Privacy Policy
How NewLedger collects, uses, and handles account, usage, authorization, and connected-app data across the Service, including App Connect, OAuth, MCP, and API-based workflows.
Last updated
9 September 2026
Privacy framework
Singapore PDPA · other laws as applicable
DPO contact
dpo@newledger.io
1. Introduction
This Privacy Policy explains how Nexara Global Pte. Ltd., which operates NewLedger ("NewLedger," "we," "us"), collects, uses, discloses, and protects personal data when you visit our websites, create an account, use our accounting platform, APIs, OAuth or MCP integrations, or contact us (collectively, the "Service").
This Policy is a privacy notice, not a request for blanket consent or part of our contractual Terms of Service. Where consent is required by applicable law, we request it separately and you may withdraw it as described at the time of collection.
NewLedger acts as an organisation or controller for account administration, billing, website, security, support, and business operations. For personal data contained in accounting records that a customer submits and controls, NewLedger generally acts as a data intermediary or processor on that customer's behalf. The customer is responsible for its collection and use of that data; our processing may also be governed by a data processing agreement.
2. Information We Collect
The data we handle depends on the features, integrations, and deployment you use. We receive data directly from you and workspace users, automatically from use of the Service, from customers that administer your access, and from services you connect. It may include:
Account & business information
Accounting & transactional data
Customer records: Customers, suppliers, employees and other counterparties; invoices, bills, quotations, payments, expenses, journals, bank and reconciliation records, tax information, reports, projects, attachments, and notes.
Subscription data: Plan, billing status, payment history, invoices, and receipts. Full payment-card details are handled by our payment provider and are not stored by NewLedger.
Usage, device & support data
Technical data: IP address, device and browser information, timestamps, pages and features used, diagnostic events, security logs, and cookie or similar identifiers.
Communications: Support requests, trust and sales enquiries, feedback, and related correspondence or attachments.
Connected Apps, OAuth, and MCP
Authorization Data: OAuth consent decisions, connected app identifiers, requested scopes, access status, and connection metadata used to provide and secure App Connect, MCP, API, and similar integrations.
Activity Data: Tool calls, requested actions, timestamps, account identifiers, audit events, and related metadata generated when a connected app, automation, AI-enabled client, or MCP client interacts with the Service.
Cookies & Tracking
We use necessary cookies to operate the Service and, where permitted or consented to, analytics, functionality, and marketing technologies. You can use any available consent controls and your browser settings to manage them.
We do not exchange personal data for monetary payment. Where permitted or consented to, analytics and marketing providers may receive identifiers or usage data as described in this Policy and in any available consent settings.
3. How We Use Your Information
4. Legal Basis
- Perform a contract or take requested pre-contract steps
- Legitimate interests that are not overridden by individual rights
- Consent, where required and separately requested
- Legal obligations and other grounds available under applicable law
5. Sharing
- Hosting, security, communications, support, analytics, and professional service providers
- Payment providers and financial institutions where you use payment features
- Authorities, advisers, or other parties where required by law or to protect rights and security
- Customer-authorised connected apps and workspace users
- Parties to a merger, financing, acquisition, or transfer of all or part of our business
5A. Connected Apps, AI Clients, and MCP Access
If you authorize a third-party application, AI-enabled client, Model Context Protocol ("MCP") client, automation tool, or other connected system, we may share the account data, accounting records, reports, tools, and metadata covered by the scopes or permissions you approve. The connected system's own terms and privacy policy apply to its handling of data after receipt. The workspace administrator is responsible for reviewing requested scopes and deciding whether to authorise the connection. NewLedger does not use Customer Data to train general-purpose AI models. A connected AI client may process data it receives under its own terms.
We use OAuth consent records, scopes, tool-call activity, timestamps, and audit metadata to provide the integration, enforce access boundaries, support security reviews, troubleshoot issues, and help administrators understand what connected systems accessed or requested.
You can revoke connected access where supported in the Service or by contacting us. Revocation stops future access through NewLedger, but it may not delete or retrieve data that a third-party connected system already received under your prior authorization.
6. International Transfers
NewLedger and its service providers may process personal data outside your country. NewLedger operates infrastructure in Singapore, Belgium, and Iowa. Placement of supported Customer Data in that infrastructure does not necessarily include account administration, support communications, security telemetry, integrations, or service-provider operations. Where applicable law requires transfer safeguards, we use appropriate measures designed to provide a comparable level of protection, which may include contractual protections, transfer assessments, and the European Commission's Standard Contractual Clauses where applicable.
7. Data Security
We use technical and organisational measures designed to protect personal data, including encryption, access controls, logging, monitoring, backups, and documented incident-response processes appropriate to the Service and deployment. No system is completely secure. You are responsible for protecting credentials, configuring permissions, and notifying us promptly of suspected unauthorised access. Additional current control information is available on our Security & Trust page.
8. Data Retention
We retain personal data for as long as reasonably needed to provide the Service, maintain security and audit records, resolve disputes, enforce agreements, and meet legal, tax, accounting, and regulatory requirements. Retention depends on the data type, purpose, sensitivity, customer instructions, and applicable law. After account closure or a valid deletion request, we delete or anonymise data when no longer required. Residual copies may remain in protected backups until overwritten under our backup schedule, and we may retain limited records where a legal or legitimate business requirement applies.
9. Your Privacy Rights
Depending on your location, our role, and applicable law, some or all of the following rights may apply to you, as well as the right to withdraw consent and complain to a data protection authority. These rights are not available in every jurisdiction and are subject to legal exceptions.
Rights that may apply
To make a request, contact dpo@newledger.io. We may verify your identity and authority. If NewLedger processes the relevant data solely for a customer, we may refer the request to that customer. We will respond within the period required by applicable law.
10. Children's Privacy
The Service is intended for business use and is not directed to children. We do not knowingly create accounts for individuals under 18. Customer Data may contain information about minors where a business customer lawfully submits it; in that situation we process it on the customer's instructions.
11. Cookies
- Essential: Core functionality
- Performance: Usage analytics, where permitted
- Functionality: Preference memory
- Targeting: Marketing, where enabled and with any consent required by law
12. Changes to This Policy
We may update this Policy to reflect changes to the Service, our practices, or applicable law. We will post the revised Policy with a new effective date and provide additional notice of material changes where appropriate or required. If a change requires consent, we will request it separately.
13. Questions and Complaints
Contact our Data Protection Officer with questions or complaints. We will investigate and respond in accordance with applicable law. This Policy does not limit any right to contact a competent data protection authority.
14. Language
This Privacy Policy is provided in English. If it is translated into other languages, the English version shall prevail in the event of any inconsistency.
15. Contact Us
Official Registered Office
Nexara Global Pte. Ltd.68 Circular Road, #02-01
Singapore, 049422
DPO Contact
dpo@newledger.io