Privacy

Three buckets, nothing else:

• Account data. Your email address, and — if you sign in with Google — the name and profile image Google returns. No passwords are stored by us in readable form.
• Books. Entities, locations, chart of accounts, journal entries and their lines, bank statement lines, invoices and bills, counterparties (suppliers, banks, employees, customers), policies, agreements, exceptions, period locks and the audit log.
• Documents. Every file you upload — invoices, receipts, statements, spreadsheets — kept in a private storage bucket so each posting can point back at its source.

We do not store card numbers, and we do not connect to your bank. Bank data only exists here because you uploaded a statement file.

Extraction, categorisation suggestions, control checks and the Copilot all send data to a hosted large-language-model provider through the Lovable AI Gateway. What gets sent is scoped to the task: the document you uploaded, or the ledger rows and statement figures relevant to the question you asked.

Your data is not used to train the models. Nothing is sent to the AI unless you upload a document, run a scan, or ask the Copilot something. If you never open the Copilot and never upload a file, no financial data leaves the database.

AI output is a draft. Nothing posts to your ledger without you confirming it, which is also why every AI-touched action shows up in the audit log.

Row-level security is enforced in the database itself, not just in the app: a query for data belonging to another account returns nothing, even if the app has a bug. Documents live in a private bucket that requires a signed, time-limited link.

Our infrastructure providers — hosting, managed Postgres and storage, and the AI gateway — process data on our instruction to run the service. We do not sell data, do not share it with advertisers, and do not build profiles from your books.

If we are legally compelled to disclose something, we will tell you unless we are legally barred from doing so.

We use a session cookie and browser local storage to keep you signed in and to remember small preferences — the active entity, the selected period, light or dark theme, and the Copilot's position on screen. That is functional state, not tracking.

There are no advertising cookies, no third-party trackers, and no cross-site pixels. We keep aggregate, non-identifying usage counts to know whether pages load and features work.

Books and documents are kept for as long as your account exists, because accounting records are meant to be retrievable years later — most jurisdictions expect six or seven years, and deleting them for you would be unhelpful.

Demo data you generate is marked as demo and can be cleared at any time without touching real entries.

When you delete your account, live records are removed within 30 days and backups age out within 90.

Export is built into the product, not a support ticket: trial balance, general ledger, statements and note disclosures export to CSV from the Reports screen, and every source document can be downloaded from Intake.

You can ask us to correct account details, export a full copy, or delete the account entirely. Deletion is irreversible — the ledger is immutable by design, so there is no undo once it is gone. Email privacy@thegl.app and we will respond within 30 days.

If this policy changes in a way that affects what we collect or who we send it to, we will say so in the app before the change takes effect, not quietly bump the date at the top.