Privacy Policy

We handle information in two capacities. (a) For information about our own customers — the account and identity details of the businesses and users who subscribe to the Service, and how they use it — we act as a data controller, and this Policy describes our own practices. (b) For personal information that a customer enters about other people — their clients, employees, and subcontractors — the customer is the controller and we act as their processor, storing and processing that information on the customer’s behalf and under their instructions to provide the Service. If you are an employee, client, or subcontractor of a business that uses ExpenseDesk and you have questions about your information, please contact that business directly; we will assist them in responding to your request.

Account and identity information. Your name, email address, password (stored only as a secure hash), business name, and role.

Business profile. Company details you enter such as legal name, EIN/tax ID, address, phone, website, and business type, which appear on the documents you generate.

Data you enter to run your business. Jobs, bids and estimates, invoices, expenses, change orders, selections, schedules, daily logs, job-costing and financial records, and the files and photos you upload (including receipts and documents).

Information about your clients, employees, and subcontractors. Contact details and, where you choose to enter them, sensitive identifiers — such as the last four digits of a Social Security Number, bank or direct-deposit details, employer identification numbers, insurance certificates and W-9 records, emergency contacts, and pay information. You decide what to enter, and we recommend entering only what you need.

Location information. If a worker uses the mobile time clock, the Service may capture the device’s approximate GPS location at clock-in (on a best-effort basis) to help verify where time was recorded. This is associated with the time entry.

Payment information. When you subscribe, our payment processor (Stripe) collects and processes your payment-card details; we do not store full card numbers. We store limited billing status (such as whether a subscription is active or in trial and its renewal date).

Usage, device, and log information. Standard technical data such as IP address, browser and device type, pages and features used, timestamps, and error logs, used to operate and secure the Service.

For residents of California and other U.S. states that require it, the following table lists the categories of personal information we collect, examples of each, and the business or commercial purpose for which it is collected. Any of these categories may be disclosed to the sub-processors listed in Section 5 for the purposes described. We collect this information from you directly and from your use of the Service.

We use information to: provide, operate, maintain, and secure the Service; store your records and display them back to you; generate the reports and documents you request; perform the integrations you authorize; process your subscription and payments; prevent fraud and abuse and enforce our Terms; provide customer support; understand and improve the Service; and comply with legal obligations. We do not sell your information, and we do not use it for third-party advertising.

We share information only as needed to provide the Service, and we require our providers to protect it and use it only for that purpose. Our key sub-processors are:

• Supabase — cloud database, authentication, and file storage (United States).
• Vercel — application hosting (United States).
• Stripe — subscription billing and, if you enable it, processing your clients’ online payments to your own connected account.
• Intuit / QuickBooks Online — only if you connect it, for the syncing you initiate.
• Resend — sending transactional and account emails (such as invitations and password resets).
• Web push providers — if you enable push notifications, your browser/device push service (e.g., Apple, Google, or Mozilla) delivers them.
• Product analytics — if enabled, a privacy-focused analytics provider helps us understand aggregate usage; this is disabled unless we activate it.

We may also disclose information to comply with law, respond to lawful requests, protect the rights, safety, and security of users or the public, or in connection with a merger, acquisition, or sale of assets (with continued protection under this Policy). A Data Processing Addendum is available on request for customers who need one.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, in each case as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA) and similar U.S. state laws. We have not sold or shared personal information in the preceding twelve months. We do not use sensitive personal information to infer characteristics about you; we use it only for the limited purposes described in this Policy (for example, maintaining the payroll and direct-deposit records a customer chooses to store). Because we do not engage in any of these activities, there is nothing to opt out of. We retain personal information for as long as your account is active and as needed to provide the Service, and thereafter only as required to comply with our legal, tax, accounting, or security obligations or to resolve disputes.

Connecting QuickBooks is optional and only happens if you authorize it. When you connect, we receive and store authentication tokens and your QuickBooks company identifier, and we access your QuickBooks company only as needed to perform actions you initiate — such as looking up or creating a customer or creating an invoice that mirrors one in ExpenseDesk. We do not use your QuickBooks data for any other purpose and do not sell or share it. You can disconnect at any time from Settings, which deletes the stored connection tokens, and you may also revoke access from your Intuit account. Your QuickBooks account is governed by Intuit’s own terms and privacy policy.

We use cookies and similar technologies that are strictly necessary to keep you signed in and to operate and secure the Service. If product analytics is enabled, it may set limited first-party analytics identifiers; we do not use third-party advertising or cross-site tracking cookies. Because the industry has no common standard, we do not respond to browser “Do Not Track” signals, but we already do not track you across other sites or sell your data.

We retain information for as long as your account is active and as needed to provide the Service. When you delete a business or your account, the associated data is removed from our active systems; residual copies may persist for a limited period in encrypted backups before being overwritten on our normal backup cycle. We may retain limited information as required to comply with legal, tax, accounting, or security obligations, or to resolve disputes.

We use commercially reasonable technical and organizational measures to protect information, including encryption in transit (HTTPS), hashed passwords, optional multi-factor authentication, leaked-password protection, server-side handling of integration tokens, and database access controls (row-level security) so that each account can access only its own businesses’ data. No online service can guarantee absolute security. You are responsible for keeping your credentials confidential, managing the access you grant your own users, and limiting the sensitive information you choose to store.

You can view, correct, export, and delete your data at any time within the Service (including full data export and account deletion in Settings). Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act (CCPA/CPRA) and other U.S. state privacy laws — including the right to know or access the personal information we hold about you, to request its correction or deletion, and to not be discriminated against for exercising these rights. Because we do not sell personal information and do not share it for cross-context behavioral advertising, there is no such activity to opt out of. To exercise a right, contact us at the address below; we will verify your request and respond as required by law, and you may use an authorized agent where permitted. If your information is in the Service because a business (our customer) entered it, please direct your request to that business, which is the controller of that information.

If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or another state with a comprehensive consumer privacy law, you may have the right to: confirm whether we process your personal information and access it; correct inaccuracies; delete personal information; obtain a portable copy of information you provided; and opt out of the sale of personal information, targeted or cross-context behavioral advertising, and profiling that produces legal or similarly significant effects. We do none of these activities, so there is nothing to opt out of. To submit a request, contact us at the address in Section 17; we will verify your identity and respond within the time your state’s law requires. You may use an authorized agent where the law permits. If we deny your request, you may appealthat decision by replying to our response or writing to the same contact address with the word “Appeal” and a brief explanation; we will review the appeal and inform you of our decision and its reasons within the period your state’s law allows. If you disagree with the outcome of your appeal, you may contact your state Attorney General. As noted above, where your information is in the Service because a business entered it, that business is the controller and you should direct your request to them.

The Service is intended for businesses and individuals at least 18 years old. It is not directed to children, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

We store and process information on infrastructure located in the United States. The Service is intended for users in the United States; if you access it from elsewhere, you consent to processing in the United States.

We may update this Privacy Policy as the Service evolves. If we make material changes, we will update the “Last updated” date and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

This Privacy Policy may be provided in English and Spanish for your convenience. In the event of any conflict, inconsistency, or ambiguity between the English version and any translation, the English version governs and controls.

Questions or privacy requests can be directed to access@expensedeskpro.com.