Privacy Policy

1.Who we are and scope

This policy covers our website, app, mobile app, API and AI connector.

LedgerSync Inc. ("LedgerSync," "we," "us" or "our") is a Delaware corporation with its principal place of business at 12853 Tiara St, Valley Village, California 91607. This policy applies to personal information we process through ledgersync.com and its subdomains, the LedgerSync web application, the LedgerSync client mobile app, the LedgerSync API, the LedgerSync AI connector, our support channels, and our sales and marketing activities (together, the "Services").

This policy does not cover the practices of financial institutions, Data Providers, AI Providers, accounting software or other third parties you connect to the Services, or of the accounting and bookkeeping firms that use LedgerSync, each of which has its own privacy practices.

2.Our role: business or service provider

For client financial data, we work on behalf of your accounting firm.

LedgerSync plays two roles:

• On behalf of our customers. When a Firm or other Customer uses the Services to connect accounts and process data for itself or its End Clients, LedgerSync processes that Customer Data as a service provider (also called a processor) on the Customer's behalf and under its instructions. If you are an End Client, your accounting or bookkeeping firm is responsible for its own use of your information, and you should contact your firm with privacy questions or requests. We will assist our Customers in responding.
• For our own purposes. LedgerSync decides how and why to process information about visitors to our website, people who contact us or book demos, and Customer account holders and Authorized Users (for example, registration, billing and usage information). For this information, LedgerSync is the business (or controller).

Some financial information we process may be subject to the Gramm-Leach-Bliley Act ("GLBA") and its implementing regulations, which may make it exempt from certain state privacy laws. We protect that information as described in this policy regardless.

3.Information we collect

Information you provide

• Account and registration information: name, firm or company name, job title, email address, phone number, password and account preferences, and information about Authorized Users you invite.
• End Client information: names, email addresses, phone numbers and business details of End Clients a Firm adds or invites.
• Billing information: billing contact and address, and payment card or bank details, which are collected and processed by our third-party payment and subscription processors. We receive limited information such as card type, last four digits, expiration date and payment status.
• Documents and content: bank and credit card statements, check images, receipts, invoices and other files you or your End Clients upload or photograph, including through the mobile app, and any notes, comments or answers to transaction questions.
• Communications: support requests, emails, chat messages, survey responses, feedback, demo and webinar registrations, and the content of conversations with our AI assistant.

Financial account information

When you or an End Client connect a financial account, we receive Account Data from financial institutions through Data Providers or other connection methods, including account names, types and numbers (which may be masked), routing numbers, balances, transaction history and descriptions, merchant details, statements, check images, account holder names and addresses as provided by the institution, and connection status information.

Information from integrations

When you connect accounting software such as QuickBooks Online, QuickBooks Desktop, Thomson Reuters Accounting CS or Zoho Books, or a storage service such as Google Drive, we receive the information needed to perform the functions you enable, such as company and file identifiers, chart of accounts, vendors, customers, existing transactions and folder information.

Information collected automatically

• Device and usage data: IP address, browser and device type, operating system, approximate location derived from IP address, pages and features used, referring pages, timestamps, clickstream data and error logs.
• Cookies and similar technologies: see Section 11.

Information from other sources

We may receive business contact information from scheduling tools, event and webinar partners, referral partners, publicly available sources and business data providers, which we use for sales and marketing to businesses.

4.Financial account credentials

Where possible, you log in at your bank or through Mastercard or MX, and we never see your password.

For most connections, you enter your bank login directly into a secure window provided by a Data Provider or sign in at the financial institution through OAuth, and LedgerSync receives a token rather than your password. Where a connection requires LedgerSync to store credentials or multi-factor authentication responses, they are encrypted, are used only to retrieve data for the connection you authorized, are not visible to LedgerSync staff in plain text, are not shared with third parties other than the Data Provider handling the connection, and are deleted when the connection is removed. Stored credentials are not kept in backups.

5.How we use information

We use personal information to:

• provide, operate and maintain the Services, including retrieving Account Data, delivering statements and check images, applying rules, reconciling and syncing transactions to your accounting software, and depositing files to your storage;
• power automated and AI features, as described in Section 7;
• create and manage accounts, authenticate users and send security codes;
• process payments, subscriptions, renewals and cancellations;
• provide customer support, troubleshoot connection issues, and work with Data Providers and financial institutions to resolve them;
• send service, security, billing and administrative messages;
• send marketing communications to business contacts, subject to your right to opt out;
• monitor, maintain and improve the Services, including connection routing, reliability and data quality;
• detect, prevent and investigate fraud, security incidents, abuse and violations of our Terms;
• comply with legal obligations, respond to lawful requests, and establish, exercise or defend legal claims; and
• carry out any other purpose disclosed when the information is collected, with consent where required.

We use Customer Data that we process on a Customer's behalf only to provide the Services to that Customer and for the related operational, security and legal purposes permitted by our Terms and by law. We may create de-identified or aggregated information that does not identify any individual or Customer and use it to improve our products. We maintain such information in de-identified form and do not attempt to re-identify it.

6.Mastercard and MX

Mastercard and MX connect us to banks. They receive what they need to make and maintain the connection.

LedgerSync uses Mastercard Open Banking (Finicity, a Mastercard company) and MX Technologies, Inc. as Data Providers, together with direct institution connections and LedgerSync's own connection technology. We may use either or both Data Providers for a given institution or account, including to improve coverage, retrieve statements or check images, or validate data across sources.

To establish and maintain a connection, we and the Data Provider exchange information such as the financial institution selected, connection identifiers and tokens, the customer and account identifiers we assign, authentication responses you provide, and the Account Data retrieved. Data Providers process this information to provide connectivity and under their own terms and privacy policies, which they may present to you during the connection process and which are available on their websites at mastercard.com and mx.com. Data Providers may also be required to retain certain information under law or their agreements with financial institutions.

You can revoke a connection at any time by disconnecting the account in the Services or contacting us. When you do, we stop retrieving data and instruct the Data Provider to stop as well.

7.Artificial intelligence processing

We send data to AI services such as Claude, ChatGPT and Gemini to categorize, match, extract and answer. Those providers may not use it to train their models.

LedgerSync uses third-party AI Providers, including Anthropic (Claude), OpenAI (ChatGPT and OpenAI API models), Google (Gemini) and other AI tools we may adopt, to process data for the Services. Personal information and Customer Data, including transaction details, account metadata, statements, check images, receipts and other documents, End Client and vendor names, and the contents of questions and support conversations, are transmitted to AI Providers to:

• categorize, match and reconcile transactions and suggest accounting entries;
• read and extract data from statements, check images and documents (OCR);
• flag anomalies, missing items and transactions that need clarification;
• generate summaries, reports and answers within the Services;
• assist our support team and power automated support and workflow agents; and
• improve the accuracy of these features using de-identified or aggregated information.

LedgerSync accesses AI Providers solely through their commercial API services and does not use consumer AI accounts to process your data. Under those API terms, as of the effective date of this policy, AI Providers act as our service providers and may not use data submitted through the Services to train their models. AI Providers may retain inputs and outputs for a limited period for security, abuse monitoring or legal compliance, as described in their terms. AI Providers may process data in the United States or other countries. We send AI Providers only the data reasonably necessary for the requested function.

Automated and AI features produce suggestions that you review and approve. LedgerSync does not use AI to make decisions that produce legal or similarly significant effects about individuals, such as decisions about credit, employment, housing or insurance.

If you connect LedgerSync to an AI assistant you choose, for example through the LedgerSync AI connector or the API, the data you request is sent to that assistant at your direction and is handled under your agreement with that provider, not this policy.

8.Google user data

If you connect a Google account, such as Google Drive, LedgerSync's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Google user data only to provide the features you enable, such as creating folders and depositing files you select, and we do not use it for advertising, sell it, or use it to train generalized AI models. You can revoke access at any time in your Google account settings or by disconnecting the integration in LedgerSync.

9.Who we share with

We disclose personal information only as follows:

• Within your organization and firm. Information is visible to Authorized Users of the Customer account, and End Client information is available to the Firm that invited the End Client.
• Data Providers and financial institutions, to establish and maintain connections and retrieve Account Data, as described in Section 6.
• AI Providers, to power automated and AI features, as described in Section 7.
• Service providers that process information on our behalf under contracts that limit their use of it, including cloud hosting and storage, payment and subscription processing, customer support and ticketing, email and SMS delivery, scheduling, analytics, security and fraud prevention, and professional advisors.
• Integrations you enable, such as accounting software and cloud storage, at your direction.
• Legal and safety. When we believe in good faith that disclosure is required by law, subpoena, court order or other legal process, or is necessary to protect the rights, property or safety of LedgerSync, our customers or others, to investigate fraud or security issues, or to enforce our Terms. Where permitted, we will notify the affected Customer before disclosing Customer Data in response to legal process.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, bankruptcy or sale of all or part of our business, subject to the commitments in this policy. We will notify you of any change in ownership that affects how your information is used.
• With your consent or at your direction.

10.We do not sell your information

LedgerSync does not sell personal information, and does not sell or share Account Data or Customer Data for advertising. We have not sold personal information in the past 12 months.

LedgerSync does not run advertising on its website or in the Services, does not use advertising or retargeting cookies or pixels, and does not share personal information for cross-context behavioral advertising or targeted advertising. If this changes, we will update this policy and provide any opt-out required by law before doing so.

11.Cookies and similar technologies

We and our service providers use cookies, pixels, local storage and similar technologies to:

• keep the Services working, such as signing you in, remembering your session and preferences, and protecting against fraud (strictly necessary);
• understand usage and improve performance, for example with analytics tools (analytics).

We do not use advertising cookies. You can block or delete cookies through your browser settings. Blocking strictly necessary cookies may prevent parts of the Services from working. Because we do not sell or share personal information or engage in targeted advertising, browser "Do Not Track" and Global Privacy Control signals have nothing to opt you out of on our site.

12.How long we keep information

We keep personal information only as long as needed for the purposes in this policy, as follows:

• Customer Data (including Account Data, documents and End Client information) is kept only while the Customer's Subscription is active and the related End Client, account or connection exists. When a Customer cancels, or deletes an End Client, account or connection, the related Customer Data is deleted and the related bank connections are removed from LedgerSync and from our Data Providers, including Mastercard and MX. Customers are responsible for downloading any data they need before cancelling or deleting.
• Stored financial credentials and connection tokens are deleted when the connection is removed.
• Backups are encrypted, are kept only for disaster recovery, and are overwritten in the ordinary course of our backup cycle. We do not guarantee that data can be recovered from backups.
• Account, billing and transaction records are kept for the life of the account and as long as needed to meet tax, accounting and legal obligations, typically up to seven years.
• Support communications are kept for as long as needed to resolve the request and maintain service history, and then deleted or de-identified.
• Marketing contact information is kept until you opt out or it is no longer needed, and suppression records are kept so we can honor your opt-out.

We may keep information longer where required by law, to resolve disputes, or to enforce our agreements.

13.How we protect information

We maintain a written information security program with administrative, technical and physical safeguards appropriate to the sensitivity of financial data, including encryption of data in transit and at rest, role-based access controls and least-privilege access, multi-factor authentication for internal systems, logging and monitoring, vendor security review, and employee confidentiality obligations and training. We design these safeguards with reference to the FTC Standards for Safeguarding Customer Information.

If we confirm a breach of security that affects your personal information, we will notify affected Customers and individuals as required by applicable law. No system is completely secure, so we cannot guarantee absolute security. You can help by using a strong, unique password, enabling multi-factor authentication and keeping your devices secure.

14.Your choices

• Account information: you can review and update your profile in the Services.
• Connections: you can disconnect financial accounts and integrations at any time.
• Marketing email: use the unsubscribe link in any marketing email. We will still send service, security and billing messages.
• Text messages: reply STOP to opt out of non-essential texts.
• Cookies: see Section 11.

15.U.S. state privacy rights

Depending on where you live, you may have rights to access, correct, delete and opt out.

Residents of California and other states with comprehensive privacy laws may have the following rights, subject to exceptions and verification:

• Know and access: to know the categories and specific pieces of personal information we have collected, its sources, our purposes, and the categories of third parties we disclose it to;
• Correct: to correct inaccurate personal information;
• Delete: to request deletion of personal information we collected from you;
• Portability: to receive a copy of your personal information in a portable format;
• Opt out: of the sale or sharing of personal information, targeted advertising, and profiling in furtherance of decisions with legal or similarly significant effects (we do none of these);
• Limit: the use of sensitive personal information (we use sensitive personal information only for purposes permitted by law, such as providing the Services you request, so this right does not require action from you); and
• Appeal a decision we make about your request, where your state provides that right.

We will not discriminate against you for exercising these rights. If your information is processed by LedgerSync on behalf of a Firm or other Customer, please send your request to that Customer; we will help them respond.

California "Shine the Light." California residents may ask whether we disclosed personal information to third parties for their own direct marketing purposes in the prior year. We do not make such disclosures.

16.California notice at collection

In the past 12 months, we have collected the following categories of personal information, as defined by the California Consumer Privacy Act, for the business and commercial purposes described in Section 5, and disclosed them to the categories of recipients in Section 9:

• Identifiers, such as name, email, phone, IP address and account IDs. Sources: you, your Firm, devices, integrations. Disclosed to: service providers, Data Providers, AI Providers, integrations you enable.
• Customer records and financial information (Cal. Civ. Code § 1798.80), such as billing details, account and routing numbers, balances, transactions, statements and check images. Sources: you, your Firm, financial institutions via Data Providers. Disclosed to: service providers, Data Providers, AI Providers, integrations you enable.
• Commercial information, such as Subscription and purchase history. Sources: you. Disclosed to: service providers.
• Internet or network activity, such as usage logs and website interactions. Sources: your devices. Disclosed to: service providers.
• Approximate geolocation derived from IP address. Sources: your devices. Disclosed to: service providers.
• Professional or employment information, such as firm name and job title. Sources: you, business data sources. Disclosed to: service providers.
• Sensitive personal information, specifically financial account numbers and account log-in credentials or tokens that permit access to an account. Sources: you and Data Providers. Used only to provide the Services and for security and legal purposes. Disclosed to: Data Providers and service providers necessary to operate connections.

We retain each category as described in Section 12. We do not sell or share any category of personal information for cross-context behavioral advertising. We do not knowingly sell or share the personal information of consumers under 16.

17.How to submit a request

To exercise your rights, email info@ledgersync.com with the subject line "Privacy Request," or call +1 (877) 415-3152. We will verify your request by matching information you provide with information we hold, which may include confirming access to your account email. You may use an authorized agent, who must provide written proof of authorization, and we may ask you to verify your identity directly. We will respond within 45 days, or as otherwise required by law, and will tell you if we need more time. If we deny your request, you may appeal by replying to our decision with the subject line "Privacy Appeal," and we will respond within the time required by your state's law.

18.Users outside the United States

The Services are designed for customers in the United States and connect primarily to U.S. financial institutions. LedgerSync is based in the United States, and personal information is processed and stored in the United States and in other countries where our service providers, Data Providers and AI Providers operate. If you access the Services from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country. If you are located in a jurisdiction that requires a specific legal basis or transfer mechanism, such as the European Economic Area, the United Kingdom or Canada, please contact us before using the Services so we can discuss whether we can support your requirements.

19.Children

The Services are intended for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 18 except as incidentally contained in financial records a Customer processes. If you believe a child has provided us personal information directly, contact us and we will delete it.

20.Third-party sites

The Services may link to or integrate with websites and services we do not operate, including financial institutions, Data Providers, AI Providers, accounting software and social media. Their privacy practices are governed by their own policies, which we encourage you to review.

21.Changes to this policy

We may update this policy from time to time. We will post the updated version on this page and change the "Last updated" date. If we make material changes, we will notify Customers by email or in-app notice before the changes take effect. Where required by law, we will obtain your consent before using personal information in a materially different way than described when it was collected.

22.Contact us