Privacy policy

This policy explains how saas.group LLC, operating as MyWorks Software ("MyWorks", "we", "us") collects, uses and protects information when you use Ledgerloom (the "service") or this website, ledgerloom.ai. The short version:

• We never sell your data or your clients' data.
• We never use your clients' accounting data to train AI models.
• Ledgerloom reads your clients' books only when you or your team ask for something, and passes the result to the AI app you asked from. We don't keep copies of the books.
• Each person at your firm can reach only the clients your firm gives them.

1. Information we collect

Account information. Your name, email address and firm name, and the same details for teammates you invite. We also store each person's role and which clients they can access.

Connection credentials. When you connect a client's QuickBooks company, Intuit gives us an access credential so Ledgerloom can read that company on your behalf. We store it encrypted and use it only to provide the service. We never see your QuickBooks password.

Connections to AI apps. When someone at your firm connects an AI app such as Claude or ChatGPT, we store a credential for that connection (only a secure hash of it) and which app and person it belongs to.

The activity log. For every request an AI app makes through Ledgerloom, we record who made it, from which app, for which client, what kind of information was looked up (for example "profit and loss, October 2026"), when, whether it succeeded, and how much data was read. The log doesn't contain the figures or records that were returned. Your firm can see and export it.

Usage and diagnostic data. How the service's features are used, error reports, and standard server logs, so we can fix problems and improve the service.

Support conversations. If you contact us, we keep the conversation so we can help you over time.

This website. If you request early access, we store what you enter in the form (name, email, firm name, number of clients, which accounting software your clients use), how you found us if the link you used says so, and the country your request came from. We may use Google Analytics to count visits, with Google Signals and ad personalisation turned off.

2. Your clients' accounting data

This is the information firms trust us with most, so here is exactly how it's handled.

• Read on request. Ledgerloom reads a client's books only to answer a request from someone at your firm who has access to that client, made through an AI app they connected.
• Passed through, not stored. What Ledgerloom reads is sent to the AI app that asked for it. We may hold it briefly in memory or a short-lived cache, for minutes, so the same report isn't read twice in one conversation. We don't keep it in our database, logs or backups.
• Sensitive numbers. By default, tax ID numbers and bank account numbers are shortened to their last four digits before they reach an AI app. Your firm can change this per client.
• Changes to the books. Ledgerloom is read only at launch. If your firm turns on write access when it becomes available, changes are made only with the approval of someone at your firm, and we keep a record of what was changed so it can be reviewed.
• Never for training. We don't use your clients' accounting data, or anything derived from it, to train or improve AI or machine learning models.

If we add support for accounting software that requires keeping a copy of the data, such as QuickBooks Desktop, we'll describe how that copy is handled here before that support launches.

3. AI apps you connect

When you ask a question in an AI app, that app's provider (for example Anthropic for Claude, or OpenAI for ChatGPT) receives the data Ledgerloom returns. How the provider handles it is governed by your agreement with them and the settings of your plan, not by this policy. Choose AI apps and plans that meet your confidentiality obligations to your clients.

4. How we use information

• To provide the service: connecting your clients' books, answering your AI apps' requests, and enforcing your firm's access settings.
• To show your firm its activity log and usage.
• To send email you need, such as sign-in links and invitations.
• To answer support requests and tell you about changes to the service.
• To understand how the service is used, fix problems and improve it, using account and usage data, not your clients' accounting data.
• To keep the service secure and prevent abuse.
• To follow up on early-access requests.

5. What we never do

• We never sell your data or your clients' data.
• We never share it with advertisers or data brokers.
• We never let one firm see another firm's data.
• We never use data from QuickBooks or other accounting software for anything except providing the service to you.

6. Service providers

We use these providers to run Ledgerloom. They process information only on our behalf and under contracts that require them to protect it.

• Amazon Web Services - hosting and database (United States).
• Cloudflare - website hosting, network security, and early-access form storage.
• Postmark - sending email such as sign-in links.
• Sentry - error reporting.
• Mixpanel and Segment - product analytics about how the service is used.
• Intercom - customer support conversations.
• Google Analytics - website visit statistics.
• Stripe - payment processing, once paid plans are available.

Intuit (QuickBooks) is not a service provider. It's where your clients' books live, and its own privacy terms apply to your use of QuickBooks.

7. Retention and deletion

• Disconnecting a client deletes its access credential immediately and revokes it with Intuit. You or your client can also revoke access from inside QuickBooks at any time.
• Removing a teammate or an AI app connection ends that access immediately.
• The activity log is kept while your firm's account is open, so your firm can review it.
• Closing your account deletes your firm's data within 30 days. Database backups expire within a further 7 days.
• Early-access requests are kept until you ask us to remove them or we no longer need them to contact you.

8. Your rights

Depending on where you are, you may have rights to access, correct, export, delete or restrict the processing of your personal information, under laws such as the GDPR or the CCPA/CPRA. For account and website data, MyWorks is the controller. For your clients' accounting data, we process it on your firm's behalf and instructions. To make a request, email legal@myworks.software. We respond within 30 days, and we never treat anyone differently for exercising these rights.

9. Security

Data is encrypted in transit and at rest. Accounting software credentials are also encrypted at the application level, and they never appear in logs, error reports or responses. Every firm's data is separated from every other firm's, and every request is checked against the person's access before anything is read.

10. International transfers

Ledgerloom is hosted in the United States. If you use it from elsewhere, your information is processed in the United States under this policy.

11. Children

Ledgerloom is for businesses and isn't directed to children. We don't knowingly collect personal information from anyone under 16.

12. Changes to this policy

If we update this policy, we'll change the date at the top. For material changes, we'll let account owners know by email or in the app before they take effect.

13. Contact

Questions about privacy or this policy: legal@myworks.software.