Apsis Privacy Policy

This Privacy Policy explains how Apsis Accounting LLC, a Florida limited liability company ("Apsis," "we," "us," or "our"), collects, uses, shares, and protects information when you use the Apsis accounting software, the website at apsisaccounting.com, and related services (the "Service"). It should be read together with our Terms of Service.

Apsis is a business tool. Our customers are businesses ("Customers") and the people they authorize to use the Service ("Users"). Customers decide what financial data to put into the Service; for that Customer Data we act as a service provider (processor) on the Customer's behalf.

1. Information We Collect

1.1 Account and profile information

When you sign in with Google, we receive your name, email address, and profile picture (Google scopes openid, email, profile). We store a user record, your memberships in Company Accounts, and your role (owner or member). Invitations you send include the invitee's email address.

1.2 Company and books data ("Customer Data")

Information you or your Users enter or import, such as company legal name, address, tax identifiers you choose to store (company, member, and vendor EINs and SSNs, which we store encrypted), logo and branding, chart of accounts, journal entries, transactions, invoices, bills, statements, customers and vendors (names, emails, addresses, amounts owed), deals, investment records, reports, notes, and uploaded documents.

1.3 Bank and card data via Plaid

If you connect a financial account, we use Plaid Inc. to retrieve account information such as institution name, account name, type and mask (last 4 digits), balances, and transaction history (date, amount, description, merchant, category). We do not receive or store your bank login credentials; you provide them directly to Plaid. Plaid's handling is described in the Plaid End User Privacy Policy. We store Plaid access tokens encrypted at rest.

1.4 Gmail sending permission

If you choose to connect Gmail for sending, we request the https://www.googleapis.com/auth/gmail.send scope, plus the openid and email scopes so we can confirm which Google address you connected (it must be your sign-in address or one at a domain your company allows). We store an encrypted OAuth refresh token tied to you and the Company Account, the connected address, when it was connected, whether it is working, and when it last sent. For each message the Service sends, we keep who sent it, the From address, the recipients, the subject, the type of message, the related invoice or customer, the time, and Gmail's message ID. We cannot and do not read, search, or download any email in your mailbox. See Section 4.

1.5 Payment and billing information via Stripe

When paid subscriptions are offered, payments will be processed by Stripe, Inc., and we will receive a Stripe customer ID, subscription status, plan, billing email, invoice history, and limited card details (brand, last 4, expiration) — not full card numbers. If and when you use Stripe Connect to accept invoice payments, we will receive your connected account ID, onboarding status, and payment and payout records for invoices paid through the Service. Your customers' card data is handled by Stripe and not stored by us.

1.6 Usage, device, and log data

IP address, browser and device type, pages and features used, timestamps, referring URLs, error logs, and security events. We use essential cookies for sign-in sessions, sign-in security (CSRF and OAuth state), your theme preference, your time zone, and the date range you last viewed in a report.

1.7 Consent records

When you accept the Terms of Service and this Privacy Policy, we record your user ID, the versions accepted, the date and time, IP address, and user agent.

1.8 Support communications

Messages you send us and, where available, conversations with our AI support assistant.

2. How We Use Information

We use information to:

provide, operate, and maintain the Service (books, bank feeds, invoices, statements, reminders, reports);

authenticate Users, manage Company Accounts and permissions, and keep the Service secure (fraud prevention, abuse detection, debugging, audit logs);

send the emails you create or schedule through your connected Gmail account;

once offered, process subscriptions and invoice payments through Stripe;

provide AI Features (Section 5);

provide customer support;

send service, security, billing, and legal notices (including changes to our Terms);

comply with law, enforce our Terms, and protect our rights and the rights of others; and

analyze aggregated or de-identified usage to improve the Service.

We do not sell personal information, and we do not use Customer Data, Plaid data, or Google user data for advertising.

3. How We Share Information

We share information only as described here:

Service providers (subprocessors) who process data on our behalf under contractual confidentiality and security obligations, including: Railway Corporation (application hosting and PostgreSQL database); Plaid Inc. (bank connections); Google LLC (sign-in and Gmail API); Anthropic, PBC (AI model provider for AI Features); and, once offered, Stripe, Inc. (billing and payments). We will update this list before adding a subprocessor.

Within your Company Account: Users you invite can see the Company's books according to their role.

Recipients you choose: invoices, statements, and reminders go to the recipients you specify.

Your accountant or others you authorize.

Legal and safety: to comply with law, subpoena, or court order; to protect the rights, property, or safety of Apsis, our Users, or others; or to investigate fraud or security issues.

Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to this Policy (Google user data will be transferred only as permitted by the Google API Services User Data Policy, with notice to you).

4. Google User Data and Limited Use Disclosure

Apsis's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

What we access. Google Sign-In: your name, email address, and profile picture (openid, email, profile). Gmail (optional, only if you connect it): the gmail.send scope, which permits sending email as you, and the openid and email scopes, used only to confirm which address you connected. Apsis does not request any scope that allows reading, modifying, labeling, or deleting your email, and does not access your inbox, contacts, calendar, or Drive.

How we use it. We use the gmail.send permission solely to send invoices, statements, payment reminders, user invitations, and related messages that you create, approve, or schedule in Apsis (or, if your company chose you as its reminder sender, the company's automated overdue reminders), from your own Gmail address, so that your customers receive mail from you and replies come back to you. Sign-in data is used only to authenticate you and display your identity in the app.

No transfer except as needed. We do not transfer Google user data to third parties except as necessary to provide or improve this user-facing feature, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to you.

No advertising. We do not use or transfer Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising.

No sale; no data brokers. We do not sell Google user data, and we do not transfer it to data brokers or information resellers or use it to determine creditworthiness or for lending purposes.

No human access. No Apsis personnel read Google user data unless (a) you give us affirmative permission for specific messages (for example, for a support request), (b) it is necessary for security purposes such as investigating abuse, (c) it is necessary to comply with applicable law, or (d) the data is aggregated and anonymized and used for internal operations in compliance with applicable law.

No AI/ML training. We do not use Google user data to develop, improve, or train generalized or non-personalized artificial-intelligence or machine-learning models.

Security. OAuth tokens are encrypted at rest, transmitted only over TLS, and accessible only to the server processes that send your messages.

Revoke anytime. You can disconnect Gmail in Settings → My email, or revoke access at myaccount.google.com/permissions. When you disconnect, we delete the stored token immediately, ask Google to revoke it, and stop all sending from your account, including scheduled reminders. If you are removed from a Company Account, your Gmail connection for that company is deleted the same way.

5. AI Processing

Apsis offers AI Features such as transaction categorization and, where available, an AI support assistant that can read (but not change) data in your Company Account to answer your questions. When bank or card transactions are imported, AI categorization may post confident ones to your books automatically; you can review, change, or reverse any of them.

Provider. AI Features are powered by third-party large-language-model providers acting as our subprocessors (currently Anthropic, PBC) via their commercial APIs.

What is sent. Only the data needed for the request: for categorization, each transaction's description, amount, date, direction, and bank category hint, the name and type of the bank account, your company name, your chart of accounts, the names of your customers (to recognize who paid), and examples of how you categorized similar transactions; for the assistant, your question and the records needed to answer it. Gmail data, tax identifiers, bank login credentials, and OAuth or Plaid tokens are never sent to AI providers.

No training. Under our provider terms, data submitted through the API is not used to train the provider's models. We do not use your Customer Data to train generalized AI models.

Retention by provider. Providers may retain inputs and outputs for a limited period for abuse monitoring and safety, per their commercial terms.

Accuracy. AI output may be wrong. You decide whether to accept suggestions; see our Terms of Service.

6. Data Retention and Deletion

Requesting deletion. Company owners can request deletion of a Company Account and its Customer Data by emailing [privacy@apsisaccounting.com] or using in-app settings when available. Individual Users can request deletion of their user account. We may retain information as required by law, to resolve disputes, or to enforce our agreements. Because many Customers have legal record-keeping obligations, please export your data before requesting deletion.

7. Security

We use administrative, technical, and physical safeguards designed to protect information, including: TLS encryption in transit; storage with our hosting provider, which applies its own physical and infrastructure protections; application-level encryption (AES-256-GCM) of OAuth and Plaid tokens and of tax identifiers; signed, single-use, short-lived OAuth state; per-company data scoping and role-based access controls; and limiting personnel access to what is needed to run and support the Service. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we learn of a breach affecting your personal information, we will notify you as required by law (including the Florida Information Protection Act, § 501.171, Fla. Stat.).

8. Your Choices and Rights

Access, correction, export: most data can be viewed, edited, and exported in the Service.

Disconnect integrations: Plaid accounts in Settings → Banking; Gmail in Settings → My email.

Email: you can opt out of non-essential marketing emails; service and legal notices will still be sent.

State privacy rights: depending on where you live, you may have rights to know, access, correct, delete, or port personal information, and to opt out of sale/sharing (we do not sell or share for cross-context behavioral advertising). Contact us to exercise these rights; we will verify your request and respond as required by law. You will not be discriminated against for exercising your rights.

Customer Data about others: if your information was entered by one of our Customers (e.g., you are a customer or vendor of an Apsis user), please contact that business; we will assist them as their service provider.

9. Children

The Service is not directed to children under 18, and we do not knowingly collect their personal information.

10. International Users

Apsis is operated from the United States, and information is processed and stored in the United States. If you use the Service from outside the U.S., you consent to this transfer.

11. Changes to This Policy

We may update this Policy. The version and date are shown at the top. For material changes, we will notify you by email or in the Service and may ask you to review and accept the updated Policy at your next sign-in. We will not use Google user data in a materially different way without first obtaining your consent.

12. Contact

Apsis Accounting LLC, 4370 Tarpon Lake Blvd., Palm Harbor, Florida 34685. Privacy: [privacy@apsisaccounting.com] Support: [support@apsisaccounting.com]