ISOERP Privacy Policy

nrerp.khanwco.net · operated by Khan Waheed & Co. Chartered Accountants

1. Who we are

ISOERP is a software service provided to businesses and their staff by Khan Waheed & Co. Chartered Accountants ("we", "us").

Khan Waheed & Co. Chartered Accountants
Islamabad, Pakistan · khanwco.net
Email: [email protected] · Product support: [email protected]

2. Our role

For the business data your organisation puts into ISOERP, your organisation is the controller and we act as its processor: we handle that data only to provide the service on your organisation's instructions. For account and billing information about our own customers, we act as controller.

3. Data we collect

• Account data: name, email address, phone number, role and sign-in records of each user.
• Organisation data: firm or company name and settings, users and permissions.
• Customer content: accounting records, invoices, vouchers, inventory, customers, suppliers, employees, contacts, tasks and other business records entered or imported by the customer.
• Messages: if your organisation connects WhatsApp, the messages users exchange with our WhatsApp assistant.
• Usage and security logs: technical logs such as IP address, browser, pages and actions, and AI usage counts, used to run, secure and support the service.
• Billing data: plan and payment status. Card details are entered with our payment processor and are not stored by us.

4. How we use data

To provide, secure and support the service; to sign users in (including one-time codes); to send system emails and notifications; to process payments; and to meet legal obligations. We do not sell personal data and we do not use customer content for advertising.

5. How AI is used

ISOERP includes an in-app assistant and can be connected to external AI assistants such as Claude through our MCP connector, which uses OAuth sign-in. When a user asks the assistant something, the data needed to answer that request is sent to the AI model (Google Gemini) to produce the answer. Assistants act only with the permissions of the signed-in user.

AI never signs, posts to a ledger or submits anything to a government system on its own. Such actions require confirmation by a human user, and this is enforced in the product.

AI model provider. We use Google Gemini through Google's paid Gemini API. Under Google's Gemini API Additional Terms of Service (last modified 28 April 2026), for paid services Google states that it does not use prompts or responses to improve its products, and that it logs prompts and responses for a limited period solely to detect and prevent violations of its policies. See ai.google.dev/gemini-api/terms. These are Google's terms and may change.

No training on your data. We do not train or fine-tune any AI model on customer data.

Claude and other external assistants. If a user connects ISOERP to Claude or another external AI assistant through our MCP connector, the data returned to that assistant is processed by its provider (for Claude, Anthropic) under the user's own account and that provider's terms, not ours.

6. Security

• Each customer organisation's data is kept separate (tenant isolation) and users see only what their role allows (role-based access control).
• Connector sign-in uses OAuth 2.1 with PKCE.
• Data in transit is encrypted with HTTPS/TLS.
• Backups: the service databases and uploaded files are backed up every hour with restic, which stores only changes and encrypts the backup before it leaves our server, to Google Cloud Storage. Hourly copies are kept for 48 hours, then daily, weekly and monthly copies for longer periods. Restores have been tested.

Your own copies. Our backups exist to restore the service, not as an archive for each customer. We recommend that every customer regularly exports its own data and keeps its own copies. Where you connect your own Google Drive (bring your own cloud), ISOERP can create a folder structure in that Drive for your File Cabinet documents; this is file storage in your own account, not a backup of your ERP database.

No system is completely secure; we will inform affected customers of a security incident as required by law.

We do not claim any security certification (such as SOC 2 or ISO 27001).

7. Who we share data with

Only with service providers that help us run ISOERP, under their own terms:

• Contabo – server hosting
• Cloudflare – network protection
• Google – Gemini AI model and Cloud Storage for encrypted backups
• Stripe – payments
• Meta (WhatsApp Business) – only if your organisation uses WhatsApp features

We may also disclose data where required by law.

Where data is stored. Our application server is hosted by Contabo in a data centre in France (European Union). Backups are stored with Google Cloud Storage, and Google (AI), Stripe (payments) and Meta (WhatsApp) may process data in other countries under their own terms.

8. Retention

We keep data for as long as the account is active and as required by law. On termination, the customer can request an export and deletion of its data.

9. Your rights

You may ask to access, correct, export or delete your personal data. If your data was entered by an organisation using ISOERP, please contact that organisation first; we will help it respond. Requests to us: [email protected].

10. Children

ISOERP is a business service and is not intended for children.

11. Changes

We may update this policy. Changes are posted on this page with a new "Last updated" date.