Privacy Policy

1. Who We Are

ClearFile is a Bahamian business operating the tax compliance platform at clearfile.co. For the purposes of the DPA, ClearFile is the data controller in respect of personal data collected through the Platform.

If you have any questions about this Privacy Policy or about how we handle your data, please contact us at:

2. Data We Collect

2.1 Account and Identity Data

• Full name and business name
• Email address and phone number
• Business Licence number and VAT Tax Identification Number (TIN)
• Mailing address and island of operation
• Login credentials (password stored in hashed, non-recoverable form)

2.2 Financial and Transaction Data

• Sales invoices and purchase receipts uploaded to the Platform
• Transaction amounts, dates, counterparty details, and VAT categories
• Annual business turnover figures where provided
• Customs entry documents and import transaction records where applicable

2.3 Filing and Compliance Data

• Completed VAT returns generated through the Platform
• Filing history, submission dates, and filing period records
• Any correspondence or notes relating to a specific filing period

2.4 Payment Data

• Subscription tier and billing history
• Payment method details — processed and stored by our third-party payment processor. ClearFile does not store full credit card or bank account numbers on our own systems.

2.5 Technical and Usage Data

• IP address, browser type, device type, and operating system
• Pages visited, features used, and time spent on the Platform
• Error logs and diagnostic data for platform improvement purposes

3. How We Use Your Data

3.1 Providing the Service

• Processing your transaction data and generating VAT returns
• Storing your filing history and compliance records for the retention period specified in Section 6
• Sending filing deadline reminders and compliance alerts
• Processing your subscription payments

3.2 Improving the Platform

• Analysing aggregated, anonymised usage patterns to improve platform features and user experience
• Diagnosing and resolving technical issues
• Developing and testing new compliance modules

ClearFile does not use individual User Data for product improvement purposes without anonymisation. Your specific financial transactions are never used to train, benchmark, or improve the Platform's features in an identifiable form.

3.3 Legal and Regulatory Compliance

• Complying with applicable Bahamian law, including the DPA and any successor legislation
• Responding to lawful requests from government authorities, courts, or regulatory bodies
• Maintaining records required under Bahamian law
• Enforcing our Terms of Service and protecting ClearFile's legal rights

3.4 Communications

• Sending transactional communications relating to your Account, Subscription, and Filings
• Notifying you of material changes to these policies or to the Platform
• Sending Platform update announcements and new feature notifications (you may opt out of non-essential communications at any time)

3.5 What We Do Not Do

4. Legal Basis for Processing

Under the DPA and applicable Bahamian data protection principles, ClearFile processes your personal data on the following legal bases:

• Contract performance— processing necessary to provide the Platform services you have subscribed to
• Legal obligation— processing necessary to comply with applicable Bahamian law
• Legitimate interests— processing for platform improvement and security purposes, where such interests are not overridden by your data protection rights
• Consent— for non-essential communications and optional features, where you have provided explicit consent

5. Data Sharing and Disclosure

5.1 ClearFile Employees

Access to User Data within ClearFile is strictly limited to employees who require it to perform their job functions. All employees are bound by confidentiality obligations.

5.2 Third-Party Service Providers

ClearFile shares data with the following categories of third-party service providers, each of whom is contractually bound to process your data only on our behalf and in accordance with this Policy:

• Cloud hosting and infrastructure providers (for data storage and Platform operation)
• Payment processing providers (for Subscription billing)
• Email and SMS communication providers (for deadline reminders and notifications)
• Analytics providers (using anonymised and aggregated data only)

5.3 Legal Disclosures

ClearFile may disclose your data if required to do so by law, court order, or lawful request from a competent Bahamian government authority. Where permitted by law, ClearFile will notify you of such a request before disclosing your data.

ClearFile will not disclose your financial data to the Department of Inland Revenue or any other tax authority except where you have explicitly submitted a Filing through the Platform or where compelled by law.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of ClearFile's assets, your data may be transferred to the acquiring entity. We will notify you before your data is transferred and becomes subject to a different privacy policy.

6. Data Retention

ClearFile retains your data for the following periods:

• Account and identity data: retained for the duration of your Account and for 3 years following account closure
• Financial and transaction data: retained for 12 months from the date of upload on the Starter tier; retained for the duration of your active Subscription on Growth and Professional tiers
• Filing records: retained for the same period as the associated transaction data
• Payment records: retained for 7 years in accordance with financial record-keeping obligations
• Technical and usage data: retained for 12 months

Following the expiry of the applicable retention period, your data will be securely deleted or anonymised. You may request early deletion of your data subject to the exceptions described in Section 7.4.

7. Your Data Rights

Under the DPA and applicable Bahamian law, you have the following rights in respect of your personal data:

7.1 Right of Access

You have the right to request a copy of the personal data ClearFile holds about you. We will respond to access requests within 30 days. Requests can be made by emailing support@clearfile.co.

7.2 Right to Rectification

If you believe any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. Most Account data can be updated directly through your Account settings.

7.3 Right to Object

You have the right to object to the processing of your personal data for direct marketing purposes. You may opt out of non-essential communications at any time through your Account settings or by emailing support@clearfile.co.

7.4 Right to Deletion

You may request deletion of your personal data. ClearFile will action such requests subject to the following limitations:

• We cannot delete data that we are required to retain by law (e.g., payment records required for financial compliance purposes)
• We cannot delete Filing records that you may require for future reference or audit purposes while your Account is active
• Deletion requests will be processed within 30 days of receipt

7.5 Data Portability

You may request an export of your User Data in a standard format (CSV or PDF) at any time through your Account settings. This includes your transaction records, filing history, and account information.

7.6 Complaints

If you are unsatisfied with how ClearFile handles your data, you have the right to lodge a complaint with the Data Protection Commissioner of The Bahamas. Contact details for the Commissioner are available at the Office of the Data Protection Commissioner website.

8. Data Security

ClearFile implements appropriate technical and organisational security measures to protect your data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS
• Encryption of data at rest
• Access controls limiting data access to authorised personnel only
• Regular security reviews and monitoring
• Secure password hashing — ClearFile cannot recover your password

While we take data security seriously, no method of electronic storage or transmission is completely secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, ClearFile will notify you and the Data Protection Commissioner as required by applicable law.

9. Cookies and Tracking

ClearFile uses cookies and similar tracking technologies on the Platform for the following purposes:

• Essential cookies— required for the Platform to function, including maintaining your logged-in session
• Analytical cookies— used in anonymised, aggregated form to understand how the Platform is used and to improve it
• Preference cookies— used to remember your Platform settings and preferences

ClearFile does not use advertising cookies or share tracking data with advertising networks. You can manage cookie preferences through your browser settings, though disabling essential cookies may affect Platform functionality.

10. Children's Data

ClearFile is a business compliance platform intended for use by adults operating registered businesses. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has provided personal data to us, please contact support@clearfile.co and we will delete it promptly.

11. Changes to This Policy

ClearFile may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or applicable law. We will notify registered Users of material changes by email or through an in-platform notification at least 14 days before the changes take effect.

The current version of this Policy is always available at clearfile.co/privacy. The “Last Updated” date at the top of this document indicates when the most recent changes were made.

12. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the data ClearFile holds about you, please contact us: