Privacy Policy

1. Information we collect

Account information

Your username, password (stored only as a salted hash, never in readable form), name, email address if you add one, two factor authentication settings, your plan and billing status, and the time you agreed to these policies.

Company and financial records

What you and your team enter or import: company profile, customers, vendors, employees and contractors, products, invoices, quotes, payments, expenses, bills, bank and credit card transactions, journal entries, sales tax settings, time entries, mileage trips, payroll records you type in, budgets, reports and notes. These records may include personal information about other people, such as your customers’ names, email and postal addresses.

Documents and files

Receipts, statements, attachments, logos, product images, templates and documents you upload, sign or share, and the PDFs we generate for you.

Bank data through Plaid (only if enabled)

Bank feeds are switched off unless the service has been configured to use Plaid. When they are on and you connect a bank, Plaid gives us account names, the last digits of account numbers, balances and transactions for the accounts you choose. You sign in to your bank through Plaid; we never see or store your bank password. Plaid’s handling of your data is described in the Plaid End User Privacy Policy. Without Plaid, bank data only comes from statement files you import.

Payment provider data

When you pay for a plan, Stripe processes your card; we receive the payment status, the last four digits and the card brand, never the full card number. When your business connects its own payment provider account (Stripe, PayPal, Square, Razorpay, Mollie, GoCardless or Lemon Squeezy) to collect invoice payments, we store the connection details you provide (encrypted) and receive payment, fee, refund and payout records so they can be recorded in your books.

Store and processor imports

If you connect an online store (such as Shopify, WooCommerce, Etsy, Amazon or Square) or import payment processor history, we receive the orders, refunds, fees, payouts and product details needed to post them to your books.

Usage and device information

Server logs record the pages and API endpoints requested, the time, your IP address, browser type, error reports and security events such as sign ins. We use them to run, secure and fix the service. With your consent only, Google Analytics also collects usage information (see Analytics and cookies).

Messages and support

Emails you send us and the email we send on your behalf (for example invoices to your customers), including delivery status.

2. How we use it and our legal bases

We do not sell your personal information, we do not share it for cross context behavioural advertising, and we do not use your financial records to train AI models.

3. Processors and subprocessors

We use these service providers to run BooksBat. Each one processes data only on our instructions and under a data processing agreement or equivalent terms.

AI service providers receive only what a feature needs for the request you make, are not allowed to use it to train their models, and every AI feature is optional. We will update this list before adding a new subprocessor that handles customer data.

4. Analytics and cookies

Necessary cookies and storage. We use a session cookie to keep you signed in and browser storage for preferences such as the theme and your cookie choice. These are needed for the service to work and are always on.

Analytics cookies, only with consent. On our website and app we ask before loading Google Tag Manager, which loads Google Analytics. If you choose Accept, Google Analytics collects the pages you view, events such as button clicks and sign ups, device and browser information, and approximate location derived from your IP address, and sets cookies (such as _ga) to recognise repeat visits. If you choose Decline, or make no choice, none of it loads. Google Analytics never receives your financial records, invoices, documents or bank data. Analytics never loads on the pages your customers see, such as invoice and quote links, lead forms, signing pages and shared documents.

Your choice is remembered for 12 months, then we ask again. You can change it at any time with Cookie settings in the footer of our website. We do not use advertising trackers or sell data to advertisers.

5. When we share information

• With the people you choose: team members and accountants you invite, customers you send invoices, quotes or statements to, and anyone you share a document link with.
• With the services you connect: payment providers, stores, banks and other integrations you turn on, and API keys or MCP clients you create.
• With our processors listed above.
• For legal reasons: when required by law, a court order or to protect the rights, safety and property of our users, the public or us. Where allowed, we tell you about a request for your data first.
• In a business transfer: if we are involved in a merger or acquisition, under the same protections as this policy, and we will tell you beforehand.

6. Retention and deletion

• We keep your data while your account is open, so your books stay complete.
• You can export your company data at any time (Settings, Import and export).
• When you delete your account in Account settings, your account and the companies you own, with their records and files, are deleted from our live systems right away, and in any case within 30 days. Backups kept for disaster recovery age out on their normal schedule (no more than 35 days) and are never restored except to recover from a disaster.
• Server logs are kept for up to 30 days. Security and audit records may be kept longer while the account exists.
• Billing records we must keep for tax and accounting law are kept for the period the law requires (generally 6 to 7 years).

7. Your rights

Depending on where you live you have the right to access your personal information, get a copy in a portable format (export), correct it, delete it, restrict or object to some processing, and withdraw consent at any time without affecting earlier processing.

• European Economic Area and United Kingdom (GDPR and UK GDPR): you also have the right to lodge a complaint with your data protection supervisory authority, such as the ICO in the UK.
• California (CCPA and CPRA): you have the right to know what personal information we collect, use and disclose, to delete and correct it, and to opt out of its sale or sharing. We do not sell or share personal information as those laws define it and do not use sensitive personal information for purposes that require an opt out. We will not discriminate against you for using your rights. An authorised agent may make a request for you with your written permission.
• Canada (PIPEDA): you may access and ask us to correct your personal information and withdraw consent, and you may complain to the Office of the Privacy Commissioner of Canada.

How to use your rights: most can be done in the app: edit your profile in Account settings, export company data from Settings, and delete your account in Account settings. For anything else email [email protected]. We may need to verify your identity, and we reply within 30 days (45 days for California requests, extendable where the law allows).

If you are a customer, employee or vendor of a business that uses BooksBat, that business controls your information. Please contact them first; we will help them respond.

8. International transfers

Our providers may process data in the United States, Canada, the European Union and other countries. When personal information from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or another lawful transfer mechanism, together with the security measures below.

9. Security

We protect your data with TLS encryption in transit, encryption at rest by our database and storage providers, payment provider and integration credentials encrypted with a separate key, hashed passwords, two factor authentication, access controls with role based permissions for team members, an audit log of every change to your books, rate limits and restricted, logged staff access. No system is perfectly secure; if a breach affects your personal information we will notify you and the authorities as the law requires. See our Security page for details.

10. Your customers and team members

For the records you keep about your customers, vendors, employees and team members, you are the controller and we act as your processor. You are responsible for having a lawful basis to enter their information and for answering their requests. Our Terms of Service include our commitments as your processor.

11. Children

BooksBat is a business tool for adults. It is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.

12. Changes to this policy

We may update this policy as the service or the law changes. We will change the effective date above, and for material changes we will notify you by email or in the app at least 30 days before they take effect.

13. Contact us

BooksBat is responsible for your personal information under this policy. Questions, requests and complaints: [email protected].