This Privacy Policy describes how RISI LLC (“we,” “us,” or “our”) collects, uses, and shares information when you use BookKeeper (the “Service”) — the bookkeeping web application at book-keeper-sandy.vercel.app and any related domains we operate.
1. Information we collect
Depending on how you use the Service, we may collect:
- Account information — email address, name, password (stored by our authentication provider), and your role on a company (owner, admin, bookkeeper, or viewer).
- Company and bookkeeping records — business profile, chart of accounts, customers, vendors, invoices, sales receipts, payments, expenses, bills, recurring schedules, bank feed items, payouts, and reports you generate.
- QuickBooks Online — if you connect QuickBooks, we receive OAuth tokens and import customers, vendors, chart of accounts (Account), invoices, sales receipts, payments, expenses (purchases such as Expense, Check, and Credit Card), and bills. We store QuickBooks company identifiers (including realmId), entity ids, and sync tokens so import can be re-run without duplicating records. We do not import payroll. We do not run a scheduled two-way sync unless we later offer that and you turn it on.
- Payments and banking — if Stripe is configured, we process card and ACH charges, saved payment methods, webhooks, payouts, and (when you connect a bank) Financial Connections account and transaction data needed to reconcile the feed. Stripe handles card numbers and bank login; we store tokens, identifiers, amounts, fees, and status.
- Usage and technical data — IP address, browser or device type, timestamps, and basic logs needed to operate and secure the Service.
2. How we use information
We use information to:
- Provide bookkeeping: invoicing, receipts, expenses, accounts, payments, bank reconciliation, payouts, and tax-oriented reports
- Authenticate users and enforce company-level access controls
- Import records from QuickBooks Online when you click Connect and Import
- Collect and pay out funds through Stripe when those keys are configured
- Send transactional email (invoices, receipts, invites) when an email provider is configured
- Comply with law and protect the rights, safety, and security of users
3. How we share information
We do not sell personal information. We may share information with:
- Service providers that host or process data for us — including Supabase (database and authentication), Vercel (application hosting), Stripe (payments, payouts, and bank connections), Intuit QuickBooks Online (when you connect it), and email delivery if you enable it — under their terms and our need to operate the Service
- People you invite to your company (owners, admins, bookkeepers, viewers), who can see the books according to their role
- Your customers, only what you send them (for example an invoice or a pay/setup link)
- Authorities when required by law, or to protect against fraud, abuse, or security threats
4. Where data is stored
Application data is stored in a Supabase (Postgres) database with row-level security scoped to your company. QuickBooks access and refresh tokens are encrypted at rest and stored so only the server can use them. Hosting runs on Vercel. These providers process data in the United States unless they state otherwise.
5. QuickBooks: connect, disconnect, and import
Connecting QuickBooks is optional. You authorize access in Intuit’s screens. You can disconnect in Settings; we revoke our tokens with Intuit and delete the stored tokens. Imported bookkeeping records stay in your BookKeeper company unless you delete them there. Disconnecting does not delete your QuickBooks company.
6. Data retention and deletion
We retain information for as long as your account and companies exist, and as needed to operate the Service, resolve disputes, and comply with law. You can edit or delete many records in the app (for example void an expense, archive a customer, or disconnect QuickBooks). To request deletion of an account or company data we hold, email us at igor@bodymindsystems.com. We may need to verify your identity and may retain limited information when required by law or to complete a payment that is still settling.
7. Security
We use reasonable administrative, technical, and organizational measures to protect information, including encrypted QuickBooks tokens and company-scoped access rules. No method of transmission or storage is completely secure; you use the Service at your own risk subject to this Policy and the EULA.
8. Children’s privacy
The Service is for businesses and authorized adults. It is not directed to children under 13, and we do not knowingly collect personal information from them.
9. Your choices
You can access and update much of your data in the Service. To request access, correction, or deletion, contact igor@bodymindsystems.com.
10. International users
The Service is operated from the United States. If you access it from another country, you understand information may be processed in the United States.
11. Changes
We may update this Privacy Policy from time to time. The effective date above will change when we do. Continued use of the Service after an update constitutes acceptance of the revised Policy.
12. Contact
Questions about this Privacy Policy: igor@bodymindsystems.com
RISI LLC