Privacy Policy

We collect information you provide directly when you create an account, subscribe to our services, or interact with our platform. This includes your name, email address, phone number, company name, and billing information.

We also collect financial data that you input or import into the platform, including transactions, invoices, bills, bank account information (last 4 digits only), customer and vendor records, payroll data, and tax-related documents.

Automatically collected data includes IP addresses, browser type, device information, usage patterns, and cookies. We use this to maintain security, improve user experience, and prevent fraud.

We use your information to provide and maintain the accounting platform, process transactions, generate financial reports, and deliver AI-powered insights and automation features.

Your data is used to send invoice and bill reminders, scheduled notifications, and summary reports based on your preferences. You control which notifications are enabled and how they are delivered (in-app or email).

We do not sell your personal or financial data to third parties. Data is shared only with service providers who help us operate the platform (such as payment processors and bank connection providers), and only under strict data processing agreements.

We implement enterprise-grade security measures including AES-256 encryption for sensitive data at rest, TLS 1.2+ for data in transit, and Content Security Policy (CSP) headers to prevent cross-site scripting attacks.

Multi-tenant data isolation ensures your company data is logically separated from other tenants using row-level security (RLS) policies enforced at the database level.

Additional security features include two-factor authentication (2FA), API key rotation enforcement (90-day expiry), IP allowlisting for admin functions, file upload validation, rate limiting, session management, and comprehensive audit logging.

Daily encrypted backups are performed and retained for 30 days. All sensitive bank credentials and encryption keys are stored server-side only and never exposed to the frontend.

Each organization (tenant) operates in a logically isolated environment. Your company data — transactions, invoices, bills, customers, vendors, employees, and all financial records — is scoped to your company ID and protected by row-level security policies.

User roles (admin, user) control access levels within your organization. Only admin users can manage team members, modify security settings, and access cross-module administrative functions.

Cross-tenant data access is technically prevented at the database level. Even in the event of an application-level bug, RLS policies ensure your data cannot be exposed to other organizations.

We use essential cookies to maintain your session, authenticate requests, and remember your preferences. These cookies are necessary for the platform to function and cannot be disabled.

We may use analytics cookies to understand how users interact with the platform, which helps us improve features and user experience. You can control analytics tracking through your browser settings or our cookie consent banner.

We do not use cookies for targeted advertising or sell tracking data to third-party advertising networks.

Under the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and similar regulations, you have the right to: access your personal data, request correction of inaccurate data, request deletion of your data ("right to be forgotten"), restrict or object to processing, and request data portability.

To exercise any of these rights, contact us using the information provided in the "Contact Us" section below. We will respond to your request within 30 days.

If you are located in the European Economic Area or United Kingdom, you have the right to lodge a complaint with your local data protection authority. We encourage you to contact us first so we can address your concerns.

We retain your data for as long as your account is active. If you cancel your subscription, we retain your data for 90 days to allow for reactivation, after which it is permanently deleted from our production systems.

Encrypted backup copies are retained for 30 days and then automatically purged. Deleted items are moved to a recycle bin and can be recovered for 30 days before permanent removal.

Certain records may be retained longer as required by law, tax regulations, or legal holds. We comply with all applicable record-keeping requirements.

We integrate with third-party services to provide banking connections (Plaid), payment processing (Stripe), calendar synchronization (Google Calendar), and spreadsheet integration (Google Sheets). Each of these services has its own privacy policy governing data they process.

Bank connections through Plaid use tokenized authentication. We never store your bank login credentials — only a secure access token provided by Plaid, which is encrypted at rest.

Payment processing through Stripe is PCI-DSS compliant. We do not store full credit card numbers — Stripe handles all card data securely on their infrastructure.

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant authorities without undue delay, in accordance with applicable laws.

Our incident response plan includes immediate containment, forensic investigation, notification of affected users, and remediation steps to prevent recurrence.

If you have any questions about this Privacy Policy or your data rights, please contact us:

Email: hello@accuratebookkeeping-service.com

Phone: (305) 978-9610

Address: 850 N Miami Ave Ste 701, Miami, FL