Privacy Notice

1. Who is responsible for your data

Ledger is operated by Garison Bonnici - Trumpet, based in Malta, which acts as the data controller for the personal data described in this notice.

2. What we collect and why

• Account data — your name, email address and login credentials, used to create and secure your account (legal basis: performance of our contract with you).
• Your content — the transactions, receipts, invoices, gigs, lessons, salary entries, accounts, goals and other records you add, used solely to provide the service to you (legal basis: contract).
• Connected services data — if you connect Google Calendar or Gmail, the events and messages you choose to import (legal basis: your consent, which you can withdraw by disconnecting).
• Usage and technical data — device identifiers, IP address and basic usage/telemetry, used for security, fraud prevention and improving the product (legal basis: legitimate interests).
• Support messages — anything you send us when asking for help, used to respond to you (legal basis: legitimate interests).

Payment data (card numbers, billing details) is collected and processed directly by Stripe when you subscribe; we never see or store your card details.

3. Who we share data with

• Service providers / subprocessors — hosting, database and infrastructure providers that run Ledger.
• Stripe — our payment processor, for subscription payments, tax calculation and invoicing.
• Google — only when you explicitly connect Calendar or Gmail.
• Professional advisers — legal or accounting advisers where needed.
• Authorities — where required by law.

Where data is transferred outside the EU/EEA, it is protected by appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

4. How long we keep data

We keep your data for as long as your account exists. If your subscription ends, your account becomes read-only and your records are kept for a reasonable period so you can export them. Data that is no longer needed is deleted or anonymised.

5. Your rights (GDPR)

Because we are established in Malta, you have the right to:

• Access, rectify or erase your personal data;
• Restrict or object to processing, and withdraw consent at any time;
• Data portability (receive your data in a reusable format);
• Lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC) in Malta or your local supervisory authority.

To exercise any right, contact us at garison.trumpet@gmail.com. We respond within one month.

6. Security

We use appropriate technical and organisational measures, including encryption in transit and at rest, row-level access controls so only you can read your records, and restricted access to production systems.

7. Cookies

Ledger uses essential cookies and local storage only — to keep you signed in and remember your preferences. We do not use marketing or third-party advertising cookies.