Legal
Privacy Policy
Last updated August 31, 2026
The short version. We collect what we need to calculate your taxes and send your invoices, and nothing else. We do not sell your data, we do not share it with advertisers, and we do not use your financial data to train AI models. You can export or delete everything at any time.
1. What we collect
You give us
- Account details — email address, and your name if you provide one.
- Tax profile — filing status, state, business type, and whether you are 65 or older. Needed to apply the right rules.
- Financial figures — income, expenses, deductions, quarterly payments, and invoice line items.
- Business and client details — business name, address, EIN, logo, and the contact details of clients you invoice.
Connected services give us
- Bank transactions via Plaid — if you connect an account, we receive read-only transaction data: date, amount, merchant, and category. We never receive or store your online banking credentials, which you enter with Plaid directly. See Plaid’s end-user privacy policy.
- Billing status via LemonSqueezy — subscription state, plan, and renewal date. Card numbers go to LemonSqueezy and never reach our servers.
Collected automatically
- Technical data — IP address, browser type, and pages visited, used for security, rate limiting, and diagnosing errors.
- Invoice open tracking — when a client opens an invoice you sent, we record the time and count so you can see it was received. This tracks the invoice, not the person.
2. Why we use it
- To calculate your tax estimates and generate your forms.
- To create and deliver invoices to the clients you nominate.
- To categorize imported bank transactions as business or personal.
- To operate your subscription and take payment.
- To send transactional email — payment reminders, quarterly deadlines, and account notices. You can turn reminders off in settings.
- To keep the Service secure and to debug failures.
We do not sell personal information, share it with advertisers, use it for behavioural advertising, or use your financial data to train machine learning models.
3. Who we share with
We use a small number of processors, each for one job:
- Supabase — database, authentication, and file storage.
- Vercel — application hosting.
- Plaid — bank connections, only if you connect one.
- LemonSqueezy — subscription billing, as merchant of record.
- Resend — sending invoice and reminder email.
- Sentry — error reporting, so faults are found and fixed. Reports carry the account id and never the request body, cookies, headers or query string, and no session recordings are ever made.
We may also disclose data where legally required, or to protect our rights or someone’s safety. If the business is ever acquired, data may transfer to the acquirer under this same policy; we would notify you first.
4. How we protect it
- Encryption in transit (TLS) and at rest.
- Row-level security in the database, so each account can only reach its own rows.
- Bank access tokens are held server-side only and are not readable by any browser session, including your own.
- Card data never touches our servers.
No system is perfectly secure. If a breach affects your data we will notify you and any required regulator without undue delay.
5. How long we keep it
- Account and financial records: while your account is open.
- After you delete your account: 30 days, then permanent deletion from live systems. Encrypted backups age out within 90 days.
- Billing records: up to 7 years where tax and accounting law requires it.
6. Your rights
Wherever you live, you may:
- Access and export your data — CSV and JSON export is built in.
- Correct anything inaccurate.
- Delete your account and its data.
- Disconnect a bank at any time.
- Opt out of non-essential email.
California residents (CCPA/CPRA): you may request disclosure of the categories of personal information we collect and ask for deletion. We do not sell or share personal information as those terms are defined, so there is nothing to opt out of. We will not discriminate against you for exercising a right.
EEA and UK residents (GDPR): our lawful bases are performance of a contract (running the Service), legitimate interests (security and improvement), and consent (bank connections, marketing email). You may object to processing, request portability, or complain to your supervisory authority.
To exercise any of these, email privacy@gigledge.com. We respond within 30 days.
7. Cookies
We use strictly necessary cookies only: a session cookie to keep you signed in, and a security cookie to prevent cross-site request forgery. No advertising cookies, no third-party trackers, no cross-site profiling. Because we set no non-essential cookies, there is no consent banner to click through.
8. Children
The Service is not directed at anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us data, email us and we will delete it.
9. International transfers
We operate in the United States, and our processors may handle data there. Where data moves from the EEA or UK, transfers rely on Standard Contractual Clauses.
10. Changes
We will post material changes here and email you at least 14 days before they take effect.
11. Contact
Privacy questions or requests: privacy@gigledge.com
Security reports: security@gigledge.com