Privacy Policy

ClearDeposits is operated by Cleardeposits, LLC ("ClearDeposits", "we", "us"). This policy explains what information we collect through our website at cleardeposits.com, the ClearDeposits application, and our emails; how we use it; who else handles it; how long we keep it; and the choices you have.

Two kinds of data, two roles

Your account information, such as your name, email and sign-in activity. We decide how it is used, and this policy governs it.
Business data you bring into a workspace, such as Stripe transactions and bank statements. We process it on behalf of the business whose books the workspace keeps, and on that business's instructions. That business controls it.

What we collect

When you contact us

If you email us, for example to ask for early access, we keep your name, email address and what you write, so we can reply and stay in touch.

Your account

Your name and email address. Your email is how you sign in: we email you a one-time code, or you sign in with Google.
We do not use passwords.
The one-time codes we send are stored only as a salted one-way hash, expire after fifteen minutes, and work once. We keep a record of each code request (the address, the time and the requesting IP address) to protect sign-in against abuse, for up to 30 days.
Your acceptance of our Terms and Privacy Policy at account creation: the time, the version accepted, your IP address and browser.
The workspaces you belong to and your role in each (Accountant or Reviewer).
Invitations you send: the invitee's email address, the role offered, and who sent it.

A record of activity

To keep books trustworthy, the application records the actions taken in each workspace: who acted, what they did, when, and what changed. This includes signing up, signing in, switching workspaces, changing settings, connecting or deleting a data source, matching, approving and closing periods.

Business data in a workspace

From Stripe, through a key you provide: payouts, balance transactions, charges, invoices and their line items, refunds, disputes, credit notes, failed payments, products, prices, coupons, tax rates, account and payout settings, and balances.
About the business's own customers, as recorded in Stripe: names, email addresses and billing location, and a shipping address where one is present. We use these to show who a payment came from, and to recognise a failed payment that was later paid.
What we never collect: card numbers. We do not collect, process or store payment card numbers (primary account numbers), card security codes or full bank account numbers; Stripe never gives them to us, and card data stays with Stripe. The payment records Stripe does send can include a card's brand, last four digits, expiry month and year and country, and we keep those as part of the payment record.
Files you upload, such as Stripe exports and bank statements. We keep every row whole, including columns we do not use.
Bank statement data: dates, amounts, descriptions and account details.
Your configuration: chart of accounts, mapping rules, column templates and settings.

Stripe keys

A Stripe key is stored encrypted, is never shown back to anyone, and is never written to logs in plain text. We ask for read access and permission to generate reports, nothing more: the key cannot move money or change your Stripe account. See Security.

Technical data, cookies and browser storage

This website sets no tracking, analytics or advertising cookies and runs no analytics or advertising code. Its fonts are served from our own site.
The application uses your browser's local storage and, where needed, essential cookies strictly to keep you signed in, remember display preferences and secure the application. It sets no tracking, analytics or advertising cookies and runs no analytics or advertising code.
Our hosting providers process IP addresses and request logs to deliver the service and protect it from abuse. Application request and system logs are kept for 150 days, so we can trace a data question raised at a quarterly close, and are then deleted automatically.

How we use it

To provide the service: reconcile, match, explain and prepare postings, as you direct.
To keep it secure and auditable, and to investigate misuse.
To diagnose and fix problems with the service. We work from aggregated or de-identified information wherever we can, such as counts, statuses and error codes. When a problem can only be fixed by looking at a workspace's own records, access is limited to a named member of our staff, for that workspace alone, with a recorded reason and an expiry, as ourSecurity page describes.
To understand how the service is used and to improve it — for example, which features are used and where people get stuck. This information is never sold, and never shared with third parties for their own use; any provider that helps us process it acts only on our instructions.
To support you and tell you about changes to the service or to this policy.
To meet legal obligations.

We do not sell personal information, and we do not use it for advertising.

Who else handles data

We use a small number of service providers, each bound to use the data only to provide their service to us:

Provider	What they do for us	Where
Amazon Web Services	Hosts the application, its database and backups	United States
Resend, Inc.	Delivers the email we send — sign-in codes and service email — and so sees the recipient's address and the message's content in transit. Resend is SOC 2 Type II audited, offers a GDPR data processing agreement, and participates in the EU-U.S. Data Privacy Framework	United States
Cloudflare	Carries all traffic to and from the application, and protects it from attacks and abuse: it sees IP addresses and the content of requests and responses in transit, and we set it not to cache the application's data. Also hosts this website, runs our domain's DNS and routes mail sent to our addresses	Global network
Google	Hosts the mailbox we use to correspond with you; confirms your identity when you sign in with Google; serves the application's web fonts	United States
Stripe	The source of the Stripe data you connect. We read from the Stripe account you authorise and ask Stripe to generate its balance report; we do not send your workspace data to Stripe	As your Stripe account

We may also disclose information if the law requires it, to protect people's rights or safety, or as part of a merger or sale of the business, in which case this policy continues to apply to it.

How long we keep it

Accounting records are kept for the life of the workspace. They make up the books, so the application does not erase them, and a closed month cannot be changed.
A deleted Stripe connection: the key is erased immediately. Data already synced stays, because the workspace's books are built from it.
Backups: our encrypted backups can hold copies of data, including encrypted keys, for up to 90 days after it is deleted from the live system, until those backups expire.
Deleting a workspace: request it from your profile menu in the app, or email hello@cleardeposits.com. We delete the workspace and all its data within 30 days of the request, except where the law requires us to keep it. That includes your account record, your consent record and the workspace's audit trail; what remains is a note that a deletion was requested and carried out, with the workspace name, the requester's email and the dates.
When your access ends for any other reason, the workspace stays available for you to sign in and export your posting plans for 90 days. We then delete it and all its data within 30 days, except where the law requires us to keep it.
Early-access correspondence: kept while we are in touch. Ask us and we will delete it.

How we protect it

Encryption in transit and at rest, read and report-only Stripe access, database-enforced separation between workspaces, approvals for consequential changes, and a complete audit trail. The details are on our Security page.

No system is entirely secure. We use safeguards that are commercially reasonable for a service of our size, but we cannot guarantee the absolute security of business data or personal information against every determined attacker, and we do not promise it.

If something goes wrong

If we confirm a data breach involving business data or personal information we hold, we will notify the affected customer without undue delay, and in any case within 72 hours of confirming it, with what we know, what it affects and what we are doing about it.

Your choices and rights

You can see and correct your account details, and ask us for a copy of your personal information.
You can export a workspace's posting plan at any time, and ask us to delete your personal information, subject to the retention above.
Depending on where you live, for example California or the European Economic Area and United Kingdom, you may have further rights. We will honour them as the law requires.

We have not sold or shared personal information, including for cross-context behavioral advertising, in the preceding 12 months, and we do not do so.

Email hello@cleardeposits.com to use any of these. We will reply within 30 days. Where a request concerns business data we process for a customer, we will refer it to that customer and help them answer it.

Where data is processed

ClearDeposits is operated from the United States, and the data we hold is stored and processed there. On its way to and from the application, your traffic passes through Cloudflare's global network, so it may be handled in transit at a Cloudflare location near you, outside the United States.

Children

ClearDeposits is a business service. It is not directed at anyone under 18, and we do not knowingly collect their information. If we learn we have collected personal information from someone under 18, we will delete it immediately.

Changes to this policy

When we change this policy we will post the new version here with a new effective date. If a change is significant, we will also email account holders before it takes effect.

Contact

Cleardeposits, LLC
100 N Howard St, Ste R
Spokane, WA 99201
United States
hello@cleardeposits.com (hello@cleardeposits.com)