Privacy Policy

This policy explains how Exchange Rates Manager handles personal information and organization data when you create an account, sign in, or use the service.

About the service provider

Exchange Rates Manager is built and provided by Doaltech Global Limited, a member of the Doaltech Group of Companies. In this policy, “we,” “us,” and “our” refer to Doaltech Global Limited when it operates the service.

1. Information we collect

We may collect your name, username, email address, organization email, password in securely hashed form, assigned role, account status, password-reset information, and operational records entered by authorized users.

2. Security and activity data

We record authentication attempts, audit events, timestamps, IP addresses, browser or device information, terminal activity, and message-delivery status to operate and protect the service.

3. How information is used and our role

Information is used to authenticate users, separate organizations’ data, enforce permissions, provide requested features, maintain audit trails, prevent abuse, troubleshoot problems, support customers, and comply with legal obligations. An organization generally determines why its users and operational records are processed and acts as controller; Doaltech generally processes that information to provide the service under the organization’s instructions. Doaltech may act as an independent controller for its own security, fraud prevention, account administration, billing, and legal-compliance records.

4. Organization access

Your account and operational records are affiliated with an organization email. Authorized users within that organization may access information according to their assigned roles.

5. Sharing and service providers

Information may be processed by contracted providers needed for hosting, backups, communications, support, security, and enabled AI features. We require appropriate confidentiality and data-protection commitments and limit disclosure to what the provider needs. A current subprocessor schedule is made available during contracting and on request. We do not sell personal information. Information may also be disclosed when required by law or necessary to protect rights, users, and service security.

6. Platform Currency Intelligence and DeepSeek

Platform Currency Intelligence is optional for each organization and disabled by default. When an organization Administrator provides consent, operational summaries, organization name, currencies, current exchange rates, cluster names, aggregated exchange-rate history, and non-identifying operational counts may be transmitted to DeepSeek to answer management questions. We exclude passwords, terminal keys, API credentials, user names, user email addresses, and direct account identifiers. Consent may be withdrawn in Settings; subsequent AI queries will then exclude that organization.

DeepSeek states that data submitted to its services may be processed and stored in the People’s Republic of China. DeepSeek determines its own retention according to the purpose, sensitivity, legal requirements, security needs, and its applicable privacy terms. Organizations should review DeepSeek’s current Privacy Policy before opting in.

7. Retention and deletion

Active organization operational data is normally kept for the service term. After confirmed termination and completion of the export-validation process, primary organization data is deleted within 30 days; data in rotating backups expires within 90 days. Audit and security events are normally kept for 12 months, authentication rate-limit records for 30 days, expired or used password-reset records for 30 days, and closed support correspondence for 24 months. Platform AI questions are not stored in readable form by this application; a one-way question hash, model, organization count, token usage, result status, and timestamp are kept for 90 days. Data transmitted to DeepSeek is subject to DeepSeek’s separate retention practices. A documented legal obligation, dispute, fraud/security investigation, or legal hold may require limited data to be retained longer; it remains restricted and is deleted when the exception ends.

8. Security

We use access controls, organization-level data separation, role permissions, secure sessions, password hashing, request protections, rate limiting, query quotas, usage logging, and audit logging.

9. Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction, objection, or a portable copy of personal information. Submit a request to the contact below with the subject “Privacy Request.” We will verify identity and authority before disclosure or deletion. Where an organization controls the information, we may refer the request to that organization and assist it. Organization Administrators can grant or withdraw platform AI consent in Settings.

10. Cookies and sessions

The service uses an essential session cookie to keep you signed in securely and protect requests. It is not used for advertising.

11. International processing

Hosting or service providers may process information in other countries. We document relevant locations and use contractual, organizational, and technical safeguards required by applicable law. Optional DeepSeek processing may occur in the People’s Republic of China as described above.

12. Exports, offboarding, and incidents

An authorized organization Administrator or contractual contact may request an export or closure. We verify authority, provide a secure machine-readable export that excludes passwords and secrets, revoke access at closure, and issue deletion confirmation on request. Suspected security or privacy incidents should be reported immediately to the contact below with the subject “Urgent – Security Incident.” We investigate, contain, preserve evidence, and notify affected organizations or regulators where required.

13. Changes to this policy

We may update this policy when practices, features, suppliers, or legal obligations change. Material changes will be communicated through the service or the organization’s registered contact before they take effect where reasonably practical.

14. Contact and complaints

Privacy requests, security reports, or concerns may be directed to:

You may also raise a concern with Ghana’s Data Protection Commission at dataprotection.org.gh.