Your firm's data, your firm's data.
This is the long version. Plain English. Short enough to read in one sitting. If you'd rather have the engineering view, our Security page covers the same ground in technical terms.
TL;DR
We hold bank-line descriptions, your firm's categorization rules, and your QBO API tokens. We do not sell, share, broker, or train AI on any of it. We never see bank logins (Plaid handles those). The model sees bank lines + your policy memory, never balances or client PII. You can export or delete everything, self-serve, in Settings.
What we collect.
Three buckets. Nothing else.
| Bucket | What's in it | Where it lives |
|---|---|---|
| Account & firmstuff you type into Settings | Your name, email, firm name, role, billing contact, timezone, vertical preset. | Postgres · per-firm RLS · AES-256 at rest |
| Bookkeeping datawhat arrives via Plaid + QBO | Bank-line descriptions, amounts, dates, account types, vendor names, chart-of-accounts, your firm's rules, your overrides. | Postgres · per-firm RLS · per-firm column-level encryption for any client-identifying fields |
| Usage telemetryhow the app gets used | Keystroke timings (the pace meter), feature toggles, error stacks, login timestamps. Never the bank-line text itself. | 30-day rolling window |
We do not collect: bank passwords, ACH credentials, client SSNs, payroll details, document scans beyond what you forward to receipts@, your client's QBO admin password, or your browser history.
How it's used.
Only to run the product you're paying for.
- To categorize transactions — bank-line + vendor + your policy memory → categorization suggestion.
- To match receipts — a captured receipt is read on your own device (in your browser), and the extracted fields are compared to your bank lines. The image is never sent anywhere to be OCR'd.
- To remember your decisions — every override becomes part of your firm's policy memory for next time.
- To bill you — your contact email gets the invoice. Stripe handles the card.
- To answer your support ticket — only when you open one, and only the engineer you're talking to.
What the AI sees.
We use OpenAI's gpt-4o-mini for categorization, under a zero-retention business agreement. What gets sent per request:
- The bank-line description (e.g.
HOME DEPOT 1947) - The amount and date
- Your firm's vertical preset (e.g.
construction) - The 10 most-relevant past categorizations for that vendor, from your firm's policy memory
- Your chart-of-accounts (account names only)
What's never sent: account balances, client owner names beyond what's in the QBO company file name, payroll details, receipt image content (receipts are OCR'd on your own device, never uploaded to be read), or anything from books you haven't explicitly linked.
We log every prompt and completion for 14 days, internally only, for debugging. After 14 days, the logs are aggregated to category-level counts and the raw text is deleted.
How long we keep it.
| Data | Retention | On firm deletion |
|---|---|---|
| Account & firm data | For the life of the firm + 30 days | Hard-deleted within 7 days |
| Bookkeeping data | For the life of the firm | Hard-deleted within 7 days; encrypted backups expire on their own cycle (max 1 year on Team) |
| Telemetry | 30-day rolling | Already gone |
| AI prompt/completion logs | 14 days, then aggregated | Aggregates don't identify any firm |
| Support ticket history | 3 years | Anonymized on firm deletion |
| Billing / invoices | 7 years (US tax requirement) | Retained anonymized |
Your rights.
Under GDPR, CCPA, and just generally, you have these and we honor them within 30days, self-serve where possible:
- Export — Settings → Danger zone → Export all firm data. JSON + CSV bundle, signed, delivered to your account email.
- Delete — Settings → Danger zone → Delete firm. Hard-deletes within 7days, irreversibly.
- Correct — most fields are self-edit. For anything you can't edit, email privacy@ledgerinbox.com.
- Object — to specific processing. Email us, we'll either fix it or tell you why we can't.
- Portability — your export is in formats every other bookkeeping tool can read.
- Lodge a complaint — with your local data protection authority. We won't retaliate, full stop.
Kids.
LedgerInbox is for licensed bookkeepers and accountants running a firm. We don't expect minors to use it. We don't knowingly collect data on anyone under 16. If you believe we have, email privacy@ledgerinbox.com and we'll delete on confirmation.
When this changes.
Every meaningful change is announced 30 days in advance via the email on your account and in our changelog. The footer date at the bottom of this page always reflects the current effective version. We do not yet publish an archive of superseded versions; if you need a prior one, ask us and we will send it.
Reach a human.
For privacy questions, data requests, or anything that doesn't fit in support:
- Email: privacy@ledgerinbox.com — fastest path; we read everything.
- Postal address: We don't publish a public mailing address yet. For requests that require one (formal DSAR, GDPR Article 27 representative, court-of-competent-jurisdiction notices), email us at the address above first and we'll provide the appropriate channel.