Privacy Policy

This Privacy Policy ("Policy") describes how OurBooks ("we," "our," or "us") collects, uses, stores, shares, and protects your personal information when you use the OurBooks cloud-based accounting platform and related services (the "Service"). By accessing or using the Service, you acknowledge that you have read and agree to this Policy.

1. Information We Collect

1.1 Information You Provide

When you create an account, subscribe to the Service, or interact with us, we collect:

• Account Information: Name, email address, and authentication credentials (managed by our authentication provider, Clerk).
• Billing Information: Payment card details, billing address, and subscription plan selection (processed and stored by our payment provider, Stripe). We do not store your full credit card number on our servers.
• Company Information: Business name, legal name, business type, tax identification numbers, fiscal year settings, address, phone number, and other company profile details you enter.

1.2 Financial Data You Enter

The core purpose of OurBooks is to manage your financial records. You may enter or import:

• Chart of accounts, account balances, and account hierarchies
• Journal entries, general ledger transactions, and adjusting entries
• Invoices, bills, and payment records
• Customer and supplier contact information and records
• Bank account details and bank transaction records for reconciliation
• Budget and forecast data
• Receipts and documents uploaded for OCR processing
• Trial balance imports from other accounting systems

All financial data is entered or uploaded by you. We do not independently collect financial data about you or your business from external sources.

1.3 Usage and Device Information

We automatically collect certain information when you use the Service:

• Usage Data: Feature usage events (e.g., reports generated, imports completed, pages visited), session duration, and interaction patterns. These analytics help us improve the Service.
• Device Information: Browser type and version, operating system, screen resolution, and device type.
• Log Data: IP address, access times, referring URLs, and server log information.

1.4 Cookies and Tracking Technologies

We use cookies and similar technologies to maintain your session, remember your preferences, and analyze Service usage. See Section 10 for detailed cookie disclosures.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: To operate, maintain, and provide the features and functionality of OurBooks, including processing your financial data, generating reports, and enabling data imports and exports.
• Account Management: To create and manage your account, authenticate your identity, and process subscription payments.
• Service Improvement: To analyze usage patterns, diagnose technical issues, and improve the performance, reliability, and user experience of the Service.
• Communication: To send you transactional emails (account confirmations, billing receipts, subscription renewal notices), service announcements, and responses to your support requests.
• Compliance: To comply with applicable laws, regulations, and legal processes, and to enforce our Terms of Service.
• Security: To detect, prevent, and respond to fraud, abuse, security incidents, and other harmful activity.
• Analytics: To generate aggregated, de-identified analytics about Service usage to understand trends and improve our product.

We do not sell your personal information or financial data to third parties. We do not use your data to train third-party AI or machine learning models without your separate, explicit consent.

3. Data Storage and Security

3.1 Data Architecture

OurBooks employs a schema-per-tenant data isolation architecture. Each company you create in OurBooks receives its own dedicated PostgreSQL database schema. This means:

• Your financial data is stored in an isolated schema that is logically separated from all other customers' data.
• Cross-company data access is prevented at the database level through schema isolation.
• User account data (name, email, authentication) is stored in a shared schema, separate from your financial data.

3.2 Encryption and Security Measures

We implement industry-standard security measures to protect your data:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher (HTTPS).
• Encryption at Rest: Database storage is encrypted at rest using AES-256 encryption provided by our database hosting provider.
• Authentication Security: User authentication is managed by Clerk, which implements secure session management, password hashing, and multi-factor authentication support.
• Access Controls: Role-based access controls and company membership verification ensure users can only access data they are authorized to view.

3.3 Data Location

Your data is stored on servers located in the United States, hosted by our infrastructure providers (see Section 4). If you are located outside the United States, your data will be transferred to and stored in the United States. See Section 8 for information about international data transfers.

4. Data Sharing and Third-Party Services

We share your information only with the third-party service providers necessary to operate the Service. We do not sell, rent, or trade your personal information or financial data. Our third-party service providers include:

4.1 Clerk (Authentication)

We use Clerk (clerk.com) for user authentication and session management. Clerk receives your name, email address, and authentication credentials. Clerk's privacy policy is available at clerk.com/privacy.

4.2 Stripe (Payment Processing)

We use Stripe (stripe.com) for subscription billing and payment processing. Stripe receives your payment card details, billing address, and transaction amounts. We do not store your full credit card number on our servers. Stripe's privacy policy is available at stripe.com/privacy.

4.3 AWS Textract (Optical Character Recognition)

If you use the receipt scanning feature, we use Amazon Web Services Textract to perform optical character recognition (OCR) on uploaded documents. Document images are transmitted to AWS for processing and are not retained by AWS after processing is complete. AWS's privacy notice is available at aws.amazon.com/privacy.

4.4 Neon (Database Hosting)

We use Neon (neon.tech) to host our PostgreSQL databases. All your financial and account data resides on Neon's infrastructure. Neon provides encryption at rest and in transit. Neon's privacy policy is available at neon.tech/privacy.

4.5 Vercel (Application Hosting)

We use Vercel (vercel.com) to host the OurBooks web application. Vercel processes your requests and may receive your IP address and browser information as part of standard web hosting operations. Vercel's privacy policy is available at vercel.com/legal/privacy-policy.

4.6 Plaid (Bank Account Connections)

If you connect a bank or credit card account to import transactions, we use Plaid (plaid.com) to facilitate that connection. You enter your bank credentials directly with Plaid — OurBooks never sees or stores your banking username or password.Plaid provides us with an access token and the transaction data for accounts you have authorized. Access tokens are encrypted at rest before storage. You can disconnect a bank account at any time from the Bank Feeds settings, which instructs Plaid to revoke its access. Plaid's end-user privacy policy is available at plaid.com/legal.

4.7 Resend (Email Delivery)

We use Resend (resend.com) to deliver email — including account confirmations, password resets, billing receipts, invitations, subscription notices, service announcements, and a short series of onboarding and educational messages after you sign up. Resend receives your email address and the content of each message we send. Onboarding and other non-essential messages include an unsubscribe link, and we do not sell your email address or share it for third-party advertising. Resend's privacy policy is available at resend.com/legal/privacy-policy.

4.8 Sentry (Error Monitoring)

We use Sentry (sentry.io) to capture application errors and monitor performance. When an error occurs in the Service, Sentry receives technical context including the error stack trace, the URL where the error occurred, your browser and device information, and your OurBooks user ID. We do not intentionally send financial data or message bodies to Sentry, though small fragments may appear in error messages or stack frames. Sentry's privacy policy is available at sentry.io/privacy.

4.9 Upstash (Rate Limiting)

We use Upstash (upstash.com) Redis to enforce request rate limits and protect the Service against abuse. Upstash processes identifiers (such as your user ID or IP address) and short-lived counters; it does not store financial data, account details, or message contents. Upstash's privacy policy is available at upstash.com/trust/privacy.

4.10 Google (AI-Assisted Features)

Several optional features of the Service use Google's Gemini API to assist you. These include the AI assistant (chat), automated extraction of data from uploaded bills, invoices, and bank-statement PDFs, suggested chart-of-accounts categories, transaction and bank-feed categorization, and budget, quote, and report assistance. When you invoke one of these features, the input text or document content you provide and the contextual information needed to generate a result are transmitted to Google for processing. We access the Gemini API through a paid, billing-enabled Google Cloud account; under Google's paid API terms, Google does not use Gemini API inputs or outputs to train its models. AI features are optional, and you can avoid sending data to Google by not using them. Google's privacy policy is available at policies.google.com/privacy.

4.11 Vercel Blob (File Storage)

We use Vercel Blob (vercel.com), provided by Vercel, to store files you upload to the Service — including company logos, scanned bills and invoices, receipt images, and any files you attach to in-app feedback. Vercel Blob receives the contents of these files and the access metadata needed to serve them back to you. OurBooks does not request or require you to upload full credit-card images or bank-credential documents, and we do not authorize Vercel to use uploaded files for any purpose other than storing and serving them on our behalf. Vercel's privacy policy is available at vercel.com/legal/privacy-policy.

4.12 Tax1099 (1099 E-Filing)

If you use OurBooks to electronically file 1099 information returns, we use Tax1099 (tax1099.com), provided by Zenwork, Inc., to prepare and transmit those filings to the IRS. To submit a filing, Tax1099 receives the recipient and payer information the IRS requires — including names, mailing addresses, taxpayer identification numbers (EINs or SSNs), and payment amounts. We transmit this information only when you initiate a 1099 e-filing, and only for the recipients included in that filing. Tax1099's privacy policy is available at tax1099.com/privacy-policy.

4.13 Other Disclosures

We may also disclose your information if required to do so by law, in response to a valid legal process (such as a subpoena or court order), to protect our rights or property, to prevent fraud or abuse, or to protect the safety of our users or the public. In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

5. Your Privacy Rights (U.S. Residents)

We extend the following privacy rights to all U.S. residents, regardless of which state you live in. These rights derive from the California Consumer Privacy Act (CCPA/CPRA) and similar laws in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, and other states.

5.1 Your Rights

• Right to Know / Access: Request a copy of the personal information we have collected about you, including the categories and the specific pieces of personal information collected, the sources of collection, the business purposes for collection, and the categories of third parties with whom we share it.
• Right to Correct: Request that we correct inaccurate personal information.
• Right to Delete: Request deletion of personal information, subject to legal retention requirements described in Section 9.
• Right to Data Portability: Receive your data in a portable, machine-readable format. OurBooks provides a built-in export feature that exports your financial data in CSV and JSON formats.
• Right to Opt Out of Sale or Sharing for Targeted Advertising: We do not sell your personal information, and we do not share it for cross-context behavioral advertising or engage in targeted advertising. If we ever change this practice, you will have the right to opt out before it takes effect.
• Right to Limit Use of Sensitive Personal Information:Some information we process — such as financial account numbers, tax identification numbers, and account credentials — qualifies as “sensitive personal information” under California law. We use this information only to provide the Service, secure your account, comply with legal obligations, and protect against fraud — not for inferring characteristics about you. You may request that we further limit our use of this information by contacting us.
• Right to Non-Discrimination: We will not deny you service, charge different prices, or provide a different level of quality because you exercised a privacy right.
• Right to Appeal:If we deny a privacy request, you may appeal by replying to our denial response or by emailing privacy@ourbooks.app with the subject line “Privacy Request Appeal.” We will respond to appeals within 60 days.

5.2 How to Submit a Request

To exercise any of these rights, email privacy@ourbooks.app and describe the right you wish to exercise. We can usually verify your request fastest when it is sent from the email address associated with your OurBooks account; if you are submitting a request through an authorized agent, see Section 5.4. We will respond within 45 days; if we need additional time to fulfill your request, we may extend this period by up to 45 additional days and will notify you of the extension and the reason.

5.3 Verifying Your Identity

To protect your data, we must verify that the person making a request is the account holder. We verify by confirming that the request comes from the email address registered to the account, and we may ask you to confirm specific account details. If we cannot reasonably verify your identity, we will be unable to fulfill your request and will tell you why.

5.4 Authorized Agents

You may designate an authorized agent to submit privacy requests on your behalf. We will require written documentation of the authorization (such as a signed permission or a power of attorney) and may also ask you to verify your identity directly with us before fulfilling the agent's request.

5.5 Global Privacy Control (GPC)

We do not sell personal information, share it for cross-context behavioral advertising, or engage in targeted advertising. We honor Global Privacy Control (GPC) signals consistent with this practice.

6. Automated Decision-Making and AI Features

OurBooks does not use automated decision-making or profiling to make decisions that produce legal or similarly significant effects about you. We do not use your personal information to assess creditworthiness, employment eligibility, insurance risk, or any similar consequential outcome.

Some optional features of the Service use artificial intelligence to assist you — for example, suggesting chart-of-accounts categories or describing a transaction. These features generate suggestions for you to review and accept, reject, or modify; they do not make decisions on your behalf. AI features that send data to a third-party provider are disclosed in Section 4. We do not use your financial data or personal information to train AI or machine learning models, and we do not authorize our AI providers to do so.

7. Your Rights Under the General Data Protection Regulation (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR) and equivalent local legislation:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request that we correct inaccurate or incomplete personal data.
• Right to Erasure: You may request that we delete your personal data, subject to applicable legal retention requirements.
• Right to Restriction of Processing: You may request that we restrict the processing of your personal data in certain circumstances.
• Right to Data Portability: You may request to receive your personal data in a structured, commonly used, and machine-readable format. OurBooks provides a comprehensive data export feature that exports all your financial data in CSV and JSON formats.
• Right to Object: You may object to the processing of your personal data for certain purposes, including direct marketing.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

Our legal bases for processing your personal data include: (a) performance of a contract (providing the Service you subscribed to); (b) legitimate interests (improving and securing the Service, analytics); and (c) compliance with legal obligations.

To exercise any of these rights, contact us at privacy@ourbooks.app. You also have the right to lodge a complaint with your local data protection supervisory authority.

8. International Data Transfers

OurBooks is operated from the United States, and your data is stored on servers located in the United States. If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with data protection laws that differ from U.S. law, your personal data will be transferred to the United States.

For transfers of personal data from the EEA or the United Kingdom to the United States, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission and the UK Information Commissioner's Office, respectively. These contractual safeguards ensure that your personal data receives an adequate level of protection when transferred outside your jurisdiction.

You may request a copy of the applicable Standard Contractual Clauses by contacting us at privacy@ourbooks.app.

9. Data Retention

We retain your information for as long as necessary to provide the Service and fulfill the purposes described in this Policy. Specific retention periods by data category:

• Account Information: Retained for the duration of your active account. When you close your account, your data enters a 90-day reactivation window during which you may recover the account in-app or export your data. After 90 days, your personal data (name, email, profile information, financial records, and uploaded files) is permanently and irreversibly deleted from our application database. A pseudonymous tombstone identifier is retained alongside per-account and per-company audit-log entries to preserve the referential integrity of our security and compliance records. Payment and tax records continue to be retained as described under Billing and Transaction Records below.
• Financial Data: Retained for the duration of your active account. After account closure, you may export your financial data at any time during the 90-day reactivation window. At the end of that window, financial data is permanently deleted, subject to any legal retention requirements (see Billing and Transaction Records below).
• Billing and Transaction Records: Retained for a minimum of seven (7) years following the transaction date, as required for tax and financial compliance purposes.
• Usage and Analytics Data: Retained in identifiable form for up to 24 months, after which it is aggregated or de-identified. Automated enforcement of this retention is a planned feature; until that ships, we honor the 24-month limit through periodic manual review. You may request earlier de-identification by contacting privacy@ourbooks.app.
• Server Logs: Retained for up to 90 days for security and troubleshooting purposes.
• Support Communications: Retained for up to three (3) years following resolution to maintain service quality and for reference.

Archived companies vs closed accounts: Within OurBooks, you can archive individual companies separately from closing your account. Archived companies are retained for 7 years from the date of last activity (matching our 7-year tax-record retention period) so you can restore or export them during that window. Closing the company (or closing your account) starts a separate 90-day deletion countdown.

When data is no longer required, we delete or de-identify it in accordance with our internal data retention procedures. Closure is reversible during the 90-day window via the in-app recovery flow. After 90 days, deletion is permanent and irreversible. You may request earlier deletion of your personal data by contacting us at privacy@ourbooks.app, subject to applicable legal retention requirements.

10. Cookies and Tracking Technologies

We use cookies and similar technologies to operate and improve the Service:

• Essential Cookies: Required for the Service to function, including session management, authentication state, and security tokens. These cannot be disabled.
• Functional Cookies: Remember your preferences and settings (such as selected company, display preferences, and recently accessed features) to provide a personalized experience.
• Analytics Cookies: Help us understand how you use the Service, which features are most popular, and where users encounter issues. We use this data in aggregate to improve the Service.

We do not use third-party advertising cookies or cross-site tracking technologies. You can manage cookie preferences through your browser settings. Note that disabling essential cookies may prevent you from using the Service.

11. Children's Privacy

OurBooks is a business accounting platform not directed at children under the age of thirteen (13). We do not knowingly collect personal information from children under 13 in compliance with the Children's Online Privacy Protection Act (COPPA). If we learn that we have inadvertently collected personal information from a child under 13, we will take steps to delete that information as promptly as possible.

If you believe we have collected personal information from a child under 13, please contact us immediately at privacy@ourbooks.app so that we can take appropriate action.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. For material changes, we will:

• Post the updated Policy on our website with a new "Last Updated" date.
• Send an email notification to the address associated with your account at least fourteen (14) days before the change takes effect.
• Where required by applicable law, obtain your consent before implementing changes that materially affect how we process your personal data.

Your continued use of the Service after the effective date of an updated Policy constitutes your acceptance of the changes. If you do not agree to any changes, you should discontinue use of the Service and contact us to close your account.

13. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

• Privacy Inquiries: privacy@ourbooks.app
• General Legal: legal@ourbooks.app
• Mailing Address: Fiskuly, Inc., Attn: Privacy Team, 2501 Chatham Rd #6519, Springfield, IL 62704, USA

We will respond to all privacy-related requests within forty-five (45) days, or within the timeframe required by applicable law, as described in Section 5.2.