Effective 16 October 2026

Data Storage Terms

These terms describe how TimeIsMoney, operated by Rabbi Mehedi Ullah in Bangladesh, stores and deletes data. They form part of the agreement between you and us, together with the Terms and the Privacy Policy. Where you store other people’s details, you are the controller and we process that data on your instructions.

These legal pages are published in English and Bangla. If the two versions differ, the English version controls. That includes visitors using French or Spanish on the rest of the site.

What we store

Account: name, email, password hash, role, plan, language, appearance, currency, voice-log count, an optional advisor brief, and the time you accepted these terms.

Books you create: cash movements (with the original amount and rate when you paid in another currency), accounts, costs, dues, cards, deposits, projects, businesses, clients, invoices, quotes, notes, and logo files. A cash movement can store a location only if you add one. We do not use that location for advertising.

Advisor topics: title, the text of each turn, the reply, and a small amount of structured detail such as a suggested move. Audio clips are processed and then discarded. They are not written into the database. Saved suggestions you chose to keep: title, reply, and steps.

Access and payments: early-access requests, and plan payments you submit (amount, method, and, until the account is deleted or the review is finished, payer phone and transaction reference).

Technical: an encrypted session cookie so you stay signed in, a language preference, and security logs such as sign-in throttling. We do not use advertising or analytics cookies. An invite or campaign link sets one small cookie, for up to 30 days, holding only the invite code or campaign name.

Where it lives

We operate from Bangladesh. The application database and private files are stored on the hosting we use to run TimeIsMoney. Email delivery may use a separate provider. A voice or advisor turn is also sent to OpenAI’s API for transcription and a draft reply, then the audio is discarded on our side.

We do not sell personal data, and we do not use your books, voice, or topics to train our own or public models. We do not opt in to a provider setting that would use API content for model training.

How it is protected

Passwords are hashed. Sessions are encrypted. Logo files for new uploads are stored on a private disk and are shown only to someone signed in who is allowed to see that record. Each book is limited to the people who belong to that workspace.

In production the service is meant to be used over HTTPS. On an HTTPS production site, the session cookie is marked secure.

You must keep your password confidential. Tell us if you believe someone else is using your account.

How long we keep it

Account, books, brief, and advisor topics: until you delete the topic or the account, or until we close the account under the Terms. Deleting a topic deletes its messages. Saved suggestions: until you remove them or delete the account. Audio is not retained after the turn.

Sessions: until you sign out, or until the session expires (120 minutes of inactivity, unless you choose remember-me).

Password reset links: until they expire or are used. The link itself is not stored in plain text.

Early-access requests: until the request is decided, and then for up to 24 months, unless you delete an account that uses the same email, in which case we delete the request.

Security logs: up to 12 months, unless we need a particular record for a longer period to investigate abuse or answer a legal claim.

Payment reviews: the amount, date, plan, and method may be kept for up to 6 years for accounting. Name, email, phone, IP address, and transaction id are removed when the account is deleted.

Deletion

Profile includes Delete account. You must enter your password. We then delete your user, your personal workspace, the finance records in books you own, your logo files, your sessions, your advisor brief, your advisor topics and messages, your saved suggestions, and early-access requests for your email.

If you were invited to someone else’s project, that project stays. Entries you logged there remain part of the owner’s book, and your user id is removed from them.

Backups, if the host keeps them, roll off on the host’s backup cycle. We do not use deleted accounts for any other purpose.

Other people’s data

Client details, seat emails, and business records you add are processed so we can provide the features you asked for. You must have a lawful reason to enter that data and, where required, have given those people notice.

You can export cash activity from the app. You can correct or delete records inside the product. If you need a copy or deletion we cannot do from the screen, contact us.

International transfers

If hosting, email, or OpenAI processing happens outside your country, that is a transfer. Voice and advisor content is transferred to OpenAI to produce that turn. Where the GDPR, Swiss law, or UK GDPR requires a safeguard for a transfer out of the EEA, Switzerland, or the UK, we rely on the provider’s standard contractual clauses or another lawful mechanism.

You are responsible for using the service lawfully where you live. Mandatory privacy and consumer rights in your country still apply.

Incidents

If we learn of a breach of personal data that is likely to result in a risk to you, we will tell you without undue delay and describe what happened and what you can do. Where the GDPR applies, we will notify the supervisory authority within 72 hours of becoming aware, unless the breach is unlikely to result in a risk.

Contact

Write from the email on your account. We may ask you to confirm it is you before we act. We answer within 30 days, or sooner where the law requires it.