Privacy Policy

• Your account. Your name and email address, the firm or business you belong to and your role there, your password (stored only as a one-way scrypt hash), your two-factor authentication secret (encrypted) and recovery codes (hashed), the mobile number your codes are texted to if you choose text messages (encrypted), your email preferences, and when you accepted our Terms.
• Firm details. A firm's name, contact email, city, logo, brand color and settings.
• Books from QuickBooks Online. For each client a firm connects, for up to 36 months: the company name, chart of accounts, monthly profit and loss and balance sheet amounts, budgets, and transaction detail (dates, types, numbers, customer and vendor names, memos, classes, locations and amounts), plus open invoices and bills with customer and vendor names. Ledgerlight only reads from QuickBooks.
• Reports and activity. Monthly reports, their highlights, comments and approvals; the questions a firm's clients ask about their reports and the firm's answers; when each client sign-in opened a published report; and a log of what each person did in the firm (sign-ins aren't in it; changes are).
• Requests and documents. What a firm asks its clients, including which of their transactions it asks about; the clients' answers; and the files they send with them, like statements and receipts. Files are encrypted again by Ledgerlight, and kept until the firm or the client removes them, or the firm leaves Ledgerlight.
• Email and text message records. To whom we sent an email, what kind it was, its subject and whether it was delivered; for a text message (a sign-in code), the last four digits of the number, and whether it was sent. Not their text.
• Technical information. Your IP address, kept only as a one-way hash, to limit repeated sign-in attempts. Our hosting provider's request logs, which include IP addresses and browser details. The cookies described below.

We don't use analytics, advertising trackers or third-party cookies. We don't take card payments in the app: firms are invoiced separately.

• To run Ledgerlight: signing you in, updating books from QuickBooks, building dashboards, reports and PDFs, and showing each person only what they may see.
• To show a firm when its clients have opened their reports, and to carry questions, requests, answers and files between the client and the firm, including reminders about requests still waiting.
• To send emails you need: invitations, password and sign-in links, security notices, and notices such as a new report or a QuickBooks connection to fix. You can turn off the notices on your Account page; security emails always go.
• To keep Ledgerlight secure: limiting sign-in attempts, requiring two-factor authentication where it applies, and keeping logs to investigate problems.
• To help when asked: our support team can look into a firm's workspace to help it, without changing anything, and each look is recorded in the firm's activity log.
• To tell firms about changes to Ledgerlight or these documents, and to meet legal obligations.

AI drafts. If a firm's owner turns them on, a report's highlights can be drafted by Anthropic's Claude. It receives that client's figures and account names, never the names of the firm, the client, or their customers or vendors. The firm reviews every draft before a client sees it.

We don't sell personal information, or share it for advertising. We don't use firms' or clients' books to train AI models.

These companies handle information for us, under contracts that limit them to doing that:

We also share information:

• Within a firm. A firm's owners and staff see its clients' books and its activity log. A client sees their own business and the reports the firm publishes.
• With Intuit QuickBooks Online. Ledgerlight connects to QuickBooks with the authorization given in QuickBooks, to read the books. Intuit's own privacy statement covers QuickBooks.
• When the law requires it, or to protect people's safety or our rights, and only as much as needed.
• If our business changes hands, with the new owner bound by this policy. We'd tell firm owners first.

Ledgerlight uses only what it needs to work:

Information travels encrypted, is stored on Google Cloud in the United States, and is protected by measures including two-factor authentication, hashed passwords and links, and extra encryption for QuickBooks access. Our security page has the details.

• Change your name or password, sign out other devices, and turn notice emails on or off, on your Account page.
• Ask us to see, correct, delete or give you a copy of your information by writing to support@openbitech.com. If it's part of a firm's records, such as a client's books, we'll pass your request to that firm, which decides.
• Depending on where you live, you may have further rights under your state's privacy law. We won't treat you differently for using them.

We answer requests within 45 days, after checking that the request is really from you.

In the United States (Google Cloud's Iowa region). If you use Ledgerlight from elsewhere, your information is transferred to the United States.

Ledgerlight is for businesses and isn't meant for anyone under 16. We don't knowingly collect information about children.

We'll post any change here with a new date. For a change that matters, we'll also email firm owners before it takes effect.

Openbit Technology LLC, 9478 Launch Point Rd, Orlando, FL 32832. Email: support@openbitech.com.