Privacy Policy

This Privacy Policy explains what data SoftCloud, operated by ESD Corporation ("SoftCloud", "we"), collects, how we use it, and what control you have over it. It applies to the data of your account and the company you represent, and to the data of your own customers that passes through the Service when you issue an e-CF.

1. What data we collect

• About your account: name, email, password (never in plain text — it's stored encrypted with bcrypt), and the two-factor verification code if you enable it (the secret is stored encrypted, never in the clear).
• About your company: RNC or national ID, legal business name, trade name, address, phone, and contact details — the “Emisor” (issuer) section required by DGII's e-CF Format.
• Your digital certificate (.p12): if you upload it to sign your own e-CFs, it's stored encrypted at rest (AES-256-GCM) — not even our team can read it directly.
• Tax documents: the full content of every e-CF you issue or receive (products, amounts, your customers' or suppliers' RNC/national ID), its status with DGII, and its change history.
• Payment data: if you enable card payments (Azul module), the card is tokenized directly with the payment processor (Azul) — SoftCloud never stores the full card number or the security code, only the token Azul gives us.
• Technical data: IP addresses and activity logs to prevent abuse (rate limiting) and for the audit log of sensitive administrative actions.

2. What we use it for

• Issuing, signing, and transmitting your electronic tax documents to DGII.
• Operating the ERP features you enable (finance, inventory, sales, purchases, subscriptions).
• Processing card payments, if you enable that module.
• Sending you operational notifications (request approved, failed payment, changes to your account) — never marketing without your consent.
• Preventing fraud and abuse of the Service, and maintaining an audit log of administrative actions.
• Complying with legal obligations, including retaining tax documents as required by Dominican tax law.

3. Who we share data with

We do not sell your data. We share it only when necessary to operate the Service:

• DGII — the content of every e-CF you issue, as required by the Electronic Invoicing Standard.
• Azul — card data (tokenized) and amount, if you use the card payments module.
• Infrastructure providers — hosting and database providers that run the Service, under confidentiality agreements.
• Email provider — to send you transactional notifications (password reset, request approval).
• Sentry (optional) — if enabled, technical system error reports (never the content of your invoices).

4. How long we keep your data

Electronic tax documents are retained for the period required by Dominican tax law. The rest of your account data is retained while the account is active; if you close it, operational (non-tax) data is deleted within a reasonable period, unless we must retain it longer due to a legal obligation or to resolve a dispute.

5. How we protect your data

• Hashed passwords (bcrypt), never stored in plain text.
• Digital certificates and two-factor verification secrets encrypted at rest (AES-256-GCM).
• Two-factor verification (2FA) available for administrative accounts.
• Per-customer data isolation at the database level — your ERP data is never mixed with another account's.
• Encrypted communication (HTTPS/TLS) between your browser or integration and the Service.
• Outgoing webhooks signed (HMAC-SHA256) so you can verify an event came from us.

6. Your rights

You may ask us to access, correct, or delete your personal data, except for information we must retain due to a legal obligation (such as tax documents already issued). To exercise these rights, write to the contact address below.

7. Changes to this Policy

We may update this Policy — if the change is significant, we'll notify you by email or within the Service before it takes effect.

8. Contact

Questions about this Policy or your data: privacidad@esdcorporation.com.do