Privacy Policy

1. Introduction

DeepLedger Inc. ("DeepLedger," "we," "us," or "our") operates the DeepLedger platform, including the website at deepledger.ai, the DeepLedger portal, MCP server, and Claude Code plugin (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By accessing or using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

• Account registration data (name, email address, firm name)
• Organization and team member details you configure
• Documents you upload (receipts, invoices, statements)
• Messages and instructions you provide to AI agents
• Support inquiries and correspondence
• Waitlist information you submit (email, optional product edition and use case), with your consent to contact you about that product's research and availability. You can request removal at hello@deepledger.ai.

2.2 Information from Third-Party Services

• QuickBooks Online: When you connect your QuickBooks account via OAuth 2.0, we access your financial data (transactions, invoices, bills, vendors, customers, accounts, and reports) as authorized by the scopes you grant. We store encrypted OAuth tokens to maintain the connection.
• Supabase: Authentication data and session tokens managed through Supabase Auth.
• Connected Banks: If bank connections are enabled for your company and you choose to connect a bank through Plaid, we receive authorized account information, balances and transactions to provide your bank feed. We also process bank data in files you choose to import.

2.3 Automatically Collected Information

• Device and browser information (type, operating system, browser version)
• IP address and approximate geographic location
• Usage data (pages viewed, features used, timestamps)
• Cookies and similar tracking technologies

3. How We Use Your Information

We use collected information to:

• Provide, operate, and maintain the Service
• Perform AI-powered bookkeeping tasks (transaction categorization, reconciliation, financial reporting)
• Store AI agent memory to improve accuracy of bookkeeping patterns for your organization
• Generate audit logs and maintain an action trail for compliance
• Send you service-related notifications and updates
• Route items that need human review to the task list in the portal
• Respond to your support requests
• Detect and prevent fraud, errors, and security incidents
• Comply with legal obligations

4. QuickBooks Data: Special Provisions

When you connect your QuickBooks Online account to DeepLedger, we adhere to Intuit's developer policies and data-handling requirements:

• We only access QuickBooks data within the scopes you explicitly authorize during the OAuth consent flow.
• QuickBooks OAuth tokens are encrypted at rest and are never shared with third parties.
• We do not sell, rent, or trade your QuickBooks financial data to any third party.
• QuickBooks data is used solely for the purpose of providing the Service (AI bookkeeping, reporting, reconciliation).
• You may disconnect your QuickBooks account at any time through the portal settings to stop DeepLedger from using that connection. Disconnecting does not cancel your DeepLedger service.
• We delete cached QuickBooks data 30 days after your paid DeepLedger service ends following cancellation. This does not delete records in QuickBooks Online.

5. Data Sharing and Disclosure

We do not sell your personal information. We may share data only in the following circumstances:

• Service Providers: With trusted third-party providers (Supabase for database/auth, Anthropic for AI processing, Render for hosting, Resend for email delivery and Plaid for optional bank connections) who process data on our behalf under contractual obligations.
• Email Delivery: Resend processes recipient email addresses, names when provided, message content and delivery information to send account, billing, security, support and enabled report emails. Report emails may contain financial information from the report you enabled. We also maintain delivery and suppression records to handle bounces, complaints and communication preferences. See Resend's Privacy Policy.
• Bank Connections: Plaid and Stripe Financial Connections connect to the financial institutions you authorize and provide account and transaction data for the bank feed. Linking a bank is optional and is available only for companies where this feature is enabled. See Plaid's End User Privacy Policy and the Stripe Financial Connections end-user terms.
• Payment Processing: Stripe, our payment processor, processes payments and billing details when you purchase a subscription. We never receive or store card numbers. Stripe's privacy policy: stripe.com/privacy.
• AI Agents You Connect: When you use DeepLedger through an external AI agent, data returned by the tools you authorize is sent to that agent to fulfill your request. Its provider processes that data under its own terms and privacy policy. Review the provider's retention and training controls before connecting it.
• Within Your Organization: Data is shared among team members within your firm/organization as configured by your administrator.
• Legal Requirements: When required by law, regulation, legal process, or governmental request.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with notice to affected users.
• With Your Consent: When you explicitly authorize additional sharing.

6. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption in transit (TLS/HTTPS) and at rest
• OAuth 2.0 for all third-party integrations (no passwords stored)
• Row-level security (RLS) policies in our database ensuring organization-level data isolation
• Encrypted storage of QuickBooks OAuth tokens
• Regular security reviews and monitoring
• Role-based access control for team members

While we strive to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security. Our Security and Trust Center describes these measures and our service providers in more detail.

7. Data Retention and Deletion

• Account data is retained as long as your account is active.
• We delete your DeepLedger workspace data 30 days after your paid service ends following cancellation. This includes uploaded documents, bank feed data, tasks, cached QuickBooks data, AI memory, AI chat history, activity logs, preferences and stored connection credentials.
• Export any records you need before this deletion date. Your records in QuickBooks Online are not deleted by DeepLedger.
• Backup copies and service-provider logs may remain until the applicable retention cycle expires; deletion from active workspace systems does not mean immediate removal from every backup or provider log.
• We may retain billing and payment records, support correspondence, security records and minimal email suppression records where necessary for legal obligations, dispute resolution, fraud prevention or honoring communication preferences. These records are separate from the workspace data covered by the deletion schedule.
• Copies held by AI providers or other services you connect are subject to their own retention policies. Request deletion from those providers separately.
• You may request deletion of your data at any time, without cancelling first: from Settings › Account › Delete your data in the DeepLedger portal, or by contacting us at hello@deepledger.ai. Any user may request deletion of their own account; an owner or admin may request deletion of the whole workspace. We confirm each request by email, complete it within 30 days of receiving it, and notify you when it is done. The exceptions above (QuickBooks records, backups, legally required records and copies held by services you connected) apply to these requests too.

8. Cookies and Tracking

We use essential cookies for authentication and session management. If you accept analytics cookies, Google Analytics 4 measures visits to our public website and blog, using information such as page names, referring websites, browser and device details, and a cookie-based identifier. Google processes this information to provide website usage reports. Optional analytics is off until you accept it.

We do not send account, bookkeeping or financial data to Google Analytics. Our integration excludes private portal and authentication pages, URL query parameters and fragments, and form contents. We do not enable Google advertising features. Use Cookie settings in the website footer to accept or reject analytics at any time. Rejecting analytics stops collection and removes our analytics cookies from your browser. You can also control cookies through your browser settings. How Google uses information from sites that use its services.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data (from Settings › Account › Delete your data, or by email)
• Object to or restrict processing of your data
• Data portability (receive your data in a structured format)
• Withdraw consent for data processing
• Disconnect third-party integrations (QuickBooks) at any time

To exercise any of these rights, contact us at hello@deepledger.ai.

10. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware of such collection, we will delete the data promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Continued use of the Service after changes constitutes acceptance of the revised policy.

12. Contact Us

If you have any questions about this Privacy Policy, please contact us:

• Email: hello@deepledger.ai
• Website: deepledger.ai