Your firm's data, your firm's data.
This is the long version. Plain English. Short enough to read in one sitting. If you'd rather have the engineering view, our Security page covers the same ground in technical terms.
TL;DR
We hold bank-line descriptions, your firm's categorization rules, and your QBO API tokens. We do not sell, share, broker, or train AI on any of it. We never see bank logins (Plaid handles those). The model sees bank lines + your policy memory, never balances or client PII. You can export or delete everything, self-serve, in Settings.
What we collect.
Three buckets. Nothing else.
| Bucket | What's in it | Where it lives |
|---|---|---|
| Account & firmstuff you type into Settings | Your name, email, firm name, role, billing contact, timezone, vertical preset. | Postgres · per-firm RLS · AES-256 at rest |
| Bookkeeping datawhat arrives via Plaid + QBO | Bank-line descriptions, amounts, dates, account types, vendor names, chart-of-accounts, your firm's rules, your overrides. | Postgres · per-firm RLS · per-firm column-level encryption for any client-identifying fields |
| Usage telemetryhow the app gets used | Keystroke timings (the pace meter), feature toggles, error stacks, login timestamps. Never the bank-line text itself. | 30-day rolling window · aggregated for the 90-day status page |
We do not collect: bank passwords, ACH credentials, client SSNs, payroll details, document scans beyond what you forward to receipts@, your client's QBO admin password, or your browser history.
How it's used.
Only to run the product you're paying for.
- To categorize transactions — bank-line + vendor + your policy memory → categorization suggestion.
- To match receipts — forwarded receipts get OCR'd by Veryfi, the extracted fields compared to your bank lines.
- To remember your decisions — every override becomes part of your firm's policy memory for next time.
- To bill you — your contact email gets the invoice. Stripe handles the card.
- To answer your support ticket — only when you open one, and only the engineer you're talking to.
What the AI sees.
We use Anthropic's Claude Sonnet for categorization, under a zero-retention business agreement. What gets sent per request:
- The bank-line description (e.g.
HOME DEPOT 1947) - The amount and date
- Your firm's vertical preset (e.g.
construction) - The 10 most-relevant past categorizations for that vendor, from your firm's policy memory
- Your chart-of-accounts (account names only)
What's never sent: account balances, client owner names beyond what's in the QBO company file name, payroll details, receipt image content (OCR happens at Veryfi, not Anthropic), or anything from books you haven't explicitly linked.
We log every prompt and completion for 14 days, internally only, for debugging. After 14 days, the logs are aggregated to category-level counts and the raw text is deleted.
How long we keep it.
| Data | Retention | On firm deletion |
|---|---|---|
| Account & firm data | For the life of the firm + 30 days | Hard-deleted within 7 days |
| Bookkeeping data | For the life of the firm | Hard-deleted within 7 days; encrypted backups expire on their own cycle (max 1 year on Team) |
| Telemetry | 30-day rolling | Already gone |
| AI prompt/completion logs | 14 days, then aggregated | Aggregates don't identify any firm |
| Support ticket history | 3 years | Anonymized on firm deletion |
| Billing / invoices | 7 years (US tax requirement) | Retained anonymized |
Your rights.
Under GDPR, CCPA, and just generally, you have these and we honor them within 30 days, self-serve where possible:
- Export — Settings → Danger zone → Export all firm data. JSON + CSV bundle, signed, delivered to your account email.
- Delete — Settings → Danger zone → Delete firm. Hard-deletes within 7 days, irreversibly.
- Correct — most fields are self-edit. For anything you can't edit, email privacy@ledgerinbox.com.
- Object — to specific processing. Email us, we'll either fix it or tell you why we can't.
- Portability — your export is in formats every other bookkeeping tool can read.
- Lodge a complaint — with your local data protection authority. We won't retaliate, full stop.
Kids.
Ledger is for licensed bookkeepers and accountants running a firm. We don't expect minors to use it. We don't knowingly collect data on anyone under 16. If you believe we have, email privacy@ledgerinbox.com and we'll delete on confirmation.
When this changes.
Every meaningful change is announced 30 days in advance via the email on your account and in our changelog. The footer date at the bottom of this page always reflects the current effective version. Past versions live at ledgerinbox.com/privacy/archive.
Reach a human.
For privacy questions, data requests, or anything that doesn't fit in support:
- Email: privacy@ledgerinbox.com
- Postal: Ledger Software, Inc. · 1547 N. Ashland Ave., Chicago, IL 60622, USA
- EU representative: eu-dpo@ledgerinbox.com (responses in EN/DE/FR)
- Data Protection Officer: Rachel Tan · dpo@ledgerinbox.com