Privacy Notice

1. Who is responsible

PadgeBooks is operated by William Padgett, an individual based in Cincinnati, Ohio, United States. This Notice applies to the hosted PadgeBooks service. A company using a workspace also controls the records it enters and the access it grants to its own members. If your information appears in another company’s records, that company may need to respond to your request or instruct us about it.

2. Information processed

Account information includes your name, email address, password hash, account status, sign-in records, company memberships and roles, policy acceptance and optional two-factor authentication information. Passwords are hashed rather than stored as readable account passwords.

Company information includes the records users enter or import: customer, vendor and employee details; invoices, transactions, account balances, payroll entries, tax details, documents, receipt images, notes and related financial information. Optional integrations add bank account and transaction information, provider identifiers, tokens, credentials, delivery events and payment metadata.

Stripe processes payment method details through its checkout and billing services. PadgeBooks keeps subscription, customer and payment identifiers and status needed to provide the service and reconcile records; the application does not store full payment card numbers or card security codes.

Hosting and security systems process network information, request timing, sign-in activity, session identifiers and service events. Support communications contain the information you choose to send. Avoid sending passwords, recovery codes or provider secrets in support messages.

3. Why information is used

We use information to provide accounts and workspaces, authenticate users, manage authorized access, maintain business records, run requested integrations, deliver service email, process subscriptions, provide support, prevent abuse, reconcile payments, perform recovery and meet legal obligations.

Where applicable law requires a legal basis, these purposes rely on providing the service you request, legitimate interests in security and service operation, compliance with legal obligations, or consent where required for an optional activity. You can choose whether to enable optional integrations; disabling them does not erase records already imported or payments already processed.

We do not sell or rent account or bookkeeping information, and we do not use company records to target advertisements.

4. Who can receive information

Authorized members can access information within their company according to their roles. Company owners control invitations and access. Information may also be disclosed to operate the service, respond to lawful requests, protect people and the service, or investigate misuse.

Render provides application hosting and storage. Resend processes recipient addresses and message content for account emails and, when configured, invoice delivery. Stripe processes subscription billing and, when a company enables it, merchant payment information.

Plaid processes bank connection and transaction information when bank access is enabled. Bank sign-in takes place in the provider’s connection flow. AWS Textract processes uploaded receipt documents when receipt scanning is enabled. Provider use is limited to the features and configurations involved; provider services also have their own privacy notices.

The provider notices are available at Render, Resend, Stripe, Plaid and AWS through the links below. Information sent to a customer as an invoice or other requested communication is available to that recipient; consider the recipient and document contents before sending.

• Render privacy information
• Resend privacy information
• Stripe privacy information
• Plaid privacy information
• AWS privacy information

5. Browser storage and cookies

PadgeBooks uses essential session cookies to keep you signed in. Browser storage also remembers report preferences and temporary invitation and bank connection state. Blocking essential cookies can prevent sign-in; clearing temporary browser storage can interrupt a bank connection flow.

The application does not include advertising trackers or marketing analytics. Third-party pages and connection interfaces, such as Stripe Checkout and Plaid Link, can use their own cookies or storage under their own notices.

6. Security and company access

The service uses HTTPS, session controls, account permissions and separate company workspaces. Selected credentials, bank tokens, authenticator secrets and tax identifiers are encrypted by the application. Ordinary bookkeeping records and attachments are not individually encrypted by the application; hosting, administrative access and backup protection also matter.

No system guarantees absolute security. Protect your account and provider credentials, use available two-factor authentication, and invite only people authorized to see company records. A read-only member may still see ordinary records in that company. Contact us promptly about suspected unauthorized access.

7. Retention and deletion

Information is retained while needed to provide the service and meet the purposes in this Notice. An expired or cancelled subscription does not automatically delete company records; authorized users can view and export retained records.

A company deletion request starts a 90-day read-only export period. After that period, live company records become eligible for the operator’s deletion process. Account deletion disables access; associated personal account details are removed after retained company memberships are gone. These processes are separate from subscription cancellation.

Minimal billing identifiers, accepted policy versions, audit and security records may remain for reconciliation, disputes, security and legal obligations. Backup copies can remain until backup rotation or removal and are separate from live records. A request to delete live data does not immediately erase historical backups. Contact us for questions about retention or deletion of particular information.

8. Your choices and requests

You can change your password, manage two-factor authentication and sign out through the service. Authorized company users can export records; company owners can manage access and request company deletion. You can stop using an optional provider connection through the available disconnect controls.

Depending on your location and applicable law, you may have rights to request access, correction, deletion or a copy of personal information, to restrict or object to particular processing, or to complain to a privacy regulator. Contact us to make a request. We may need to verify your identity and authority and consider legal retention requirements or the rights of other people.

For information held in a company’s workspace, contacting the company that supplied it may be the most direct way to obtain a correction or deletion instruction. If a request involves an independent provider’s records, that provider may also need to respond under its own policies.

9. Processing locations

The operator is based in the United States. Depending on your location and the providers used, information may be processed in a country different from yours. Contact us for questions about the providers and processing locations involved in your use of the service.

10. Children

PadgeBooks is intended for adults using personal or business recordkeeping software and is not directed to children under 18. If you believe a child has provided account information, contact us so we can investigate and address it.

11. Updates to this Notice

We publish the effective date and version with this Notice. Material changes will be communicated through the service or account email as required by applicable law. Contact us if you have questions about the practices described here.

Contact

For support, billing questions or privacy requests, contact William Padgett, operating as PadgeBooks, at padgbooks1@gmail.com. The operator is based in Cincinnati, Ohio, United States.