase orders;
• receipts;
• accounting classifications;
• related financial metadata; and
• other information required to perform the accounting workflow Customer requests.

2.4 Prompts, conversations, and workflow information

We may process:

• prompts and instructions;
• conversation history;
• workflow configurations;
• business rules;
• permissions and authorization settings;
• approvals;
• corrections;
• Customer-supplied files;
• AI-generated Outputs;
• exceptions;
• status information; and
• audit events describing actions taken through the Services.

2.5 Technical and security information

We may collect:

• IP address;
• browser and device information;
• operating-system information;
• timestamps;
• authentication events;
• API request metadata;
• performance information;
• error information;
• security events;
• feature usage; and
• other operational telemetry.

We design our operational logging and analytics so that routine product telemetry does not require collection of raw Customer Accounting Data.

3. Connected Services

Customer may connect third-party applications or accounts to the Services.

At launch, Devraftel may support integrations such as QuickBooks. We may support additional accounting, ERP, document, spreadsheet, communication, or business systems in the future.

When Customer connects a Connected Service, we may receive:

• account and organization identifiers;
• accounting records;
• files and document contents;
• file metadata;
• application records;
• OAuth access tokens;
• OAuth refresh tokens;
• permission scopes;
• authorization metadata; and
• other information required to perform the functionality Customer has authorized.

We access Connected Service information only within the permissions Customer grants and only for purposes related to the functionality Customer requests.

Customer may disconnect an integration through Devraftel or through the applicable third-party service.

4. Customer Systems Remain the System of Record

Devraftel is designed to work on top of Customer's existing systems rather than replace them.

A connected accounting platform remains the authoritative system of record for accounting information maintained in that platform.

Devraftel does not intentionally create or maintain a separate complete copy of Customer's accounting ledger as the authoritative accounting record.

To perform authorized workflows, however, the Services may temporarily retrieve and process portions of Customer Accounting Data and may retain information necessary to operate the Services, including:

• conversations;
• workflow state;
• approvals;
• AI-generated Outputs;
• audit events;
• customer-configured rules;
• integration metadata; and
• limited operational records.

5. How We Use Information

We use information to:

• provide and operate the Services;
• authenticate users and manage accounts;
• connect to Customer-authorized systems;
• execute accounting and finance workflows;
• generate Outputs;
• create or update records where Customer has authorized those actions;
• maintain workflow state and auditability;
• identify and route exceptions;
• provide customer support;
• administer subscriptions, usage-based billing, account entitlements, and related billing operations;
• secure the Services;
• prevent fraud, abuse, and unauthorized access;
• diagnose reliability and performance issues;
• comply with legal obligations;
• enforce our agreements; and
• improve the usability, security, reliability, and functionality of the Services.

We may use aggregated or de-identified information, product telemetry, and customer feedback to improve the Services where that information does not identify Customer, its clients, or individuals and does not include Customer Accounting Data.

6. Artificial Intelligence Processing

The Services use artificial-intelligence and machine-learning systems to perform Customer-requested tasks.

To provide these features, limited portions of Customer Data may be transmitted to an AI model provider where necessary to perform the applicable workflow.

Devraftel currently primarily uses OpenAI for AI model inference. We may change or add AI providers as the Services evolve. When we do, those providers will be subject to applicable contractual, security, and data-use requirements.

6.1 No generalized model training

Devraftel does not use:

• Customer Data;
• Customer Accounting Data;
• prompts;
• Outputs; or
• information obtained from Connected Services

to train generalized artificial-intelligence or machine-learning models.

We require AI providers processing Customer Data on our behalf to operate under terms or configurations that prohibit use of that data to train their general-purpose models.

6.2 Product improvement is different from model training

We may use aggregated or de-identified usage information, operational metrics, product telemetry, and customer feedback to understand how the Services are used and to improve functionality, reliability, security, and user experience.

We do not use raw Customer Accounting Data for generalized model training or unrelated product analytics.

7. Human Access to Customer Accounting Data

Devraftel is designed so that routine support, product analytics, and engineering operations do not require Devraftel personnel to inspect Customer Accounting Data.

Devraftel personnel may access Customer Accounting Data only in limited circumstances:

7.1 Customer-authorized access

Customer may expressly authorize Devraftel personnel to access specified Customer Accounting Data for a defined purpose such as:

• onboarding;
• implementation;
• migration;
• configuration;
• troubleshooting;
• support;
• testing a Customer-specific workflow; or
• helping Customer adopt or implement a feature using Customer's own data.

Authorization must come from an Authorized User and may be provided through:

• an in-product approval;
• a support ticket;
• email;
• a signed document; or
• another written electronic instruction that reasonably identifies the requested purpose.

Customer authorization does not create a general right for Devraftel personnel to access all Customer Data.

7.2 Security, legal, and protective access

Devraftel personnel may also access Customer Accounting Data where access is reasonably necessary to:

• investigate, contain, or respond to a security incident, fraud event, abuse, or material threat;
• comply with applicable law, regulation, court order, or lawful governmental process; or
• protect the rights, safety, security, or property of Devraftel, Customer, users, or others.

7.3 Controls on human access

Where human access occurs, Devraftel will seek to:

• limit access to authorized personnel;
• apply least-privilege access;
• limit access to the data reasonably necessary for the stated purpose;
• limit access to the period reasonably necessary;
• protect information through confidentiality and security obligations; and
• log access where technically practicable.

Devraftel does not permit personnel to access Customer Accounting Data for advertising, generalized AI model training, curiosity, unrelated analytics, or other unrelated purposes.

Customer may revoke prospective Customer-authorized access at any time.

If Customer voluntarily sends financial or accounting information directly to Devraftel personnel, including through a support request, Devraftel may access and use that information to address the request for which it was provided.

8. Authorization and Customer-Controlled Actions

Customer controls the scope of the AI Employee's access and actions.

Depending on the functionality available, Customer may determine:

• which company or client the AI Employee may work on;
• which Connected Services may be accessed;
• which data may be read;
• which records may be created or updated;
• which actions require approval; and
• when authorization should be changed or revoked.

Connecting an account does not automatically grant unrestricted authority to modify all information within that account.

Devraftel processes information and executes actions only within the permissions available through the Connected Service and the authorization Customer provides through the Services.

9. Service Providers and Subprocessors

We use service providers and subprocessors to operate the Services.

Depending on the features enabled, these providers may include:

Devraftel may add, replace, or remove service providers as our infrastructure evolves.

We configure observability and analytics services so that they are not intended to receive raw Customer Accounting Data for routine analytics. Where a provider must receive Customer Data to perform a Customer-requested function, we limit the information to what is reasonably necessary for that function.

Third-party providers process information under their own security controls and contractual obligations applicable to the service they provide to Devraftel.

10. Hosting and International Processing

Devraftel's primary production infrastructure is hosted in Amazon Web Services' US East (N. Virginia) region, United States.

Customer Data may therefore be processed in the United States and in other countries where Devraftel's authorized service providers operate.

Where applicable privacy law requires safeguards for international transfers, we will use appropriate contractual or other lawful transfer mechanisms.

11. How We Share Information

We do not sell Customer Data or personal information.

We may disclose information to the following categories of recipients:

11.1 Service providers and subprocessors

Providers that help us host, operate, secure, support, monitor, bill for, or maintain the Services.

11.2 Connected Services

We transmit information to Customer-authorized third-party systems when necessary to carry out Customer's instructions.

11.3 Professional advisers

We may disclose information to lawyers, accountants, auditors, insurers, or other professional advisers where reasonably necessary for our business or legal obligations.

11.4 Legal and protective disclosures

We may disclose information where reasonably necessary to:

• comply with applicable law or lawful process;
• respond to valid governmental requests;
• investigate fraud, abuse, or security incidents;
• enforce our agreements; or
• protect rights, safety, security, or property.

11.5 Corporate transactions

Information may be transferred as part of a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, subject to applicable law and confidentiality obligations.

12. Data Retention

We retain information only for as long as reasonably necessary to provide the Services, satisfy Customer instructions, maintain security and auditability, resolve disputes, enforce agreements, or meet legal obligations.

Our intended default retention approach is:

A service provider may retain limited information for a different period where necessary for security, fraud prevention, legal compliance, or operation of the service it provides to Devraftel.

We may retain de-identified or aggregated information that no longer reasonably identifies Customer or an individual.

13. Data Deletion and Integration Disconnection

Customer may request deletion of Customer Data by contacting privacy@devraftel.com or by using deletion functionality made available through the Services.

Disconnecting a Connected Service stops future access through that authorization.

Where technically supported, Devraftel will revoke applicable integration credentials when the connection is terminated.

Some information may remain temporarily in:

• encrypted backups;
• security records;
• audit records;
• billing records; or
• records we are legally required to retain.

Deletion requests do not require Devraftel to delete information that applicable law requires Devraftel to keep.

14. Security

Devraftel uses administrative, technical, and organizational measures designed to protect information against unauthorized access, alteration, disclosure, loss, or destruction.

Depending on the relevant system, measures may include:

• encryption in transit;
• encryption at rest;
• access controls;
• least-privilege permissions;
• authentication controls;
• secure credential and secret management;
• tenant and authorization controls;
• audit and security logging;
• monitoring;
• software-development security practices; and
• incident-response procedures.

No method of transmission or storage can guarantee absolute security.

If you believe information has been compromised, contact:

security@devraftel.com

15. OAuth and Integration Credentials

Some Connected Services require OAuth or similar authorization credentials.

We may store:

• access tokens;
• refresh tokens;
• granted permission scopes;
• organization or account identifiers; and
• related authorization metadata.

We use these credentials only to maintain the authorized integration and perform the functions Customer has enabled.

Customer can revoke an integration through Devraftel or, where available, through the Connected Service.

We protect stored credentials using security controls appropriate to their sensitivity.

16. Analytics, Cookies, and Similar Technologies

Our public website may use:

• necessary cookies;
• authentication technologies;
• preference storage;
• Google Analytics;
• Vercel Analytics;
• PostHog; and
• similar measurement technologies.

We may use these technologies to understand website usage, service performance, reliability, and feature adoption.

We do not intend to use website or product analytics tools to collect raw Customer Accounting Data.

Where applicable law requires consent before non-essential analytics or cookies are activated, we will request that consent.

Users may also control certain technologies through browser settings or any cookie controls we make available.

17. Customer Responsibilities and Third-Party Personal Data

Customers determine what information they provide to the Services and which Connected Services they authorize.

Customer is responsible for ensuring that it has the rights, authority, legal basis, notices, and consents required to provide personal information to Devraftel for processing.

If an accounting firm or other professional service provider uses the Services for a client, that Customer remains responsible for its relationship with the client and for establishing its authority to process the client's information.

Customer should avoid providing personal information that is unnecessary for the requested accounting or finance workflow.

18. Privacy Rights

Depending on where an individual is located, applicable law may provide rights such as:

• requesting access to personal information;
• requesting correction;
• requesting deletion;
• requesting restriction of processing;
• objecting to certain processing;
• requesting portability;
• withdrawing consent where processing is based on consent; and
• lodging a complaint with a competent privacy or data-protection authority.

To submit a privacy request, contact:

privacy@devraftel.com

If Devraftel processes the relevant information solely on behalf of a Customer, we may direct the individual to that Customer because the Customer controls the applicable data and processing purpose.

We may need to verify identity or authority before completing a request.

19. Automated Processing and AI Transparency

AI Employees automate finance, accounting, and related workflows.

The Services are not intended to independently make legally binding or similarly significant decisions about individuals without the Customer establishing any human review and safeguards required by applicable law.

Where applicable law requires a person to be informed that they are interacting directly with an AI system, Devraftel may provide or enable an appropriate disclosure.

Customers remain responsible for additional transparency or human-review obligations arising from how they deploy the Services.

20. Children's Privacy

The Services are intended for businesses and professionals and are not directed to children.

We do not knowingly collect personal information directly from children through account registration for the Services.

Information relating to minors may occasionally appear incidentally in legitimate accounting, payroll, expense, or business records processed on behalf of a Customer. In those situations, Devraftel processes the information on behalf of the Customer.

21. Third-Party Services

Connected Services and third-party websites are governed by their own privacy practices.

This Privacy Policy does not govern how a third party independently collects, uses, stores, or discloses information outside Devraftel's processing activities.

Customer should review the policies of the Connected Services it chooses to use.

22. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in:

• the Services;
• our technology or infrastructure;
• our service providers;
• our business practices; or
• applicable law.

We will update the Last Updated date when we revise this Policy.

Where required by applicable law, we will provide additional notice of material changes.

23. Governing Framework

DEVRAFTEL (PRIVATE) LIMITED is incorporated in Pakistan.

This Privacy Policy is intended to describe our practices globally. Privacy and data-protection laws outside Pakistan may apply depending on where Customer or affected individuals are located.

Nothing in this Privacy Policy limits rights that cannot lawfully be limited under applicable law.

24. Contact Us

For questions, privacy requests, or concerns:

DEVRAFTEL (PRIVATE) LIMITED
96 S, KB Colony
Lahore, Pakistan

Privacy: privacy@devraftel.com
Security: security@devraftel.com
Legal: legal@devraftel.com
Support: support@devraftel.com
Website: https://finance.devraftel.com