Privacy policy
What we keep, and why.
FirmSum turns the statements and receipts you send into finished books. To do that we have to hold your financial records. This page says plainly what we collect, who can see it, and how to get it removed.
What we collect
- Your account. Your name, email address, and password (stored as a hash, never in plain text). If you sign in with Google, we receive your name, email address, and Google account id from Google. We never see your Google password.
- Your business records. The files you upload (bank and card statements, PayPal, eBay, Stripe and other exports, receipt photos) and everything we build from them: transactions, categories, the answers you give to questions, your rules, and the reports we produce.
- Your accountant. If you invite an accountant, their name and email address, and the questions and answers exchanged inside FirmSum.
- Sign-in security. If you turn on the second sign-in check, the secret that makes it work. We keep basic access logs (time, browser, approximate location from the network address) to protect your account.
Why we use it
- To read your statements, work out what each transaction is, and produce your books.
- To ask you plain questions when something is not clear, and to remember your answers.
- To let the people you invite see and work on the same books.
- To send you account emails: confirmations, password resets, and updates you have asked for.
- To keep the service secure and to fix problems.
We do not sell your data. We do not use your records for advertising.
Who can see it
Your books are visible to you and the people you invite, and nobody else at FirmSum unless you ask us for help with a specific problem. Behind the scenes, a small number of service providers process your records on our behalf, under contracts that limit them to that purpose:
- Supabase (database, file storage, and sign-in), hosted in the United States.
- Vercel (web hosting and the background workers that read your files).
- Document reading and categorization services that read your statements and receipts to extract transactions. They receive the pages they need to read and nothing else.
- Resend (account and notification emails).
- Google, only if you choose to sign in with Google.
We will disclose records if the law requires it, and we will tell you when we are allowed to.
How long we keep it
As long as your account is open, so your books are there when you need them next year. Encrypted backups are kept separately so your originals can be restored. When you delete your account, your records are removed from the working system right away and from backups on their rolling schedule.
Your choices
- Download your books and originals at any time from the year-end package.
- Remove an accountant’s access from your settings at any time.
- Ask us to correct or delete anything, or to close your account, at privacy@firmsum.com. We answer within 30 days.
- If you signed in with Google, you can also revoke FirmSum’s access from your Google account permissions page.
Security
Records travel and rest encrypted. Access inside the system is limited to the account and the people it has invited, enforced in the database itself. A second sign-in check is available for every account. No system is perfectly secure; if we ever learn of a breach affecting your data, we will tell you.
Children
FirmSum is for businesses and is not directed at anyone under 18.
Changes
If this policy changes in a way that matters, we will email you before it takes effect. The date at the top always shows the current version.