Privacy Policy

These terms are the agreement between you and [Company legal name] ("SyncBooks", "we", "us") for using SyncBooks. We have tried to write them the way we would explain them across a table. Each section starts with a short summary; the text under it is what actually applies.

1. Who these terms cover

In short: anyone who signs in to SyncBooks, and the business they use it for.

If you sign up for a business, you agree to these terms for that business, and you confirm you are allowed to do that.

People you invite to your workspace agree to these terms when they create their login. Your customers and suppliers who only use a portal link or a pay link are not bound by these terms, but you are responsible for how you use SyncBooks with them.

2. Your workspace, companies and people

In short: a workspace belongs to its owner. The owner decides who gets in and what they can see.

A workspace holds one or more companies. The person who creates it is its owner, and ownership can be transferred to another member.

The owner, and anyone the owner gives the right to, can invite members, give them a role, limit them to certain companies, and remove them. Collaborators such as your accountant only see the companies you approve.

You are responsible for everything done in your workspace by the people you let in. If you remove someone, their access ends right away.

3. Your login

In short: keep your password to yourself, and tell us if you think someone else is using your login.

Give us a real name and an email address you can read. Every login belongs to one person; do not share it.

You can see every device signed in to your login under Your account, and sign any of them out. We strongly recommend turning on two-step verification. A workspace can require it of every member.

If you think someone else has used your login, change your password (this signs out every other device) and write to us at [Support email].

4. Your data is yours

In short: you own what you put into SyncBooks. We use it only to run the service for you, and you can take it with you.

You keep all rights to the records you enter, import or connect ("your data"). You give us permission to store, copy, process and display your data only as needed to run SyncBooks for you, keep it safe, and support you.

We do not sell your data. We do not use it for advertising.

A workspace owner can download a full export of the workspace's records at any time, including when the subscription has ended.

The Privacy Policy explains what we keep, where, and for how long.

5. What SyncBooks is, and what it is not

In short: SyncBooks is a tool. It does the arithmetic and keeps the records, but it is not your accountant, tax adviser or lawyer.

SyncBooks helps you keep books, track inventory, send invoices, pay bills and run payroll. It calculates figures from what you and your connected services give it.

You are responsible for checking your figures, and for the returns and payments you file with tax authorities, including sales tax and payroll taxes. SyncBooks calculates payroll taxes from the published tables it has loaded; unless we agree otherwise in writing, you pay and file them yourself.

Sales tax rates, payroll tables and exchange rates come from published sources and can be out of date or wrong for your situation. Check them against your own advice before you rely on them.

6. Services you connect

In short: when you connect another service, you are asking SyncBooks to exchange data with it on your behalf. That service's own terms apply to it.

SyncBooks can connect to services such as Shopify, Stripe, Plaid, online marketplaces, advertising platforms, QuickBooks Online, Xero and your own mailbox. You choose which to connect, and you can disconnect any of them at any time.

When you connect one, SyncBooks reads from it and writes to it only as needed for the features you use. That service's own terms and privacy policy govern your use of it.

We are not responsible for another service's outages, mistakes or changes, but we will tell you when a connection stops working and we can see it.

7. Getting paid online

In short: card payments go through your own Stripe account. SyncBooks never holds your money and never sees card numbers.

If you connect Stripe, your customers can pay invoices, deposits and statements by card from a link. The payment is made to your own Stripe account, under your agreement with Stripe. Stripe's fees are charged by Stripe.

SyncBooks records the payment against the invoice when Stripe confirms it. Refunds are made through the same Stripe account.

Paying bills and employees by bank transfer (ACH) needs a payment provider. [ACH provider name and its terms, once chosen.]

8. Customer and supplier portals

In short: if you switch a portal on, your customers or suppliers can sign in with a link sent to the email address on their record.

A portal shows one customer or one supplier only what belongs to them. Sign-in links go to the address on their record, so keep those addresses right. You can block any customer or supplier from the portal at any time.

9. Plans, trials and payment

In short: you pay for a plan in advance. Prices and limits are shown before you buy.

Plans are sold on [syncbooks.com store URL]. The price, billing interval, and the number of companies and people each plan includes are shown there before you buy. [Trial length and terms.]

Subscriptions renew automatically until you cancel. Prices do not include taxes unless the store says so. [Refund policy.]

We may change prices for future billing periods. We will tell the workspace owner at least [30] days before a change reaches them.

10. If a subscription ends

In short: nothing is deleted. The workspace becomes read-only, and you can still export everything.

When a subscription is canceled and its paid period ends, the workspace becomes read-only: people can still sign in, read their records and download an export, but cannot change anything.

We do not delete a workspace automatically because a subscription ended. How long we keep a read-only workspace before asking you about it is [Retention period for a lapsed workspace].

11. Fair use

In short: do not use SyncBooks to break the law, harm others, or harm SyncBooks.

You agree not to:

• use SyncBooks for anything illegal, fraudulent, or to hide money or goods from anyone entitled to know about them;
• enter data you have no right to hold, or send mail through SyncBooks to people who did not agree to receive it;
• try to reach another workspace's data, test our security without our written permission, or get around limits on your plan;
• overload the service, including through the API, or copy SyncBooks to build a competing product.

If you do, we may suspend access. We will tell you why, and give you a chance to fix it first unless the harm is serious or ongoing.

12. The API and automations

In short: API keys and workflow rules act for you, with no more access than you give them.

An API key can reach only the companies and permissions chosen when it was made, never more than the person who made it still has. It expires after 365 days unless a shorter time is chosen, and can be revoked at any time. Keep keys secret; anything done with a key counts as done by your workspace.

Workflow rules act as the person who saved them, and never with more access than that person has.

13. Availability and changes

In short: we work hard to keep SyncBooks running, but we cannot promise it will never be down.

We back up your data every night and watch the service for errors. Even so, SyncBooks may sometimes be unavailable, for maintenance or because something went wrong. [Service level commitment, if any.]

We improve SyncBooks all the time. We may change or remove a feature; if a change takes away something you rely on, we will tell you in advance where we reasonably can.

14. Ending your account

In short: you can leave at any time. Export first, then ask us to delete.

You can cancel your subscription at any time; it runs until the end of the period you paid for.

To delete your login, or all of a workspace's data, send a request from Your account. A person at SyncBooks handles each request. Some records may have to be kept longer because the law requires it; the Privacy Policy explains which.

We may end our service to you for a serious or repeated breach of these terms, with [30] days' notice except where the law or the harm requires faster action. You can still export your data during that notice.

15. Our responsibility to you

In short: [To be written by a lawyer. This section limits what either side can claim if something goes wrong.]

[Warranty disclaimer.]

[Limitation of liability, including the cap, for example the fees paid in the 12 months before the claim.]

[Indemnities, if any.]

16. Changes to these terms

In short: when these terms change, you will see the new version and be asked to accept it before you continue.

Each version of these terms is published with its date, and earlier versions stay readable on this page. When we publish a new version, SyncBooks asks every person to read and accept it the next time they use the service.

17. The law that applies

In short: [To be written by a lawyer.]

These terms are governed by the laws of [Governing law]. Disputes will be handled by the courts of [Venue], unless the law where you live gives you the right to go to your local courts.

18. Contact

In short: write to us. A person will answer.

[Company legal name] [Registered address] [Support email]$legal$ WHERE d."kind" = 'terms' AND d."isPlaceholder" AND d."pk" = (SELECT c."pk" FROM legal_documents c WHERE c."kind" = 'terms' ORDER BY c."publishedAt" DESC, c."pk" DESC LIMIT 1);

UPDATE legal_documents d SET "body" = $legal$This policy explains what SyncBooks keeps, why, where, for how long, and who else sees it. SyncBooks is run by [Company legal name] ("SyncBooks", "we", "us"). Each section starts with a short summary.

1. The short version

In short: we keep what we need to run your books, we protect the sensitive parts, and we do not sell anything or track you for advertising.

• We keep your login details and the records your business puts into SyncBooks.
• Social Security numbers, bank account numbers, tax IDs and the passwords of connected services are encrypted before they are stored.
• We never see or store card numbers. Card payments go straight to Stripe.
• There are no analytics or advertising trackers in SyncBooks.
• You can export everything, and ask us to delete it.

2. Two kinds of data, two roles

In short: for your own login, we decide how the data is used. For the records your business keeps about other people, your business decides, and we follow its instructions.

Your login (your name, email address, password and sign-in history) is ours to look after. For it, we are the "controller", and this policy is our promise to you.

Your business also keeps records about other people in SyncBooks: its customers, suppliers and employees. For those records your business is the controller and we are its "processor": we store and process them only to run SyncBooks for your business. If you are one of those people, ask the business first; we will help it answer you. [Data processing agreement, when available.]

3. What we keep about you

In short: who you are, how you sign in, and what you agreed to.

• Your name, email address and, if you add them, your phone number and profile photo.
• Your password, stored only as a one-way hash (bcrypt). Nobody at SyncBooks can read it.
• Two-step verification: the secret your authenticator app uses (encrypted) and your recovery codes (hashed).
• Your signed-in devices: when each session started and was last used, and the internet address and browser it came from.
• What you accepted: which version of the Terms of Service and Privacy Policy, when, from which address and browser, and at which step (sign-up, invitation or a new version).
• Your settings, such as language, time zone, Home layout and notification choices.
• Requests you send us, such as a request to delete your login.

4. What we keep for your business

In short: the records you enter, import or connect. That is the service.

• Companies, their addresses, logos, branding and settings.
• Customers and suppliers: names, email addresses, phone numbers, addresses, notes, and the records of what you sold to or bought from them.
• Products, stock, locations, purchase orders, sales, invoices, bills, payments, bank lines, receipts you upload or forward, journal entries and reports.
• Payroll: employees' names, addresses, pay, tax withholding choices (W-4), Social Security numbers and bank accounts for direct deposit. The Social Security numbers and bank accounts are encrypted.
• Suppliers' tax details (W-9) and bank accounts for paying them. Encrypted.
• The team: who is a member of which workspace, their role and which companies they can see.

5. What we get from services you connect

In short: only what the features you switched on need, and only after you connect the service.

• Shopify, marketplaces and other sales channels: orders, products, stock, and the buyer names, email addresses, phone numbers and addresses on orders.
• Stripe: payments, refunds, fees and payouts on your own Stripe account.
• Plaid (bank feeds): the transactions and balances of the accounts you choose.
• Advertising platforms: daily spend per campaign. No personal data about the people who saw the ads.
• QuickBooks Online and Xero: the records you choose to bring over when switching.
• Your mailbox, if you connect one: the invoices and statements SyncBooks sends from it, and, if you switch it on, the receipts that arrive in its receipts folder.

The sign-in details for these connections (tokens, keys and passwords) are encrypted before they are stored.

6. What we do not collect

In short: no card numbers, no tracking, no selling.

• We never receive card numbers. Your customers type them into Stripe's own payment form.
• SyncBooks has no analytics, advertising or social media trackers.
• We do not sell personal data, or share it for advertising.
• We do not build profiles of you or of your customers.

7. How we use it

In short: to run SyncBooks, keep it safe, and talk to you about it.

• To provide the features you use: bookkeeping, inventory, invoicing, payments, payroll and reports.
• To keep your login and your data safe: spotting unusual sign-ins, blocking automated attacks, and keeping records of who changed what.
• To send you the email the service needs: invitations, sign-in links, password resets, alerts you asked for, and notices about your subscription or these documents.
• To answer your questions and fix problems.
• To meet our legal obligations.

We do not send marketing email unless you ask for it. [Marketing email policy, if any.]

8. Who else sees it

In short: a few service providers that SyncBooks cannot run without, the services you connect yourself, and no one else.

Service providers that process data for us:

• [Hosting provider]: runs the servers and the database.
• [Backup storage provider]: holds copies of the nightly backups.
• [Email provider]: delivers the email SyncBooks sends.
• Google reCAPTCHA: checks that sign-in, sign-up and password reset requests come from a person. Google receives your internet address and browser details on those pages.
• Google Fonts: serves a typeface SyncBooks uses. Google receives your internet address; no cookie is set.
• Shopify and PayPal: take payment for SyncBooks subscriptions on our store.
• [ACH provider, once chosen]: sends bill payments and direct deposits.

Services you connect yourself (section 5) receive what SyncBooks sends them to do the job you asked for, under their own privacy policies.

We may also share data when the law requires it, to protect people from harm, or if SyncBooks is sold or merged, in which case this policy continues to apply to your data.

9. Where it is stored

In short: in one database, in [Country or region], with nightly backups kept elsewhere.

Your data is stored in a PostgreSQL database hosted by [Hosting provider] in [Country or region]. Files you upload, such as logos, profile photos and receipts, are stored in the same database.

A backup of the database is made every night and copied to [Backup storage provider] in [Country or region].

[How data transferred between countries is protected, for example Standard Contractual Clauses.]

10. How long we keep it

In short: your business records for as long as your workspace exists. Security and technical records for a fixed, short time.

• Your business records: for as long as the workspace exists. If the subscription ends, the workspace becomes read-only and nothing is deleted. After a deletion request: [Retention period after deletion], because tax and accounting law may require financial records to be kept.
• Your login: until you ask us to delete it.
• Signed-in sessions: until you sign out, or sign the device out from Your account. Changing your password signs out every other device. A session that is never signed out expires after one year, and expired sessions are deleted within 15 minutes.
• Password reset links: one hour, and they work once. Email confirmation links: 24 hours.
• Customer and supplier portal sign-in links: one hour. A portal session lasts 7 days.
• Server logs: 30 days.
• The log of requests made with your API keys: 90 days.
• Records of webhooks sent to your systems, and of finished background jobs: 30 days.
• Backups: made every night. The newest 14 are kept on the server; copies kept elsewhere are deleted after [Off-server backup retention]. Data you delete can remain in a backup until that backup is deleted.
• Records of what you accepted, and of deletion requests: for as long as the login exists, and afterwards for [Retention period for consent records], so we can show what was agreed and done.
• The accounting audit log (who posted, reversed or closed what): kept with the company's books. It cannot be edited.

11. How we protect it

In short: encryption, strict separation between workspaces, and records that cannot be quietly changed.

The Security page explains this in detail. The main points: every connection is encrypted, sensitive fields are encrypted in the database, each workspace can reach only its own records, and every change to the books is recorded in a log that cannot be edited.

12. Your choices and rights

In short: you can see, correct, export and delete your data. Most of it you can do yourself.

• See and correct: your profile is under Your account; your business records are in the app.
• Export: a workspace owner can download every record of the workspace as one file, at any time.
• Delete: send a request from Your account, for your login or (as the owner) for a whole workspace. A person handles it and answers within [Response time, for example 30 days].
• Sign out: see every signed-in device under Your account and sign any of them out.
• Cookies: choose under Manage cookies at the foot of any SyncBooks page.

Depending on where you live, you may have further rights, such as to object, to restrict processing, or to complain to a data protection authority. [Rights by region, for example GDPR and US state laws.] To use any of them, write to [Privacy email].

13. If you hold data about others in SyncBooks

In short: your business is responsible for having the right to keep its customers', suppliers' and employees' data. We help it meet those duties.

Only enter data about other people that your business is allowed to hold. When a Shopify store asks SyncBooks to erase a customer's data, SyncBooks removes that customer's name, email address, phone number, addresses and notes from its records automatically, and keeps the amounts the books need.

14. Children

In short: SyncBooks is for businesses, not children.

SyncBooks is not meant for anyone under [Minimum age]. We do not knowingly keep a child's login.

15. Changes to this policy

In short: when this policy changes, you will see the new version and be asked to accept it.

Each version is published with its date, and earlier versions stay readable on this page. When we publish a new version, SyncBooks asks every person to read and accept it the next time they use the service.

16. Contact

In short: write to us about anything in this policy.

[Company legal name] [Registered address] [Privacy email] [Data protection officer or representative, if required]