Privacy Policy

We collect information you provide directly to us, information we collect automatically when you use the Services, and information we receive from third parties. We only collect the information that is reasonably necessary to provide and improve the Services.

1.1 Information You Provide Directly

• Account information: your full name, email address, phone number, organization or company name, and password when you register for an account. On mobile, you may log in using your email address and password.
• Financial information: information you enter into the Services to manage your finances, such as income, expenses, transactions, budgets, savings goals, investments, and related financial data.
• HR and payroll information: if you use Protocol as an HR and payroll tool, we collect employee data such as names, contact details, employment and attendance records, leave information, salary and payroll data, designations, departments, and other information required to manage your workforce.
• Communications: information you provide when you contact support, respond to surveys, or otherwise communicate with us.

1.2 Information Collected Automatically

• Device and usage data: device type, operating system, browser type, IP address, unique device identifiers, app version, pages or features you visit, and interactions within the Services.
• Log data: diagnostic, crash, and performance data that helps us maintain the reliability and security of the Services.
• Cookies and similar technologies: as described in Section 10 below.

We do not require you to provide more information than is necessary to operate your account and provide the Services.

We use the information we collect for the following purposes:

• To create, maintain, and secure your account and to authenticate you when you log in.
• To provide, operate, and improve the Services, including financial tracking, budgeting, savings, reporting, HR, attendance, leave, and payroll features.
• To personalize your experience and deliver content and features relevant to you.
• To process transactions, manage subscriptions and billing, and send you service-related communications.
• To provide customer and technical support and respond to your enquiries.
• To detect, prevent, and address technical issues, security incidents, fraud, and abuse.
• To comply with legal and regulatory obligations.

Where the UK GDPR or equivalent law applies, we rely on the following legal bases for processing your personal information:

• Performance of a contract: to provide the Services you have requested and to administer your account and subscription.
• Consent: where you have given us clear permission to process your information for a specific purpose, such as receiving marketing communications. You may withdraw your consent at any time.
• Legitimate interests: to operate, secure, and improve our Services, provided our interests are not overridden by your rights and interests.
• Legal obligation: where processing is necessary to comply with the law.

We do not sell your personal information. We share your information only in the limited circumstances described below:

• Service providers: trusted third parties who help us operate the Services, such as cloud hosting, data storage, analytics, customer support, and payment processors. These providers are bound by confidentiality obligations and may only process your data to perform services on our behalf.
• Within your organization: where an organization uses the Services to manage employees, we may share relevant HR and payroll data with authorized administrators of that organization.
• Legal requirements: where required by law, regulation, legal process, or governmental request, or where disclosure is necessary to protect our rights, property, or safety, or the rights of our users or the public.
• Business transfers: in connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction.
• With your consent: we may share your information with third parties when you have given us explicit consent to do so.

To help you understand the data collected by the Protocol mobile app and to satisfy the data safety requirements of the Google Play Store and Apple App Store, we disclose the following categories of data we collect and share:

• Personal info: name, email address, phone number, and other identifiers.
• Financial info: financial data you provide and transaction data you create.
• User content: files, data, and content you upload or create in the Services.
• App activity: app interactions, features used, and in-app actions.
• App info and performance: crash logs, diagnostics, and other performance data.
• Device or other IDs: device identifiers used for operational and security purposes.

Data is encrypted in transit and, where applicable, at rest. We do not sell personal information, and this policy describes the purposes for which each category of data is used. This disclosure is provided in good faith to help you make informed decisions about downloading and using our app.

We retain your personal information only for as long as necessary to fulfil the purposes described in this Privacy Policy, to comply with our legal obligations, and to resolve disputes and enforce our agreements. When we no longer need your information, we will delete or anonymize it in a secure manner. Specific retention periods may be required by the laws of the jurisdiction in which you operate.

We take the security of your data seriously and implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit, access controls, secure cloud storage and backup, and regular monitoring of our systems. Financial data that you back up with us is stored securely in the cloud and is accessible only to you and to authorized service providers acting on our behalf.

However, no method of transmission over the internet or method of electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security. You are responsible for maintaining the confidentiality of your password and account credentials.

Depending on your location and applicable law, you may have the following rights regarding your personal information:

• Access: the right to request a copy of the personal information we hold about you.
• Rectification: the right to correct inaccurate or incomplete information.
• Erasure: the right to request deletion of your personal information, subject to legal requirements.
• Restriction: the right to restrict processing in certain circumstances.
• Portability: the right to receive your personal information in a structured, commonly used, machine-readable format.
• Objection: the right to object to processing based on legitimate interests or direct marketing.
• Withdrawal of consent: where processing is based on consent, the right to withdraw that consent at any time.

To exercise any of these rights, please contact us at support@protocol.software. We will respond to your request within the time frame required by applicable law. If you are in the UK or EEA and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority or the UK Information Commissioner's Office (ICO).

The Services are not directed to children under the age of 13 (or the applicable minimum age in your country, which may be higher under local law). We do not knowingly collect personal information from children. If you believe that a child has provided us with personal information, please contact us, and we will take steps to delete such information promptly.

We and our service providers may use cookies, web beacons, and similar technologies to operate and improve the Services, remember your preferences, analyze usage, and personalize your experience. You can control cookies through your browser settings; however, disabling certain cookies may affect the functionality of the Services. We use both session cookies (which expire when you close your browser) and persistent cookies (which remain until they expire or are deleted).

The Services may contain links to third-party websites, services, or applications that are not operated by us. This Privacy Policy does not apply to those third parties. We are not responsible for the privacy practices of such third parties, and we encourage you to review their privacy policies before providing them with your personal information.

We are a global product and your information may be processed and stored in the United Kingdom and other countries where we or our service providers operate. When we transfer personal data across borders, we take appropriate safeguards, such as standard contractual clauses or other recognized transfer mechanisms, to ensure your information remains protected in accordance with this policy and applicable law.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will post any changes on this page and update the “Effective Date” above. If we make material changes, we will provide prominent notice, such as notifying you in the Services or by email, where appropriate. Your continued use of the Services after changes take effect constitutes your acceptance of the revised policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at:

This Privacy Policy was effective as of 1 January 2025.