Privacy Policy

1. The short version

No amounts from your clients' books, and none of your financial statements, ever leave your computer. Statra stores your work in a file on your own machine, and we cannot see it.

Three things can leave your machine, each described below:

• AI mapping sends account names, group names, whether each balance is a debit, a credit or nil, and examples of your past corrections to Google to suggest classifications. You can switch it off.
• Licence checks send your licence key and a one-way device identifier to our licence server.
• Issue reports and feedback are sent only when you press send.

Account names often name real people and businesses. If a client's account names must not leave your machine, switch AI mapping off before working on that client.

2. Who is responsible for what

You are responsible for your clients' information, held under your professional duty of confidentiality and the Individual Privacy Act 2075.

We are responsible for the information Statra sends to us, and to Google on our account, as set out in sections 4 to 8.

3. What stays on your machine

Everything in this list stays on your machine, except where sections 5 and 6 say otherwise:

• trial balances, including every amount, account name, code and group
• client names, fiscal years and engagement details
• account mappings and the reasons for them
• correction memory, meaning everything Statra learns from your corrections
• prior year balances
• financial statements, and the Excel and PDF files you export

Everything except exported files is held in a database file in your Windows application data folder. Settings shows the exact path, under Data.

4. What our licence server receives

When we issue a licence, we record the name, email address and firm you give us, the plan, and the dates of the term.

When you activate Statra, it sends:

• your licence key
• a device identifier, which is a one-way hash of a Windows machine identifier. We never receive the original value and cannot reverse the hash
• the name you enter, the label you give this computer, the Statra version and your operating system
• the version of the Terms of Use, this Privacy Policy and the Refund Policy you accepted

Each time Statra checks your licence afterwards, it sends only your licence key and the same device identifier. When you release a device from Settings, it sends the same two, and we delete that device's record.

We record the time of each check, so we can show how many devices are in use and help when something goes wrong.

Our server uses the IP address of each request to limit abuse, and our hosting provider records it in its logs. We do not store IP addresses with your licence record. No client data, account name or amount is ever sent with a licence check.

5. AI mapping and Google

When AI mapping is on, Statra sends Google's Vertex AI service:

• the names of the accounts it is asking about
• their Tally group names
• whether each balance is a debit, a credit or nil
• up to 25 examples of your past corrections, so the suggestions follow your own choices. Examples from other clients are sent without their account names

It never sends amounts, client names, fiscal years, or anything else identifying the engagement. Whether a balance is a debit, a credit or nil is the only thing it sends about a balance.

Requests go to Google under our Google Cloud account. Google states that it does not use them to train or fine-tune its models. Google may log requests to detect abuse of its service, and may hold them briefly in memory to speed up responses.

We store neither the requests nor the responses on any server of ours. When AI mapping is off, nothing is sent to Google. You can switch it off in Settings, under AI mapping.

6. Issue reports and feedback

When you use Report an issue or Send feedback and press send, Statra sends:

• whether it is an issue report or feedback
• what you typed
• a screenshot, only if you attach one
• which screen you were on
• the Statra version and your operating system
• your licence key, so we know who to reply to
• the one-way device identifier described in section 4, so we can confirm the report comes from a licensed device

A screenshot can show client data. We use it only to deal with your report. Nothing is sent until you press send.

7. Our website and email

Our website has no accounts and no registration form, so there is nothing to sign up for and nothing to sign in to. The one form on it is the founding member application, and section 8 sets out what we receive from someone who applies.

When you email us, your message passes through our email providers. When you message us on WhatsApp, your message passes through WhatsApp, which Meta runs. Please do not send client financial data on WhatsApp. Our website uses no advertising or tracking cookies.

8. Founding member applications

When you apply for founding member early access on our website, we receive what you enter in the application form:

• your practice type, and what you type if you choose Other
• your full name
• your ICAN membership number, if you give one, which we check against ICAN's published list of members
• your firm or office name, if you give one
• your city or district
• your email address
• your mobile number for WhatsApp
• whether the computers you would use run Windows
• how many clients' financial statements you prepare in a year, how many computers would use Statra, and what your clients' books are usually kept in
• what takes the most time in your statement work today, if you tell us
• that you ticked the consent box, and the time you submitted

We also record the browser identification string sent with the form, so we can tell a real application from an automated one. Our website uses the IP address of each submission to limit abuse and does not store it with your application.

We use all of this to assess founding member applications and to contact you about your application and your early access. We use it for nothing else.

Applications are stored in a database held with Cloudflare, who host our website. Each application is also emailed to Aaditya Nepal through Cloudflare's email service, and read in Gmail.

Only Aaditya Nepal sees your application. We never share it or sell it to anyone.

We keep an application for 12 months after we reply to it. If you become a founding member, we keep it until 12 months after your licence ends, which is how long we keep the record of a free licence under section 11. We delete it sooner if you ask.

To ask what we hold about your application, to have it corrected, or to have it deleted, write to support@statranepal.com.

Please do not enter anything about your clients in this form. We do not ask for it and we do not want it.

9. What we never collect

• your trial balances or any amount in them
• your clients' names
• your financial statements or anything you export
• usage tracking of any kind. Statra contains no analytics and no telemetry
• your Windows username, your file paths, or the contents of any folder

10. Why we collect it, and your consent

We collect only what we need to issue and check your licence, answer your reports, assess founding member applications, and run AI mapping when you use it. We use it for nothing else.

You consent when you accept at activation. Each issue report or feedback you send is a separate consent. You can withdraw consent by switching AI mapping off, or by asking us to delete your licence record (section 12).

11. Where it is stored and for how long

Our licence server and its database are hosted with Render and Neon, on servers outside Nepal. AI mapping requests are processed by Google.

• Licence records for paid licences: kept while the licence is active, then for as long as Nepali tax law requires us to keep records of the sale.
• Licence records for free licences: deleted 12 months after the licence ends, unless you buy a licence.
• Issue reports and screenshots: deleted within 30 days of the issue being resolved.
• Support emails: kept while we are helping you, and for up to 12 months after.

12. Your rights

You can ask us what we hold about you, ask us to correct it, or ask us to delete it. Write to support@statranepal.com.

Deleting your licence record stops your licence working, so we will confirm with you before doing it.

Everything on your own machine is under your control. Statra never deletes it and we cannot reach it.

13. Security, stated honestly

The database on your machine is not encrypted by Statra. It is protected by your Windows user account and by whatever disk encryption you use.

We recommend enabling BitLocker on any machine holding client data, and including the Statra database in your firm's backups. Settings shows you where it is.

Connections to our licence server and to Google are encrypted. Responses from our licence server are cryptographically signed, so Statra can verify they genuinely came from us.

We are one developer, not a security team. We have done what we reasonably can, and we have told you where the limits are.

14. Third parties

These services are involved in running Statra:

• Google Vertex AI processes AI mapping requests, only when AI mapping is on.
• Google sign-in authorises those requests. It receives no client data.
• Render and Neon host our licence server and its database.
• Cloudflare hosts our website, holds founding member applications, and carries email to and from our domain.
• Gmail, from Google, is where we read support email.
• WhatsApp, from Meta, carries messages you send us there.

We do not sell or rent your information, and we do not share it with anyone outside this list.

15. Changes to this policy

If we change what Statra collects or where it sends it, we will update this policy and the date at the top. Statra will ask you to accept the new version before anything new is sent.

16. Contact

Aaditya Nepal

Kathmandu, Nepal

support@statranepal.com