Privacy Policy

1. Introduction and Scope

This Privacy Policy (“Policy”) explains how Obsidyun, operated by obsidyun.com (“Obsidyun,” “we,” “our,” or “us”), collects, uses, discloses, retains, and safeguards personal information in connection with our cloud-based accounting, inventory, invoicing, payroll, human resources, and business management platform, including our website, applications, and related services (collectively, the “Service”).

This Policy applies to: (a) visitors to obsidyun.com; (b) prospective and current customers who register for or subscribe to the Service (“Customers”); and (c) individuals whose personal information is submitted to the Service by a Customer in the course of using the Service, such as a Customer’s employees, contractors, or business contacts (“End Users”). Where a Customer uploads, enters, or transmits personal information of its own employees or contacts into the Service, Obsidyun acts as a data processor / operator on the Customer’s behalf, and the Customer remains the data controller / responsible party for that information, as described in Section 3 below.

This Policy should be read together with our Terms of Service. Capitalized terms not defined here have the meaning given in the Terms of Service.

2. Information We Collect

2.1 Information You Provide Directly

• Account and identity data: full name, email address, phone number, job title, company name, and login credentials.
• Billing data: billing address, tax identification number, and payment method details. Card and bank account numbers are collected and stored by our PCI-DSS-compliant payment processors, not on Obsidyun’s own servers.
• Business and financial records: chart of accounts, invoices, receipts, purchase orders, inventory records, payroll data, employee records, VAT/tax filings, and other accounting data that a Customer inputs, uploads, or imports into the Service (“Customer Data”).
• Support communications: information you provide when contacting support, submitting a help ticket, or corresponding with us.

2.2 Information Collected Automatically

• Usage data: pages viewed, features used, session duration, click-stream data, and referring URLs.
• Device and technical data: IP address, browser type and version, operating system, device identifiers, and general location inferred from IP address.
• Cookies and similar technologies: as described in Section 12 (Cookies and Tracking Technologies).
• Security and audit logs: authentication events, access logs, and error logs used to detect fraud, abuse, and security incidents.

2.3 Information From Third Parties

• Payment processors (e.g., transaction status and confirmation, not full card numbers).
• Identity or business verification providers used for KYC/anti-fraud checks where required.
• Integration partners that a Customer connects to the Service (e.g., banking, e-commerce, or tax-authority integrations), limited to the data the Customer authorizes us to receive.

3. Our Role: Controller vs. Processor

Obsidyun acts in two distinct capacities, which determines which party is primarily responsible for a given category of personal data:

A copy of our standard Data Processing Addendum, incorporating the EU Standard Contractual Clauses and POPIA operator obligations, is available on request to reachout@obsidyun.com and is incorporated by reference into every Customer’s subscription agreement.

4. How We Use Personal Information

• Provision, operation, maintenance, and improvement of the Service, including hosting Customer Data and generating accounting outputs (invoices, VAT reports, payslips, financial statements).
• Processing subscription payments, issuing receipts, and managing billing.
• Authenticating users and securing accounts (e.g., detecting anomalous logins).
• Providing customer support and responding to inquiries.
• Sending service, security, and transactional notifications.
• Sending product updates and marketing communications, where you have opted in or where permitted by law, with an unsubscribe option in every message.
• Complying with legal, tax, and regulatory obligations, including e-invoicing and VAT compliance obligations applicable in the jurisdictions where our Customers operate.
• Aggregating and de-identifying usage data to improve platform performance and reliability. De-identified data is not re-identified and is not treated as personal information.
• Preventing fraud, abuse, and security incidents.

5. Legal Bases for Processing (GDPR)

Where the GDPR applies (Section 11 below), we rely on the following legal bases under Article 6(1):

6. Data Sharing and Disclosure

We do not sell or rent personal information. We disclose personal information only as follows:

• Sub-processors and service providers: cloud hosting and database infrastructure, payment processing, email delivery, customer support tooling, analytics, and security monitoring providers, each bound by written data protection terms. A current list of material sub-processors is available on request.
• Within Obsidyun: personnel who need the information to perform their duties, subject to confidentiality obligations and role-based access controls.
• Corporate transactions: in connection with a merger, acquisition, financing, or sale of assets, subject to confidentiality commitments and, where required, advance notice to affected individuals.
• Legal and safety reasons: to comply with a legal obligation, court order, or lawful request from a regulator or tax authority, or to protect the rights, property, or safety of Obsidyun, our Customers, or others.
• With your direction: where you or your Customer administrator authorize a specific integration or export.

7. International Data Transfers

Obsidyun is headquartered in the United States and may process personal information in the United States and other countries where we or our sub-processors operate. Where we transfer personal information out of the European Economic Area, the United Kingdom, Switzerland, or South Africa, we use recognized transfer mechanisms, including:

• The European Commission’s Standard Contractual Clauses (2021) and the UK International Data Transfer Addendum, incorporated into our sub-processor and Customer agreements;
• Assessment of the destination country’s data protection framework and supplementary technical, contractual, and organizational safeguards (e.g., encryption in transit and at rest, access controls) as required by Schrems II-aligned transfer impact assessments;
• For South Africa, reliance on POPIA section 72 conditions, including contractual safeguards that bind the recipient to conditions substantially similar to POPIA’s conditions for lawful processing; and
• Consent or another applicable derogation only where a structural safeguard listed above is not available.

8. Data Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including:

• Encryption of data in transit (TLS 1.2+) and at rest for production databases and backups.
• Role-based access controls and the principle of least privilege for employee access to Customer Data.
• Multi-factor authentication for administrative and infrastructure access.
• Logging and monitoring of access to production systems, with automated alerting for anomalous activity.
• Regular vulnerability scanning and periodic third-party security review.
• A documented security-incident response process, including notification timelines described in Section 8.1.

8.1 Breach Notification

If we become aware of a security incident that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal information, we will: (a) notify affected Customers without undue delay and, where feasible, within 72 hours of becoming aware, consistent with GDPR Article 33; (b) notify South Africa’s Information Regulator and affected data subjects as soon as reasonably possible, consistent with POPIA section 22; and (c) notify affected individuals or state authorities as required under applicable U.S. state breach-notification laws, which generally require notice “without unreasonable delay.” Obsidyun will provide Customers with the information reasonably necessary for the Customer to meet its own notification obligations as controller/responsible party.

9. Data Retention Policy

We retain personal information only for as long as necessary to fulfil the purposes described in this Policy, comply with our legal and contractual obligations, resolve disputes, and enforce our agreements. Retention periods vary by data category, as set out below. Where a Customer requests earlier deletion and no legal ground requires continued retention, we will delete or anonymize the data within the timeframe stated in Section 9.2.

9.1 Standard Retention Schedule

9.2 Deletion Requests

Where you submit a verified deletion request and no overriding legal basis for retention applies, we will complete deletion from production systems within 30 days and from backups by the end of the then-current backup cycle (Section 9.1). Certain minimal records (e.g., evidence of a prior deletion request, or records we are legally required to keep) may be retained solely for compliance purposes and are restricted from further use.

9.3 Account Closure by a Customer Administrator

When a Customer terminates its subscription, the Customer administrator may export Customer Data before the 90-day recoverable window in Section 9.1 closes. After that window, Customer Data is deleted or anonymized in line with our standard retention schedule, except where the Customer has a separate written retention agreement with us or where retention is legally mandated (e.g., statutory bookkeeping periods).

10. Your Privacy Rights

The rights available to you depend on where you live and which data protection law applies. Obsidyun honors valid rights requests regardless of jurisdiction as a matter of policy, but the legal deadlines, exemptions, and enforcement routes differ as described below. To exercise any of these rights, contact reachout@obsidyun.com. We will verify your identity before acting on a request and will respond within the statutory timeframe applicable to your jurisdiction (see below), or within 30 days by default.

10.1 European Economic Area, United Kingdom, and Switzerland — GDPR / UK GDPR

If the GDPR or UK GDPR applies to you, you have the right to:

• Access the personal information we hold about you (Art. 15);
• Rectify inaccurate or incomplete data (Art. 16);
• Erasure (“right to be forgotten”), subject to legal retention exceptions (Art. 17);
• Restrict processing in certain circumstances (Art. 18);
• Data portability, to receive your data in a structured, machine-readable format (Art. 20);
• Object to processing based on legitimate interests or direct marketing (Art. 21);
• Not be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects (Art. 22); and
• Withdraw consent at any time where processing is based on consent, without affecting prior processing (Art. 7(3)).

You also have the right to lodge a complaint with your local supervisory authority — for example, the Irish Data Protection Commission, the German Bundesbeauftragte für den Datenschutz, or, for the UK, the Information Commissioner’s Office (ICO). We respond to verified GDPR requests within one month, extendable by two further months for complex requests, consistent with Article 12(3).

10.2 South Africa — POPIA

If the Protection of Personal Information Act 4 of 2013 (“POPIA”) applies to you, you have the right to:

• Be notified that personal information is being collected (section 18) and, where applicable, that it has been accessed or acquired by an unauthorized person (section 22);
• Establish whether Obsidyun holds personal information about you and to request access to it (section 23);
• Request correction, destruction, or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully (section 24);
• Object, on reasonable grounds, to the processing of your personal information (section 11(3)) and to object to processing for direct marketing purposes (section 69);
• Not be subject to a decision based solely on automated processing that affects you in a manner that significantly affects you (section 71); and
• Submit a complaint to South Africa’s Information Regulator if you believe your POPIA rights have been infringed.

As required by POPIA section 69, we do not send direct marketing by electronic communication to individuals in South Africa unless you are an existing Customer being marketed similar products/services with an opt-out on every message, or you have separately consented.

10.3 United States

Obsidyun does not sell personal information for money and does not use personal information for cross-context behavioral advertising. Depending on your state of residence, you may have rights under comprehensive state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, and similar laws in other states as they take effect. Common rights include the right to:

• Know / access the categories and specific pieces of personal information we have collected about you and the categories of sources, purposes, and third parties involved;
• Delete personal information we hold about you, subject to statutory exceptions (e.g., completing a transaction, complying with a legal obligation, security, and internal uses reasonably aligned with your expectations);
• Correct inaccurate personal information;
• Opt out of the “sale” or “sharing” of personal information and of targeted advertising (Obsidyun does not currently engage in either, so this right is not applicable in practice, but you may still submit a preference signal such as Global Privacy Control, which we honor);
• Limit the use of sensitive personal information to purposes permitted by law (CPRA); and
• Non-discrimination for exercising any of these rights, including with respect to price or service level.

California residents may designate an authorized agent to submit a request on their behalf. We will verify both the requester’s identity and the agent’s authority before acting. We do not knowingly sell or share the personal information of consumers we know to be under 16 years of age.

10.3.1 Other Sector-Specific U.S. Considerations

Because Obsidyun processes payroll and financial data, certain Customer Data may also be subject to sector rules such as the Gramm-Leach-Bliley Act safeguards standard (where a Customer is itself a financial institution) or state data-breach notification statutes. Where such rules apply to a Customer’s use of the Service, the Customer is responsible for its own regulatory compliance, and Obsidyun supports that compliance through the security and DPA commitments in Sections 3 and 8.

10.4 Ethiopia — Personal Data Protection Proclamation No. 1321/2024

Because Obsidyun is based in Addis Ababa and many of our Customers and End Users are located in Ethiopia, we also comply with Ethiopia’s Personal Data Protection Proclamation No. 1321/2024, enforced by the Ethiopian Communications Authority. Ethiopian data subjects have the right to be informed of collection, to access, rectify, and erase their personal data, to object to processing and to direct marketing, and to restrict certain automated decision-making. Cross-border transfers of personal data out of Ethiopia are made only where the recipient country provides an adequate level of protection, where standard contractual safeguards are in place, or where the data subject has given informed consent to the transfer, consistent with the Proclamation’s cross-border transfer conditions.

11. Where Each Framework Applies

12. Cookies and Tracking Technologies

We use strictly necessary cookies (for authentication and security), functional cookies (to remember preferences), and analytics cookies (to understand feature usage). Non-essential cookies are set only with your consent where required by law (e.g., the EU ePrivacy Directive and UK PECR), and you can manage preferences through our cookie banner or your browser settings. Consent records are retained per Section 9.1.

13. Children’s Privacy

The Service is intended for business use by individuals who are at least 18 years old, consistent with our Terms of Service. We do not knowingly collect personal information from children, and we do not knowingly sell or share the personal information of individuals under 16. If we learn that we have inadvertently collected personal information from a child, we will delete it promptly.

14. Third-Party Links and Integrations

The Service may link to, or integrate with, third-party websites, banks, tax authorities, or applications that Customers choose to connect. We are not responsible for the privacy practices of those third parties, and this Policy does not apply to information you provide directly to them. Review their privacy notices before connecting an integration.

15. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or legal requirements. We will post the revised Policy with an updated effective date and, for material changes, provide additional notice (e.g., by email or an in-app notice) before the change takes effect.

16. Contact Us

Questions, requests, or complaints about this Policy or our data practices can be sent to:

Obsidyun — Privacy Team
Email: reachout@obsidyun.com
Postal address: 444 Alaska Avenue, Suite BIP244, Torrance, CA 90503, USA