Privacy Policy
Last updated: October 13, 2026 — Version 1.0.0
1. Introduction
ProfitSync ("we", "us", "our") provides accounting and client-tracking software ("the Service") on profitsync.net, in our Android and iOS apps, and to AI apps you choose to connect to it. This Privacy Policy explains what personal data we collect, why we use it, who receives it, how long we keep it, and the controls you have over it.
2. Data we collect
- Account data: name, email address, password hash and sign-in metadata, handled by our identity provider (Clerk).
- Workspace data: the names of your personal and company workspaces, their members and their roles.
- Financial and business data you enter or import: accounts and balances, transactions, budgets, recurring entries, debts, cards (only the last four digits of a card number), clients, quotations, notes and attachments.
- Contacts you save: the name, company, phone numbers, email addresses, note and extra details of the people you choose to keep in Contacts, and which of your transactions, clients, quotations, recurring entries and debts they are linked to. Section 3 explains how they are handled.
- Connected apps: when you connect an AI app such as ChatGPT or Claude, the app's name, the workspaces and access level you approved, when it was connected and last used, and its access tokens (stored only as hashes).
- Integrations you turn on: for Google Sheets, an encrypted Google refresh token and the spreadsheet we create in your Google Drive; for notifications, your device's push token.
- Content you send to AI features: the text, photo or voice note you give AI quick add, the assistant or statement import.
- Usage data: IP address, browser or device type, timestamps and pages viewed, for security, fraud prevention and analytics.
3. Contacts
Contacts are details about other people, so they get extra care:
- You decide who is saved. You add a contact by hand, or import a vCard, CSV, Excel or PDF file. The file is read on your device; we receive only the contacts you choose to keep, never the file itself.
- Google Contacts (personal space only): with your permission, your browser gets one-time, read-only access to your Google Contacts. It reads them, you choose who to keep, and only those reach us. The access token covers only reading your contacts, stays in that browser tab and expires within an hour; we never receive or store it, and nothing keeps reading or syncing afterwards. You can remove the permission in your Google Account at any time.
- Who can see them: contacts in your personal space are visible only to you. Contacts in a company workspace are visible to every member of that workspace, which is why importing from Google or a phone is only offered in your personal space.
- What we never do: we never contact the people in your contacts, use them for marketing or advertising, sell or share them, or use them to train AI models. We never send your contact list to our AI provider, and contacts are never written to your Google Sheet.
- Connected apps: an AI app you connect can read the contacts of the workspaces you approved, and change them if you gave it edit access.
- Your responsibility: as with any address book, you are responsible for having a good reason to keep the details of the people you add — for example, they are your customers, suppliers or acquaintances.
ProfitSync's use and transfer of information received from Google APIs (Google Contacts and Google Sheets) adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4. How we use your data
- To provide and maintain the Service, including the integrations and AI features you choose to use.
- To answer requests from apps you connect, limited to the workspaces and access level you approved.
- To authenticate you and protect your account.
- To process subscription payments and issue invoices.
- To send transactional email and notifications (sign-up, security, billing, the reminders you set, support).
- To comply with legal obligations and respond to lawful requests.
We do not sell your personal data, and we do not train AI models on it.
5. Who receives your data
We share data only to run the Service:
- Service providers (sub-processors): Clerk (sign-in), Neon (database), Vercel (hosting), Dodo Payments (our Merchant of Record for subscriptions), Resend (email delivery), Google Firebase Cloud Messaging and browser push services (notifications), an S3-compatible storage provider (quotation PDFs), Brandfetch (bank logos; it receives the bank name you search for), and the AI provider that powers our AI features (Anthropic, Google or OpenAI), which receives only the content you send to those features.
- Google, when you connect Google Sheets: the workspace data you choose to sync is written to a spreadsheet in your own Google Drive. Contacts are never included.
- AI apps you connect, such as ChatGPT or Claude: only after you authorize the connection, only the workspaces you select, and only at the level you choose (view only, or view and edit). What the app does with that data is governed by its provider's privacy policy (for example, OpenAI's or Anthropic's).
- Other members of a workspace see that workspace's data according to their role.
- Authorities, when the law requires it.
Each service provider is contractually bound to handle data consistently with applicable privacy laws.
6. Data retention
- Account and workspace data is kept while your account is active. When you delete a workspace or your account, its data is permanently removed within 30 days, except where the law requires us to keep it (for example, billing records).
- Connected apps: access tokens expire after 1 hour. A refresh token lasts 90 days and is replaced each time it is used. Revoking a connection stops it at once. A revoked connection stays in your Connected apps history until you delete your account.
- Google Sheets: the stored token is deleted when you disconnect or delete your account. The spreadsheet in your Google Drive is yours, and stays there until you delete it.
- Contacts are kept until you delete them. Deleting a contact removes it, and its links to your records, at once; deleting or resetting a workspace, or deleting your account, deletes all of its contacts.
- Usage data is kept only as long as it is needed for security and troubleshooting.
7. Your controls and rights
- Connected apps: in Settings → Connected apps you choose which workspaces each app may use and at what level, change it at any time, or revoke it. Owners and admins of a company workspace can turn connected apps off for that workspace, which stops every app's access to it.
- Integrations and notifications: disconnect Google Sheets at any time, and turn notifications off in Settings → Notifications.
- Contacts: edit or delete any contact in Contacts, and undo an import right after it runs. To withdraw Google Contacts access, use your Google Account's security settings.
- Export: download your transactions as a CSV file.
- Delete: delete your account yourself in Settings → Account; we confirm with a code sent to your email.
- Access, correction and your other rights: view and correct your data in the app, or email hello@profitsync.net to exercise any right you have under applicable law.
8. Security
We use encryption in transit (TLS) and at rest. Passwords are never stored in plain text, connected-app tokens are stored only as hashes, and Google refresh tokens are encrypted. Access to personal data is limited to the people who need it.
9. International transfers
Your data may be processed in regions outside your country. Where required, we rely on Standard Contractual Clauses or other lawful mechanisms.
10. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will update the date above and notify you in the product. Continued use of the Service after a change means you accept the updated policy.
11. Contact
Questions? Email hello@profitsync.net or visit profitsync.net/support.