Heesab Data Retention Policy

Effective: June 16, 2026

This Data Retention Policy describes Heesab's current pilot retention targets. Heesab is operated by Basha Holdings LLC d/b/a Heesab.

Retention targets are subject to legal, security, accounting-integrity, dispute, backup, provider, and operational needs. Some records, especially immutable audit records, may be retained longer than the ordinary targets.

Retention Targets

• Raw invoice attachments and email bodies: generally up to 90 days.
• Parsed invoice records: generally up to 90 days.
• Audit logs: generally at least 90 days and potentially longer when needed to preserve accountability for actions taken in customer books.
• App and server logs: generally up to 90 days.
• QuickBooks OAuth tokens: deleted when the customer disconnects QuickBooks or closes the account, unless retention is required for legal, security, or dispute reasons.
• Session records: retained only as needed for login, security, troubleshooting, and abuse prevention.
• Workflow settings and vendor mappings: retained while the customer account is active and as needed to explain prior automation behavior.

Why Some Data May Be Kept Longer

Heesab may retain data longer than the ordinary targets when needed to:

• Investigate suspected unauthorized access or incorrect posting.
• Resolve support issues or customer disputes.
• Preserve an audit trail for accounting-integrity reasons.
• Comply with legal process or legal obligations.
• Maintain backups and disaster recovery.
• Prevent duplicate invoice processing.
• Protect the rights, safety, security, or integrity of Heesab, customers, or providers.

Deletion, Disablement, and Disconnect

Customers may request that Heesab:

• Pause automation for a tenant.
• Disable a tenant.
• Disconnect QuickBooks Online.
• Delete QuickBooks tokens.
• Stop processing forwarded invoice emails.
• Delete or archive operational records where deletion is appropriate and legally permissible.

Customers should also remove or disable their own invoice forwarding rules when ending use of Heesab.

Audit Records

Heesab keeps audit records to preserve accountability for actions taken in customer books, including queueing, mapping, approvals, auto-post decisions, QuickBooks posting, errors, and tenant status changes.

Audit logs are database-enforced immutable. Because of that, audit records may not be editable or deletable in normal operations and may be retained longer than raw invoice content or parsed invoice records.

Backups and Provider Logs

Backups, provider logs, and security logs may follow provider-specific retention schedules and may persist after ordinary application records are deleted. Heesab will use reasonable efforts to ensure those records are protected and not used for unrelated purposes.

Contact

Retention or deletion questions should be sent to [email protected] or [email protected].