Privacy Policy

Effective Date: May 7, 2026  ·  Last updated: May 7, 2026

1. Overview

EasyAccounting ("we," "us," or "our") provides AI-powered accounting software for small businesses at easyaccounting.online. This Privacy Policy describes how we collect, use, store, and protect personal information, including data obtained through third-party integrations such as Gusto and Plaid.

2. Data We Collect

Data You Provide Directly

• Account information: name, email address, password (hashed — never stored in plaintext)
• Company information: business name, address, EIN, phone number
• Financial records: invoices, expenses, bills, bank transactions, payroll runs
• Employee records: name, email, SSN (encrypted at rest), pay rate, W-4 elections

Data From Third-Party Integrations

• Gusto (when connected): employee roster and processed payroll runs via OAuth. We do not write data back to Gusto or access SSNs through the Gusto API.
• Plaid (when connected): bank account identifiers and transaction history for reconciliation.
• Shopify, Stripe, QuickBooks, Ramp: transaction and order data limited to what is needed for accounting purposes.

Automatically Collected Data

• Server-side error events (Sentry) — stack traces and request context; no financial data transmitted
• Aggregate product usage events (PostHog) — page views and feature usage; no financial data transmitted
• Web server access logs — IP address, timestamp, request path; retained 30 days

3. How We Use Data

Purpose	Legal Basis
Providing accounting services (invoicing, payroll, reporting)	Contract performance
Populating payroll tax forms (941, 940, W-2, state forms)	Legal obligation
Syncing third-party integration data (Gusto, Plaid)	User consent via OAuth
Error monitoring and service reliability	Legitimate interest
Aggregate product analytics	Legitimate interest

We do not sell, rent, or share personal data with third parties for marketing purposes.

4. Data Storage and Security

• Infrastructure: DigitalOcean cloud hosting (US region)
• Encryption in transit: TLS 1.2+ enforced on all connections
• Encryption at rest: Sensitive fields (SSN, OAuth tokens, bank credentials) encrypted using AES-256
• Passwords: bcrypt-hashed; never stored or logged in plaintext
• Multi-tenancy: All data is isolated by company — no query can return another company's records
• Two-factor authentication: TOTP (authenticator app) available to all users

5. Data Retention

Data Type	Retention Period
Accounting and payroll records	Duration of subscription + 7 years (IRS requirements)
Gusto-synced employee and payroll data	Duration of subscription + 7 years
OAuth tokens (Gusto, Plaid, etc.)	Deleted immediately upon disconnecting the integration
Server access logs	30 days rolling
Database backups	30-day rolling window

6. Third-Party Sub-processors

Sub-processor	Purpose	Data Shared
DigitalOcean	Cloud hosting and file storage	All application data
Anthropic	AI assistant (Claude API)	Chat messages and tool call context
Sentry	Error tracking	Stack traces, request metadata (no financial data)
PostHog	Product analytics	Page views, feature events (no financial data)
SendGrid / SMTP	Transactional email	Recipient email, invoice reference

7. Your Rights

You may at any time:

• Access your data via the application or by contacting us
• Export your data (P&L, Schedule C, payroll records, invoice history)
• Delete your account and all associated data — requests fulfilled within 30 days
• Disconnect third-party integrations — OAuth tokens are immediately revoked and deleted

8. Data Breach Notification

In the event of a confirmed data breach affecting personal information, we will notify affected users within 72 hours of confirmation and provide a description of the breach, data affected, and remediation steps taken.

9. Changes to This Policy

Material changes will be communicated via email to account owners at least 14 days before taking effect.

10. Contact