Mainstreet Ledger

Privacy Policy

Last updated: [set a date when you publish this]

This Privacy Policy explains what information Mainstreet Ledger collects, how it's used, and the choices you have.

1. Information we collect

We collect the information you and your business provide directly:

  • Account information: name, email, business name, and role.
  • Business records you enter: ledger entries, inventory, expenses, sales, vendors, and business profile details.
  • Uploaded documents (receipts, invoices) if document digitization is enabled for your deployment.
  • Billing information, handled directly by Stripe. We never see or store full card numbers.
  • Basic technical data (IP address, request metadata) used for security purposes like rate-limiting.

2. How we use information

Information is used to operate the Service for your business specifically:

  • Providing accounting, inventory, expense, and reporting features.
  • Expense category suggestions are generated from your own business's history only. They're never generated from other tenants' data, and never used to train any shared model.
  • Processing subscription payments via Stripe.
  • If enabled, sending uploaded documents to Anthropic's Claude API to extract structured expense data. Documents are sent only for that extraction purpose.
  • Securing accounts (rate-limiting logins/signups, detecting abuse).

3. Data storage and security

Business data is stored in a PostgreSQL database, scoped per business so no tenant can access another's data. Passwords are hashed (bcrypt) and never stored in plain text. Sessions use signed, expiring cookies. Uploaded documents are stored via a configured storage backend (local disk in development, or object storage such as S3 in production).

4. Third parties we share data with

We share data only as needed to operate the Service: Stripe (billing and payment data), Anthropic (document contents, only if digitization is enabled), and our hosting provider (infrastructure). We do not sell personal or business data to third parties.

5. Data retention and deletion

We retain business data for as long as your account is active. To request deletion of your account and associated data, contact us at the email below; we'll confirm deletion once complete, subject to any records we're required to retain by law.

6. Children's privacy

The Service is intended for business use and is not directed at individuals under 18.

7. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the date above.

8. Contact

Questions about this policy or your data? Contact us at support@example.com.