Last updated: October 28, 2026
This Privacy Policy explains how Business Control System, operated by Stone A Tech ("we", "us", "our"), collects, uses, stores, and protects information when you or your organization use our multi-company business management platform (the "Service"), available at erp.stoneatech.com.
Account information: name, email address, and password (stored as an irreversible hash — we never store or can see your plain-text password) when an administrator creates your account.
Business data you enter: company records, client and project details, invoices, quotations, expenses, financial account balances and transaction history, payroll and employee records, loans and repayment schedules, and internal chat messages you or your organization enter into the Service.
Connected third-party messaging data: if your organization chooses to connect a WhatsApp Business or Facebook Page account, we receive and store the messages and comments sent to that account through Meta's platforms, solely so your team can view and respond to them inside the Service.
Usage and technical data: IP address, browser/device information, and action logs (audit trail) recorded automatically for security and accountability, such as who created, edited, or approved a record and when.
Each company record in the Service is a separate data boundary. Users are only shown data for companies they have been explicitly granted access to by a Super Admin or company Administrator. Business data belongs to the organization that entered it; we act as a data processor on that organization's behalf, not as the owner of that data.
The Service includes optional AI features ("Alphonsine", the AI Business Agent, and AI Tutor) powered by Anthropic's Claude API. When you use these features, your questions and relevant business data snapshots (such as revenue, expense, and project summaries) are sent to Anthropic to generate a response. We do not send your full database — only the specific data needed to answer your question. Anthropic's own privacy terms govern how they process this data on our behalf.
We do not sell your data. We share data only with:
We retain data for as long as your organization's account is active, or as needed to comply with legal, accounting, or reporting obligations. You may request deletion of your personal account data at any time — see our Data Deletion page.
Passwords are hashed, not stored in plain text. Access to company data is restricted by our role-and-permission system, and administrative actions are recorded in an audit log. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
Depending on your location, you may have the right to access, correct, export, or request deletion of your personal data. To exercise these rights, contact us using the details below or use our Data Deletion Request form.
The Service is a business tool not directed at children, and we do not knowingly collect information from anyone under 18.
We may update this Privacy Policy from time to time. Material changes will be reflected by the "Last updated" date above.
For privacy questions or requests, contact: contact@stoneatech.com
This document is a general template and does not constitute legal advice. Stone A Tech should have this policy reviewed by a qualified attorney familiar with applicable data protection law before relying on it.