Privacy Policy

Last Updated: April 11, 2026

Accrew ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered bookkeeping services.

1. Personal Data We Collect

1.1 Client Information

Name, email address, phone number, WhatsApp contact
Company name, business registration number, Hong Kong address
Bank account details for reconciliation purposes
Hong Kong ID or passport (for identity verification)

1.2 Financial Data

Bank statements, credit card statements
Invoices, receipts, expense records
Transaction data (date, amount, merchant, description)
Tax documents (MPF records, IRD filings, profit tax returns)
Financial statements (P&L, Balance Sheet, Cash Flow)

1.3 Technical Data

IP address, browser type, device information
Usage data (pages visited, time spent, features used)
Cookies and similar tracking technologies

1.4 AI Training Data

Transaction categorization corrections (only with your consent)
Anonymized financial patterns for AI model improvement

2. How We Use Your Personal Data

2.1 Service Delivery

Bookkeeping, reconciliation, financial reporting
AI-powered transaction categorization and insights
MPF administration and tax return preparation
CFO advisory and strategic planning

2.2 Legal Compliance

Compliance with Hong Kong Inland Revenue Department (IRD) requirements
Anti-money laundering (AML) and counter-terrorist financing (CTF) checks
Response to lawful requests from regulatory authorities

2.3 AI Model Improvement

Important: We use AI to categorize transactions and generate insights. We may use anonymized transaction data to improve our AI models, but only with your explicit consent. You can opt out at any time.

3. Legal Basis for Processing (PDPO Compliance)

We process your personal data under the following lawful bases as permitted by Hong Kong's Personal Data (Privacy) Ordinance (PDPO):

Contractual necessity: To provide bookkeeping services you've engaged us for
Legal obligation: To comply with IRD, HKMA, and other regulatory requirements
Legitimate interests: To improve our AI services and prevent fraud
Consent: For marketing communications and AI training (you may withdraw anytime)

4. Data Retention

Financial records: Minimum 7 years (IRD requirement)
Tax documents: 7 years from date of filing
Client contracts: 7 years after termination
Marketing data: Until you unsubscribe or request deletion

5. Data Sharing and Disclosure

5.1 Third-Party Service Providers

We may share your data with:

Xero, QuickBooks: Cloud accounting software (data hosting)
Google Workspace: Email and document storage
Calendly: Appointment scheduling
AI service providers: For transaction categorization (anonymized where possible)

5.2 Legal Disclosures

We may disclose your data to:

Hong Kong Inland Revenue Department (IRD)
Law enforcement agencies (with valid legal request)
Professional indemnity insurers (in case of claims)

5.3 No Sale of Data

We never sell your personal or financial data to third parties.

6. International Data Transfers

Some of our service providers (e.g., cloud hosting, AI platforms) may store data outside Hong Kong. We ensure adequate safeguards through:

Standard contractual clauses approved by PCPD
Data processing agreements with all vendors
Encryption in transit and at rest

Note: We do not transfer personal data to Mainland China without your explicit consent.

7. Data Security

We implement industry-standard security measures:

Encryption: AES-256 encryption at rest, TLS 1.3 in transit
Access controls: Multi-factor authentication, role-based access
Regular audits: Annual security assessments and penetration testing
Employee training: All staff undergo data protection training

8. Your Rights Under PDPO

You have the right to:

Access: Request a copy of your personal data (within 40 days)
Correction: Request correction of inaccurate data
Erasure: Request deletion of data (subject to legal retention requirements)
Data portability: Request transfer of data to another provider
Object to processing: Opt out of AI training or marketing
Withdraw consent: For consent-based processing (e.g., marketing)

To exercise your rights: Email us at privacy@accrew.ai with "Data Request" in the subject line.

9. Data Breach Notification

In the unlikely event of a data breach affecting your personal data, we will:

Notify you within 72 hours of discovery
Report to the Office of the Privacy Commissioner for Personal Data (PCPD)
Provide details of the breach and steps to mitigate harm

10. AI-Specific Disclosures

10.1 How AI Processes Your Data

Our AI systems:

Categorize transactions based on merchant name, amount, and description
Generate financial insights (e.g., spending trends, budget variance)
Provide confidence scores for each categorization

10.2 Human Oversight

All AI outputs are reviewed by our accounting team before finalization. You should review AI categorizations before using them for tax filing or critical decisions.

10.3 AI Training Opt-Out

By default, we do NOT use your data to train AI models. If you consent to help improve our AI, you can withdraw consent anytime by emailing hello@accrew.ai.

11. Cookies and Tracking

We use cookies to:

Remember your login session
Analyze website traffic (Google Analytics)
Improve user experience

You can disable cookies in your browser settings, but some features may not work.

12. Children's Privacy

Our services are not intended for individuals under 18. We do not knowingly collect data from minors.

13. Changes to This Policy

We may update this Privacy Policy to reflect legal or service changes. We will notify you via email at least 30 days before changes take effect.

14. Contact Us

For privacy questions or to exercise your rights:

Email: privacy@accrew.ai

15. Complaints

If you believe we have mishandled your personal data, you may file a complaint with:

Office of the Privacy Commissioner for Personal Data (PCPD)
Website: www.pcpd.org.hk
Enquiry Hotline: +852 2827 2827

Back to Home | Terms of Service