Legal

Privacy Policy

Last updated: 25 August 2026

1. Introduction

ERES (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our accounting software and services (collectively, the “Service”).

This Privacy Policy is designed to comply with the Prevention of Electronic Crimes Act, 2016 (PECA) of Pakistan and other applicable data protection laws. By using our Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Personal Information

We may collect personal information that you voluntarily provide to us when you:

  • Register for an account
  • Use our Service
  • Contact our support team
  • Subscribe to our newsletters
  • Participate in surveys or promotions

This information may include your name, email address, phone number, company name, business registration number (NTN), and billing information.

2.2 Signing In With Google

If you choose “Continue with Google” to create an account or sign in, Google shares a limited profile with us so that we can identify you:

  • Your name
  • Your email address, and whether Google has verified it
  • Your profile picture
  • Your Google account identifier, which we store so that your sign-in keeps working if you later change your email address

We request only the basic openid, email and profile permissions. We have no access to your Gmail, Drive, Contacts, Calendar, Photos or any other Google service, and we never post anything to your Google account. Using Google to sign in is optional — an email address and password works exactly the same way. See section 9 for how to disconnect it.

2.3 Financial Data

As an accounting software provider, we process financial data that you enter into our system, including but not limited to:

  • Transaction records
  • Invoice and payment data
  • Bank account information (if connected)
  • Tax-related information
  • Supplier and client information

2.4 Usage Data

We automatically collect certain information when you visit, use, or navigate our Service. This information does not reveal your specific identity but may include:

  • IP address and browser type
  • Device and operating system information
  • Usage patterns and preferences
  • Log data and error reports
  • The date, time and IP address of your most recent sign-in

2.5 Business Location

When you enter your city — at signup, in company settings, or when an administrator sets it up for you — the field suggests matching cities using Google Places. What you type is sent to Google to produce those suggestions. If you pick one, we store the city name, the province, and the coordinates of that city so we can see which parts of the country our customers are in.

This is a city, not a device location. We do not request or collect GPS or precise location from your browser or phone, and the coordinates we keep are the ones Google publishes for the city itself. You can clear the field at any time in company settings, which removes the stored coordinates with it.

3. How We Use Your Information

We use the information we collect for various purposes, including:

  • Providing and maintaining our Service
  • Processing transactions and generating reports
  • Communicating with you about your account and updates
  • Improving our Service and developing new features
  • Complying with legal obligations, including tax reporting requirements
  • Preventing fraud and ensuring security
  • Verifying who you are when you sign in, including through Google if you have chosen that method
  • Understanding which cities and regions our customers operate in, so we can plan support and rollouts
  • Providing customer support

4. Data Storage and Security

4.1 Data Location

Your data is stored on secure servers located within Pakistan and may also be stored on cloud servers in jurisdictions with adequate data protection standards. We ensure compliance with Pakistani data localization requirements where applicable.

4.2 Security Measures

We implement appropriate technical and organizational security measures to protect your data, including:

  • 256-bit SSL encryption for data transmission
  • Regular security audits and penetration testing
  • Access controls and authentication mechanisms
  • Regular data backups
  • Employee training on data protection

5. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information in the following circumstances:

  • Service Providers: We may share data with trusted third-party service providers who assist us in operating our Service. Section 8 names the ones we use and what each one receives
  • Legal Requirements: We may disclose information if required by law, court order, or governmental authority, including the Federal Board of Revenue (FBR)
  • Business Transfers: In connection with a merger, acquisition, or sale of assets
  • With Your Consent: We may share information with your explicit consent

6. Your Rights Under Pakistani Law

Under Pakistani data protection laws, you have the following rights:

  • Right to Access: You can request copies of your personal data
  • Right to Rectification: You can request correction of inaccurate data
  • Right to Erasure: You can request deletion of your data in certain circumstances
  • Right to Restrict Processing: You can request limitation of data processing
  • Right to Data Portability: You can request transfer of your data
  • Right to Object: You can object to certain types of processing

To exercise these rights, please contact us using the information provided in the “Contact Us” section.

7. Cookies and Tracking Technologies

We use cookies to keep you signed in and to carry out the sign-in process itself. The cookies we set are:

  • Session cookie: identifies you while you are signed in, and expires after 24 hours
  • Sign-in cookies: two short-lived cookies used only while you are signing in or signing up with Google — one to confirm that the request came back to the same browser that started it, and one to carry your verified Google profile to the company setup form. They last ten and thirty minutes respectively

These cookies are strictly necessary: the Service cannot sign you in without them. You can instruct your browser to refuse cookies, but you will not be able to log in. We do not use cookies to advertise to you or to track you across other websites.

8. Third-Party Services

Running the Service means passing some data to companies who provide parts of it. These are the ones we use, and what each receives:

  • Google: sign-in (if you choose it), the city text you type into a city field, map display in our internal console, and reCAPTCHA on the login page to block automated attacks
  • Safepay: subscription payments. Card details are entered on Safepay’s own systems and never reach ours
  • Resend: delivery of account and notification emails
  • ImageKit: storage and delivery of images and files you upload, such as logos and attachments
  • Pusher: live updates within the app, such as notifications
  • WhatsApp Business API: sending invoices and messages to your customers, when you enable it
  • OpenAI or Google Gemini: the AI features, when you use them. Only the records relevant to your request are sent, and only from the company you are working in

We do not sell your data to any of them, and none of them are permitted to use it for their own purposes. Each has its own privacy policy, which we encourage you to read. Our Service may also contain links to third-party websites whose privacy practices we do not control.

9. Google Sign-In and Google User Data

Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

In plain terms, the name, email address, profile picture and account identifier we receive from Google are used for one thing: signing you in and showing who you are inside the Service. We do not use that data for advertising, we do not sell or transfer it, and no human at ERES reads it except where you have asked us for support, where it is needed to investigate abuse or a security problem, or where the law requires it.

You can disconnect ERES from your Google account at any time at myaccount.google.com/permissions. Doing so stops future Google sign-ins; it does not delete your ERES account or your business records. To have those removed, contact us using the details in section 12.

10. Children's Privacy

Our Service is not intended for use by children under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

11. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last updated” date. You are advised to review this Privacy Policy periodically for any changes.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

  • Email: info@eres.cloud
  • Address: Al-fareed market Vehari
  • Phone: +923067622695

You also have the right to lodge a complaint with the National Commission for Personal Data Protection if you believe we have violated your privacy rights.

13. Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of the Islamic Republic of Pakistan. Any disputes arising under this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Vehari, Pakistan.