Privacy Policy

This Privacy Policy explains how ShadowLedger (“ShadowLedger,” “we,” “us,” or “our”) collects, uses, and protects information when you use our website and application (the “Service”). ShadowLedger finds software subscriptions and wasted spend in an organization's accounting data.

Who is responsible for your data

ShadowLedger is operated as a business based in California, United States. For questions or requests, write to support@getshadowledger.com.

Which role we play depends on whose data it is. For a firm using this for its clients, that means:

• Your own account information (your name, email, billing details, how you use the product) is data we decide the purposes for. In UK and EU terms we are the controller of it.
• The accounting data you connect or upload, including your clients' ledgers if you are a firm, is data we process only on your instructions and only to run the Service. In UK and EU terms you are the controller and we are the processor. Our Data Processing Agreement sets out that relationship, and applies automatically to Firm accounts.

Information we collect

We collect the following categories of information:

• Account information. When you sign up, our authentication provider (Clerk) collects your email address, name, and authentication credentials. We do not store your password.
• Financial and accounting data. When you upload an accounting export or connect QuickBooks Online or Xero, we process transaction records (dates, amounts, descriptions, and vendor names) to detect subscriptions and estimate spend. We do not access bank login credentials.
• Connection tokens. If you connect QuickBooks Online or Xero, we store OAuth access and refresh tokens so we can sync on your behalf. These tokens are encrypted at rest.
• Billing information. Payments are processed by Stripe. We store your Stripe customer and subscription identifiers and plan status; we do not store your full card number.
• Usage data. We collect basic technical information such as scan history and log data needed to operate and secure the Service, plus the first-party page-view records described under Usage analytics below.
• Enquiries. If you write to us through the contact form, we keep what you send: your email address, your message, and the firm name and client count if you give them. An enquiry about pricing is also passed to our marketing service, which keeps one lead record per email address so we can see earlier conversations with the same firm.
• Follow-up consent. The contact form has an optional box asking whether we may send a short follow-up. It is unticked unless you tick it. We record your answer, when you gave it, and the exact wording you saw, both with your enquiry and in our marketing service. If you later opt out, the service records that too.
• Firm owners we may write to. To find accounting and bookkeeping firms that might use ShadowLedger, we collect business contact details for people who run them: name, job title, work email address, the firm's name and website, and the page or directory where we found them. They come from the firm's own website, from public directories such as the QuickBooks ProAdvisor directory, and from BetterContact, a service that looks up work email addresses from business sources. We only email firms in the United States, and limited companies and LLPs in the United Kingdom.

How we use information

• To provide the Service: running scans, generating reports, and syncing data you connect.
• To manage your account, subscription, and billing.
• To secure the Service, prevent abuse, and debug problems.
• To communicate with you about your account or the Service.
• To send a few setup emails in your first weeks after you create an account, chosen by where your account is: running a first review, what to do with the findings, and what the paid plans add. They stop on their own after about three weeks, and stop at once if you subscribe. The sign-up page says these are coming, your dashboard offers to turn them off, and every one of them has a link that stops them with one click, with no login. You can also switch them off in Settings. Accounts made before we started sending them get them only if they say yes in the app.
• To answer an enquiry you sent us, and, only if you ticked the follow-up box, to send you a small number of follow-up emails about ShadowLedger. Every one carries a link that stops them with one click, with no login.
• To send the owner of a firm that looks like a fit one short introductory email, and at most one follow-up in the same thread. Each email says where we found the address, links this policy, and carries a one-click opt-out. A reply from anyone at the firm stops the emails to everyone there. For people in the United Kingdom, our legal basis is our legitimate interest in telling small accounting firms about a product built for them. You can object at any time: use the opt-out link, reply "stop", or email us. We then stop, and keep only a one-way hash of your address so that we do not write again.

We do not sell your personal information, and we do not use your financial or accounting data for advertising.

If we emailed you and you do not know why

You are probably the owner or a partner of an accounting or bookkeeping firm, and we wrote to you about ShadowLedger. This is the short version of what the rest of this policy says about that.

• Where we got your address. Your firm's own website, a public directory such as the QuickBooks ProAdvisor directory, or BetterContact, a service that looks up work email addresses from business sources. The email itself names which one. We hold your name, job title, work email address, your firm's name and website, and the page where we found you. Nothing else.
• Why we wrote. To tell a small firm about a product built for firms like yours and ask whether a short call would be useful. We send one email and at most one follow-up. In the United Kingdom we rely on legitimate interests and write only to limited companies and LLPs.
• How to make us stop. Click the opt-out link in the email, reply "stop", or write to support@getshadowledger.com. You do not need to log in or give a reason. A reply from anyone at your firm stops the emails to everyone there.
• How to see or delete what we hold. Email the same address. We will delete your details and keep only a one-way hash of your address so that we do not write to you again. Your rights, and who you can complain to, are under Your rights below.

How we share information

We share information only with service providers that help us operate the Service, and only as needed to perform their function. Each entry below says what that provider can see. This list is generated from the application code, and a test fails our build if an outbound integration is added without being disclosed here.

• Vercel: Application hosting, and storage for firm logos on client reports. All request traffic, server logs, and uploaded firm logo images.
• Prisma Postgres: The primary database that stores your scans and account data. Everything the Service stores: transactions, findings, vendor records, connection tokens (encrypted), preferences, and billing identifiers.
• Clerk: Authentication and account management. Your email address, name, and authentication credentials.
• Stripe: Payments and subscription billing. Your email address, billing address, card details you enter on Stripe's own form, and subscription state. Card numbers never reach our servers.
• Anthropic: The AI analysis behind vendor matching, the Ask your ledger chat, and contract term extraction. Transaction descriptions and vendor names sent for matching; the text of questions you ask in chat, together with the vendor names and amounts needed to answer them; and the full text of any contract document you upload for extraction. Under Anthropic's commercial terms, API inputs are not used to train their models.
• Resend: Transactional and notification email, setup emails to new accounts, and follow-up emails to enquirers who asked for them. Your email address and the full contents of every message we send you, which for alerts and digests includes vendor names and amounts.
• Cloudflare: The bot check on the public contact form (Turnstile), and hosting for our marketing service, which keeps contact-form leads, follow-up consent and the do-not-email list. For the bot check, the IP address and browser signals of a visitor who submits the contact form. For pricing enquiries, the enquirer's email address, firm name, client count and follow-up consent answer, with the wording shown; any follow-up emails sent; and one-way hashes of addresses that opted out. The enquiry message itself stays in our database.
• Inngest: Background jobs, including scheduled re-scans and renewal alerts. Job payloads, which carry account and connection identifiers, and for pricing enquiries being forwarded to our marketing service, the enquirer's email address, firm name, client count and follow-up answer. The financial data itself stays in our database.
• Expo: Push notifications to the mobile app, if you use it. Renewal alerts name the vendors that are renewing, so those names appear in the notification text. Your device push token and the text of each notification. Renewal alerts name the vendors renewing, so those names pass through Expo and the Apple or Google push network in readable form.

All of the providers above process data in the United States, which means that if you are outside the United States your data is transferred there to run the Service.

Accounting systems you connect

These are platforms you already use and choose to connect. Data moves from them to us on your instruction, which is a different relationship from the providers above.

• Intuit / QuickBooks Online: When you choose to connect it, to read your accounting transactions. We only ever issue read and query calls, and never write to your books.
• Xero: read-only scopes, for firms on Xero.
• Google Workspace (built, but not open to customers yet): Not part of a customer audit.

We may also disclose information if required by law, or to protect the rights, safety, and security of ShadowLedger and its users. If we are involved in a merger or acquisition, information may be transferred as part of that transaction.

Google user data

The Google Workspace feature is not available. ShadowLedger reads payments only.

The Google Workspace connection is separate from the accounting connectors, so it gets its own description. Everything in this section also applies while the connection is marked above as built but not open to customers: until Google's verification review clears, only our own staff can authorize it, and it is not part of a customer audit.

What we access. Two Google Admin SDK permissions, and nothing else: the audit report of third-party application activity (admin.reports.audit.readonly) and the user directory (admin.directory.user.readonly). The connection cannot read email, files, calendars, or messages, and it cannot change anything in the Google account.

What we keep. The raw report rows name individual users. We do not store them. Which named person is associated with which application is never written to our database and never shown in the product.

How we use it. We do not use Google user data for advertising, and we do not sell it. A customer audit does not include this connection.

AI and machine learning. Google user data is not used to develop, improve, or train any AI or machine-learning model, and it is not sent to Anthropic or any other model provider. Application names reported by Google are matched to vendors by deterministic code, not by a model, and none of the AI features described under Automated analysis below receive Google user data.

Who else sees it. No one. The stored counts sit in our database like everything else we hold and are not transferred to any third party beyond the storage and hosting providers listed above, which process them only on our behalf.

How it is protected. The OAuth tokens for the connection are encrypted at rest, and all traffic between us and Google uses encrypted transport (HTTPS).

Retention and deletion. Disconnecting Google Workspace revokes our access at Google and deletes the stored tokens. Closing your account does the same as part of the erasure described under Data retention below. You can also revoke our access yourself at any time from your Google account's security settings.

ShadowLedger's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Automated analysis

Three parts of the Service use a large language model, all of them running on Anthropic's API: matching a transaction description to a known vendor, answering questions in the Ask your ledger chat, and extracting terms from a contract document you upload. Anthropic is our only model provider for anything that touches your books, and we do not send this data to a second provider. Where you connect your own AI assistant, that is your choice rather than ours; see below.

What is sent: for vendor matching, the transaction description; for chat, your question along with the vendor names and amounts needed to answer it; for contract extraction, the contents of the document you uploaded. An uploaded contract is passed straight through and is never written to storage on our side. Under Anthropic's commercial terms, API inputs are not used to train their models.

We do not make automated decisions that produce legal or similarly significant effects. Findings are suggestions for a human to accept or reject, and every figure in a report is computed from your transactions rather than generated by a model.

Connecting your own AI assistant

On the Pro and Firm plans you can create an API token in Settings and give it to an AI assistant you run, so it can work with your audit data without opening the app. A token reads only, unless you mark it as writable when you create it. A writable one additionally lets an assistant snooze and dismiss findings and edit vendor notes and contract dates. Anything an assistant changes is recorded as having come from an assistant, so you can always tell those apart from your own decisions.

Four things no token permits, whatever you tick: recording a savings amount against a finding, adding or removing a client, running an audit, and sharing a report. Those change what you are billed or change a figure your own client sees, so they stay with you.

When you connect an assistant, your audit data goes to whoever provides that assistant, on their terms, not ours. We have no control over what they do with it and no visibility into it, and the assurances above about Anthropic apply only to the AI features we operate. Whether a given assistant is an appropriate place for your clients' financial data is a decision only you can make, and if you act as a processor for your own clients it may be one your engagement terms speak to.

A token is a credential: anyone holding it can read everything the app shows you, until you revoke it. Revoke one in Settings the moment it is no longer in use. We record which tool an assistant called and when, so we can answer what a token reached, and that record holds no vendor names or amounts.

Usage analytics

We measure traffic ourselves rather than handing it to an analytics vendor. There is no third-party analytics script on this site, no advertising pixel, and no cross-site tracking. Each page view is recorded on our own servers with the page's route, the referring site's domain, a two-letter country code from our host's edge network, whether the device is a phone, and a session identifier from a first-party cookie that expires after 30 minutes of inactivity.

We do not store your IP address with these records, we do not build a device fingerprint, and page addresses are reduced to their route before being saved, so identifiers in a URL (a scan id, a report link) are never kept. Raw page-view records are deleted after 30 days; what remains after that is daily totals that describe no individual visit.

If your browser sends a Do Not Track or Global Privacy Control signal, we record nothing at all for that visit.

Visitors in the UK and the European Economic Area get no analytics cookie at all. The visit is counted using an identifier that lasts only for that one request, so nothing is stored on the device and there is nothing to ask consent for, which is why this site has no cookie banner. Every cookie we set is listed in the Cookie Notice.

Data retention

You may delete stored scans at any time, and you may disconnect QuickBooks Online or Xero to revoke our access and remove stored tokens. Beyond that, a nightly job applies these limits:

Each workspace always keeps its most recent scan, however old, so a client you audit once a year does not come back to an empty history.

If you close your account, the erasure runs automatically. Every accounting grant you hold is first revoked at the provider, then your scans, transactions, connections, clients, custom rules, share links, calendar links, vendor corrections, uploaded report logo, and preferences are deleted, and any active subscription is cancelled. Two things are retained in de-identified form: product analytics events and any feedback you sent us, both stripped of your account id and, for feedback, of the reply address you gave. Lead records and follow-up consent history are held by our marketing service, not your account, so closing an account does not remove them: email us and we will delete them, or use the opt-out link in any follow-up to stop further email.

Details about firm owners we may write to are held by the same marketing service, on Cloudflare. The emails are sent from Google's Gmail service on a separate email domain, and addresses are looked up through BetterContact. None of these receives accounting data. We keep a record of who we wrote to, so that nobody at a firm is written to twice. Email us and we will delete it, keeping only a one-way hash of your address so that we do not write to you again.

The security audit trail is the one thing that is not erased on request. It records who reached what, including views of reports shared by link, and much of it describes actions taken by other people rather than by you. A trail the subject can erase is not much of a trail, and the account most worth investigating is often one that has since been closed. It is bounded rather than kept indefinitely: the same 400 days limit in the table above applies, and the nightly job enforces it. We may also retain records where retention is required by law.

Security

We use industry-standard measures to protect your data, including encryption of connection tokens at rest and encrypted transport (HTTPS). No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Why we are allowed to process it

If you are in the UK or the European Economic Area, we rely on these legal bases:

• Performance of a contract for running your account, scanning what you give us, producing reports, and billing you.
• Legitimate interests for keeping the Service secure, preventing abuse, understanding which parts of the site are read, and telling you about changes to the product you use, including the setup emails described above, which you can stop at any time. Where we rely on this, we have considered whether it overrides your interests, and you can object (see below).
• Legal obligation for keeping records we are required to keep, such as tax and payment records.

International transfers

We operate from the United States and every provider listed above processes data there. If you are in the UK, the EEA, Australia, or New Zealand, using the Service means your data is transferred to the United States.

For transfers of UK and EEA personal data, the transfer mechanism and the safeguards that go with it are set out in our Data Processing Agreement, which you can enter into with us before connecting any client ledger. Ask and we will send a countersigned copy.

Your rights

Everyone, wherever they are, can ask us for a copy of their data, ask us to correct it, or close their account and have it erased. Signed-in users can download everything the account holds from Settings, and closing the account runs the erasure described above. Neither costs anything and neither requires a paid plan.

Depending on where you live you may have these additional rights, and we apply them on request rather than asking you to prove where you are:

• United Kingdom and European Economic Area. Access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests. You can complain to the UK Information Commissioner's Office or to your national supervisory authority.
• California. The right to know what we collect and why, to access and delete it, to correct it, and not to be discriminated against for asking. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is no opt-out to offer for either. You may use an authorized agent.
• Australia. Access and correction under the Australian Privacy Principles, and a complaint route to the Office of the Australian Information Commissioner if we do not resolve it.
• New Zealand. Access and correction under the Information Privacy Principles, and a complaint route to the Office of the Privacy Commissioner.

To exercise anything not available in the app, email support@getshadowledger.com. We will respond within 30 days, and will tell you if we need longer and why. If a request concerns a client ledger that a firm connected, we will refer it to that firm, because the data is theirs to decide about and not ours.

If something goes wrong

If personal data we hold is breached, we will notify the relevant supervisory authority and affected people where the law requires it, and without undue delay. If the data belongs to a firm's client, we notify the firm so it can meet its own obligations, as set out in the Data Processing Agreement.

Children's privacy

The Service is not directed to individuals under 18, and we do not knowingly collect information from children.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the effective date above. Material changes will be communicated where appropriate.

• October 13, 2026. The Google Workspace feature is not available. The Google user data section no longer describes seat counts or application usage. ShadowLedger reads payments only.
• September 30, 2026. Described the setup emails sent to new accounts: what they are, why we may send them, when they stop, and how to turn them off. Accounts made before this date get them only if they ask.
• September 29, 2026. The operator is described as ShadowLedger, a business based in California, United States. The contact address is unchanged.
• September 29, 2026. Added a short section for people who received one of our introductory emails: where we found their address, why we wrote, and how to object or have their details deleted. No change to what we collect or how we use it.
• September 24, 2026. Described what the contact form keeps, the optional follow-up consent box, the marketing service that holds lead records and consent history, the one-click opt-out, and the do-not-email list that keeps an opt-out working. Email us to see or delete what we hold about an enquiry. Also described the business contact details we collect about firm owners we may email, where they come from, the introductory emails we send, and how to object to them.
• September 4, 2026. Named Xero alongside QuickBooks Online wherever this policy describes a connected accounting system. No change to what is collected or how it is used.
• August 18, 2026. A token can now optionally be marked writable, letting a connected assistant snooze and dismiss findings and edit vendor notes. Named the four things no token permits, and recorded that assistant-made changes are marked as such.
• August 16, 2026. Added the section on connecting your own AI assistant: what a token can read, that access is read-only, that data reaching an assistant you connect travels on that provider's terms rather than ours, and what we log about it.
• August 14, 2026. Added the Google user data section: what the Google Workspace connection reads, what is kept, that none of it is used for AI or transferred onward, and that disconnecting deletes the seat counts along with the tokens. Added our adherence to the Google API Services User Data Policy, including its Limited Use requirements.
• August 12, 2026. Named Anthropic as the provider behind the product's AI features and described what is sent there. Added our controller and processor roles, legal bases, international transfers, per-region rights for the UK, EEA, Australia and New Zealand, breach notification, and the cookie position for UK and EEA visitors. Described what account closure does.
• July 15, 2026. First published.

Contact us

Questions about this policy or your data can be sent to support@getshadowledger.com.

This policy is provided for transparency and is not legal advice. We recommend reviewing it with qualified counsel before relying on it.