EFFECTIVE 28 AUGUST 2026

Privacy Notice

This notice explains how Timastra LLC processes information through Timastra Expenses to provide secure, organization-isolated project-fund and liquidation workspaces.

Information processed

We process account and organization details, workspace roles, project and deposit records, expense and supplier information, receipt files, audit events, security logs, subscription identifiers, and messages needed for verification, invitations, and account recovery.

Why it is processed

Information is used to authenticate users, provide requested features, isolate tenant data, generate reports, secure and troubleshoot the service, prevent abuse, communicate account events, administer subscriptions, and meet legal obligations.

Sharing and service providers

Information may be handled by infrastructure, email-delivery, payment, monitoring, and backup providers acting on our instructions. Payment-card details are processed by the payment provider and are not stored in Timastra Expenses. We may disclose information when legally required or to protect users and the service.

Current service-provider categories: VPS hosting provider, Resend, Stripe.

Retention and security

Production data is hosted in Philippines. Workspace data is retained while the service is provided and for up to 365 days afterward unless a longer legal hold applies. Backup copies age out under the same documented schedule. Timastra Expenses uses role-based access, tenant-scoped queries, encrypted transport in production, password hashing, session controls, and audit logging. No system can guarantee absolute security.

Your choices

Workspace administrators can manage members and records. Depending on applicable law, individuals may request access, correction, deletion, restriction, or portability through the organization that controls their workspace or by contacting [email protected].

International processing and updates

Service providers may process data where they operate, subject to applicable safeguards. Material changes to this notice should be communicated and a new policy version recorded when users accept them.

Privacy requests are verified before fulfillment. Legal retention, fraud prevention, accounting, and security obligations may limit or delay deletion of particular records.