Privacy Policy

1. Our roles

Digital Innovative Agency FZ-LLC, trading through the RQM Books service, acts as a controller for account registration, billing, support, website, sales, and service-security data.

For personal data contained in a customer’s accounting records, RQM Books generally acts as a processor on the customer’s instructions, while the customer remains the controller and determines why the data is processed.

2. Personal data we collect

3. Why we process data

• To enter into and perform the subscription contract.
• To authenticate users, provide features, maintain records, and deliver support.
• To secure the Services, detect abuse, prevent fraud, and investigate incidents.
• To meet legal, tax, accounting, sanctions, court, and regulatory obligations.
• To improve the Services using aggregated or appropriately de-identified information.
• To send marketing only where a valid permission or other lawful basis applies, with an opt-out mechanism.

4. Consent and customer instructions

Where consent is the applicable basis, it must be specific and may be withdrawn without affecting earlier lawful processing.

When RQM Books processes customer content as a processor, the customer is responsible for its lawful basis, notices, permissions, accuracy, and data-subject request handling.

5. Sharing and subprocessors

RQM Books does not sell personal data.

Data may be shared with vetted hosting, storage, communications, payment, analytics, security, and support providers; professional advisers; or authorities where legally required.

Online card payments for RQM Books are processed by Stripe. Online payments for RQM E-Invoicing are processed by Paddle.com, our reseller and Merchant of Record for those orders. Each payment provider receives only the billing details needed to take payment, prevent fraud, and handle invoices and refunds, and processes them under its own privacy notice.

Providers receive only the access reasonably needed for their service and are subject to contractual confidentiality and data-protection obligations.

6. International transfers

Service providers or support personnel may process data outside the UAE. RQM Books uses contractual, organizational, and technical safeguards intended to support applicable cross-border transfer requirements.

Customers with specific residency requirements should contact RQM Books before enabling an affected feature.

7. Security

• Access controls and role-based permissions.
• Encryption in transit and protected credential storage.
• Logging, monitoring, dependency review, and incident-response procedures.
• Independent, encrypted off-site logical backups scheduled every six hours, with controlled retention, archive validation, and backup-health monitoring.

No online service can guarantee absolute security. Users should use unique passwords, limit administrator access, and promptly report suspicious activity.

8. Retention and deletion

Personal data is retained only for the period reasonably needed for the stated purpose, the customer relationship, security, backups, disputes, and applicable legal duties.

Customer accounting records may need to be preserved by the customer for UAE VAT, Corporate Tax, commercial, audit, or other statutory periods. Account deletion does not remove those customer obligations.

Independent logical recovery points follow the published Data Backup, Retention & Recovery Policy. When retention is no longer required, data is deleted, anonymized, or isolated until the applicable backup rotation completes, subject to legal holds.

9. Individual rights

Subject to applicable law, individuals may request information, access, correction, deletion, restriction, transfer, objection to certain processing, withdrawal of consent, or review of certain automated decisions.

Requests should be sent to info@rqmbooks.com. Identity and authority may be verified. Where RQM Books is a processor, the request may be referred to the relevant customer controller.

10. Security incidents

RQM Books maintains an incident process and will provide legally required notices to the appropriate customer, authority, or affected individual without undue delay after assessing a qualifying incident.

11. Artificial-intelligence features

Prompts and selected business data are processed to provide requested AI features. Users must not submit data they are not authorized to use.

AI output may be inaccurate and should be reviewed before accounting, tax, legal, employment, payment, or management action. Customer content is not used for advertising.

ChatGPT integration: if you connect RQM Books to ChatGPT, OpenAI's ChatGPT receives the customer names, item names, prices and quotation details needed to find records and prepare your quotation, and RQM Books saves a Draft quotation only after you confirm. RQM Books does not receive your ChatGPT conversations. Access follows your RQM Books permissions, and you can disconnect RQM Books at any time in your ChatGPT settings.

12. Children

The Services are intended for business users and are not directed to children. Do not create an account for a child or intentionally submit a child’s data unless lawful and necessary for an authorized business purpose.

13. Updates and contact

Material changes to this notice will be highlighted through the website, platform, or account email where appropriate.

Privacy questions, complaints, and rights requests may be sent to info@rqmbooks.com with the subject “Privacy Request,” or by post to Digital Innovative Agency FZ-LLC, FOB51716, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates.

14. Google user data: access and permissions

Connecting Google Drive to RQM Books is optional. Only an authorized company owner can configure the storage connection. Google asks for your permission before the connection is established; RQM Books does not receive your Google password.

The storage connector requests openid and email to identify the connected account, and https://www.googleapis.com/auth/drive.file to work with files created by RQM Books or explicitly made available to this app. This is not permission to read every file in your Drive. The connector does not request access to your Gmail inbox, Google Contacts or Google Calendar.

The data accessed includes the connected Google account identifier and email, the account display name and storage quota reported by Drive, and authorized files and their metadata. Metadata can include file and folder identifiers, file names, types, sizes, checksums, versions, parent folders and Drive viewing links. We also receive OAuth access and refresh tokens, granted scopes and expiry information to maintain the authorized connection.

15. How we use Google user data

We use this data to identify and display the connected storage account, check connection health and available storage, and provide the document-management features you choose. Those features include creating the RQM Books folder, uploading or updating authorized documents, listing and searching files in the configured folder, linking files to business records, opening files through Google Drive, renaming files and deleting a provider file when an authorized user expressly chooses that action.

Access is limited by Google's granted permissions and RQM Books company and user permissions. An accounting-record link does not itself grant a person access in Google Drive; Google's own account and sharing permissions still apply. We do not use the storage connection to scan unrelated Drive files or to read your email messages.

16. Where Google data is stored and protected

For this connector, document file contents are stored in the customer's connected Google Drive, rather than being automatically copied into a separate RQM Books document store. Upload sessions send the selected document to Google. Opening a document uses its Google Drive viewing link and may require a Google login.

RQM Books stores connection information, file metadata, links to business records and relevant audit events in the database for the RQM Books deployment. OAuth credentials are encrypted before database storage and are not returned in ordinary connector-status responses. Refresh tokens allow the authorized connection to continue without repeating consent for each operation. Google API communication uses HTTPS.

Cloud deployment databases and their recovery backups are managed with the service's hosting infrastructure; desktop or on-premise data follows the applicable deployment configuration. This does not promise that all data remains in a particular country. The international-transfer and backup sections of this notice also apply, subject to the more restrictive Google-specific provisions below.

17. Google data sharing, human access and Limited Use

RQM Books follows the Google API Services User Data Policy, including its Limited Use requirements, when handling Google user data. These Google-specific restrictions take priority over more general sharing, analytics, marketing and artificial-intelligence descriptions elsewhere in this notice.

Google receives requests and selected file contents needed for the Drive actions you authorize. Authorized users in your RQM Books company can see document metadata and business-record links according to their roles. Infrastructure and support providers may process only what is necessary to deliver the disclosed user-facing service, under confidentiality and data-protection obligations. Other disclosures are limited to security needs, applicable legal requirements, or a business transfer after obtaining any explicit prior user consent required by Google's policy.

We do not sell Google user data, share it with data brokers, use it for advertising or retargeting, use it to determine creditworthiness or make lending decisions, or use it to train or improve generalized artificial-intelligence or machine-learning models. Connecting Google Drive does not authorize sending Drive content to an AI provider.

Our personnel do not read Google file contents for routine monitoring. Human access is limited to your explicit consent for specific support assistance, necessary security investigations, legal obligations, or properly aggregated and anonymized internal operations where permitted by Google's policy.

18. Disconnecting Google, retention and deletion

The company owner can disconnect Google Drive under Settings > Document Management in RQM Books. Disconnecting marks the connection inactive and removes the saved OAuth credential fields from the active connection record. It does not delete your Google Drive files, erase existing accounting-record links or automatically remove all metadata and audit history.

You can also revoke RQM Books access in your Google Account's third-party connections page at https://myaccount.google.com/connections. Revocation stops further authorized Google API access but does not, by itself, erase data already stored in RQM Books. Reconnection requires authorization again.

To request deletion of Google connection metadata, document links, personal information or your RQM Books account, email info@rqmbooks.com with the subject Privacy Request and identify the company, account and data concerned. Do not send passwords, access tokens or unnecessary document contents. We verify identity and authority, involve the relevant customer controller where required, and explain any data that must be retained and why.

Connection data is used while the integration is enabled; document metadata, links and audit records are kept only while needed for the disclosed service, security or applicable legal obligations. Disconnecting and requesting deletion are separate actions. Removed active data can remain in restricted recovery backups until the published backup-retention cycle expires, or longer only where a lawful hold requires it. Retention of accounting records is not a reason to continue using revoked Google credentials.

Files already in your Google Drive remain under your control and Google's retention rules. To remove those files, delete them in Drive or use an expressly authorized provider-file deletion action. Removing only a link in RQM Books need not remove the original Drive file. Export any records you need before requesting irreversible deletion.

19. Changes to Google data use and privacy contact

We will disclose a material change to how Google user data is accessed, used, stored or shared and obtain any renewed consent required before applying that change. Continuing to use the general service is not treated as authorization for a new Google permission or undisclosed Google data use.

Questions or requests about Google data can be sent to info@rqmbooks.com, subject Privacy Request. RQM Books is operated by Digital Innovative Agency FZ-LLC, at the address stated in this notice.