Professional Privacy Notice

1. Who we are

IA Systems, based in Dubai, United Arab Emirates, operates AccountHouse Advisors and decides how the personal data in this notice is used (“we”, “us”).

It covers anyone who signs up for, or is invited to, an AccountHouse Advisors account. Households’ data — including what a household shares with a professional — is covered by the AccountHouse Privacy Policy.

If you only browse the directory, you need no account and we set no cookies. Like any website, our servers see your IP address, and we count requests from it for up to a day so that repeated requests can be limited.

2. What we collect

Your account

• Your email address and the name you choose to show.
• Your password, kept only as a hash, and your two-step settings: an authenticator app’s secret, kept encrypted, and recovery codes, kept only as hashes.
• Sign-in records: when you sign in and out, from which IP address and approximate location (worked out on our own servers from a local database), which browser and device, and failed attempts.
• Your sessions, so you can see and end them under Security.

Signing up

• The kind of work you do, your country and, for a firm, its name.
• The code that confirms your email address, kept only as a hash.
• A record that you accepted the Professional Terms and this notice: which versions, when, and from which IP address and browser.

Your application

• Your legal name, the work you do, the countries you practise in, a phone number if you give one, and anything you write to our reviewers.
• Each licence or registration you list: the regulator, its number, and its issue and expiry dates.
• The documents you upload — such as your passport or national ID, licence certificates and, for a firm, its trade licence: the file itself, its name, type and size, and a fingerprint (a SHA-256 hash) of its contents.
• Our reviewers’ findings: what they checked, the outcome, when and by whom, when it expires, and notes they keep for themselves.

Firms

• A firm’s name, legal name, country, registration number, regulatory details and website.
• Who belongs to the firm and in which role, and the email address and role of each colleague a firm admin invites.

Your public profile

• What you write for your profile: a headline, a description, the kind of work you do, your specialisations, services and the clients you work with, your years of experience, the countries you work in, your languages, how you meet clients, and how you charge, with a fee range and a note if you give them.
• Who can find it, its address on the site, and your connect code.
• For a firm, the page its admins write: a headline, a description, services, countries and languages, and who can find it.
• If we hide a profile or a firm’s page: when, by whom, and the reason, which we show you.

Your work with clients

• What you do with a client’s data: each part of their figures you open (counted by the hour), each file you download and each review you complete, with when and by whom.
• The reviews you complete: a copy of the client’s figures at that moment, kept encrypted, and any note you add.
• The messages, notes, recommendations and meetings between you and your clients — for a meeting, when, how, where or the video link, and what it is about — all kept encrypted.
• The changes you make to a client’s assets, when they allow it: what each asset was before and after, kept encrypted, which the household can undo. These belong to the household’s records and are deleted with its account.
• The plans you make, for a client or from a blank page: each version’s inputs and results and, for a plan started from a client’s figures, a copy of what was used with its date, all kept encrypted; and a client’s answer to a plan you shared, with any note.
• Your forms: their questions and published versions, the registration links you make (how many times each was used), the addresses you send questions to (encrypted), and the answers you receive (encrypted).

3. How we use it

• To run your account — signing in, two-step verification, sessions, password reset, and the emails these need. This is necessary for our agreement with you.
• To verify you — checking your identity and credentials before households can work with you, and again when they expire. This is necessary for our agreement with you, and in our and households’ legitimate interest in only presenting professionals who are who they say they are.
• To show your profile — publishing the profile and firm page you choose to publish, to the people you choose. This is necessary for our agreement with you.
• To let you work with clients — showing you the figures a household lets you see, keeping your messages, notes, recommendations, plans and meetings, sending the reminders and notices they need, and telling the household what you did with its data. This is necessary for our agreement with you, and households have a legitimate interest in knowing who saw their data.
• To keep the service safe — limiting repeated requests, alerting you to new sign-ins and to repeated failed ones, and investigating misuse. This is in our legitimate interest.
• To meet our legal obligations, and to establish or defend legal claims.

We do not sell your data and we do not use it for advertising.

4. Where it comes from

Most of it comes from you. We also look you up in the public registers of the regulators you name — for example SEBI, IRDAI and PFRDA in India; the Capital Market Authority, the Central Bank, the DFSA, the FSRA and the Federal Tax Authority in the UAE; and the SEC’s Investment Adviser Public Disclosure, FINRA BrokerCheck, NMLS Consumer Access and state boards in the United States — and record what we found. A firm admin who invites you gives us your email address and your role.

5. Who can see it

• Our verification team — the AccountHouse staff who review applications. Every time one of them opens a document of yours, it is recorded in our audit log.
• Your firm — its firm admins see your name, email address, role and whether you are verified. Its admins and compliance staff also see the firm’s clients you lead or work on, what each allowed, and what you opened, downloaded, reviewed or changed — never the clients’ data.
• Your clients — a household’s owner sees your name, firm and badges, what you can see, each part you opened, each file you downloaded and each review you completed, and the messages, meetings and recommendations between you, the plans you share with them (the version you share), the questions you send them, and the notes you share with them. Colleagues assigned to the same client see your notes for the team and the plans you share with the client. A form you share with your firm can be used by its people who take on clients; the answers each one receives are theirs.
• Anyone — a profile you publish and list in the directory, and a firm’s public page, can be read by anyone and found by search engines, with your current badges. A profile you keep to your connect code is seen by whoever has the code, and one you show on your firm’s page only, by visitors to that page. Nobody outside AccountHouse sees your documents, your licence numbers or our reviewers’ notes.

We use the following providers to run AccountHouse Advisors, each processing data under our instructions and only for the purpose named:

• Google Cloud — hosting, the database and file storage.
• Vercel — serving the AccountHouse Advisors website.
• Mailgun (EU region) — email delivery.
• Redis Cloud (Redis Ltd., on Amazon Web Services in the United States) — a temporary store for request counters, some kept for each IP address or email address, so that repeated attempts can be limited.

Some of these providers process data outside the country you live in, including in the European Union and the United States, under their agreements with us. We may also disclose information if the law requires it, or to protect households, you or the service against fraud or abuse.

6. How long we keep it

We keep your account, your application, your documents and our checks for as long as your account is open.

When you ask us to delete your account, we delete it and everything listed above that belongs to it — your sign-in records and sessions, your application, documents, credentials and our checks — and remove you from any firm. A firm you applied for keeps its own application. We keep the record that you accepted our documents, because it shows what was agreed.

When you unpublish your profile or a firm’s page, or we hide it, it stops being shown at once; search engines may take a while to drop their copies. Your profile is deleted with your account.

Your work with a client — your messages, notes, recommendations, plans and meeting records — stays with you, read-only, after the relationship ends. When it ends, the client’s own words are no longer shown to you, and the copies of their figures kept for your reviews and plans are deleted; a plan keeps the inputs you chose for it. If the household deletes its account, its words are deleted too. The record of what you did with a client’s data stays with the household while it has an account. A plan you never shared can be deleted at any time while it can still be changed.

If you stop working on a client while the relationship goes on — you leave your firm, a firm admin removes you, or you are taken off the client — your access to that client ends at once. What you wrote in the client’s workspace (notes, messages, meetings and recommendations) stays with the relationship; the plans you made stay with you, read-only, without the copies of the client’s figures or the client’s words; and the client’s answers to your questions are no longer shown to you.

A form nobody has answered can be deleted; one that has answers can be archived, and its answers stay with your account. Answers from someone you emailed stay with your account; a client’s answers are no longer shown to you once the relationship ends, and are deleted with the household.

Request counters expire on their own within a day. Copies in our database backups expire with those backups.

7. Your rights

You can see and correct most of this yourself: your application in your workspace, and your sessions and sign-in history under Security. To get a copy of your data, have it corrected or deleted, or object to how we use it, email support@theaccounthouse.com from the address on your account. We answer usually within one business day. You can also complain to the data protection authority where you live or work.

8. Security

• Passwords are kept only as hashes, authenticator secrets are encrypted, and sign-in codes and links are kept only as hashes.
• Your session lives in a cookie that page scripts cannot read and that only the AccountHouse Advisors site receives.
• Documents are only ever downloaded, never shown inside a page, and only by you and our verification team.
• Sensitive actions ask for a code from your authenticator app, including opening or downloading a client’s figures (a code counts for 15 minutes).
• Messages, notes, recommendations, plans, meeting details and copies of a client’s figures are stored encrypted.

9. Cookies and browser storage

AccountHouse Advisors uses cookies and browser storage only to sign you in and keep you signed in safely. It uses no advertising, analytics or tracking cookies, which is why there is no cookie banner.

• Session cookie (__Host-ah_pro_session) — your professional session. Page scripts cannot read it, only the AccountHouse Advisors site receives it, and it is cleared when you sign out.
• Security token (ah_pro_csrf_token, browser storage) — stops other sites from making requests in your name.
• Account summary (ah-pro-auth, browser storage) — your name and email address, so the workspace can show them while it loads.
• Installation identifier (accounthouse_installation_id) — a random value, kept for up to a year, that recognises the same browser across the AccountHouse sites, for security. It is not used for advertising or analytics.

The household area of the same site (where households see the professionals they work with) uses the AccountHouse sign-in and storage described in the AccountHouse Privacy Policy. Clearing this site’s data in your browser signs you out.

10. Changes to this notice

We publish each version here with its effective date. A change to what we do with your data takes effect no sooner than five days after it is published, and we email you about it.

11. Contact

Questions about this notice or your data: support@theaccounthouse.com. We answer usually within one business day.