SlashbooksPrivacy Policy
Slashbooks (“Slashbooks”, “we”) is a bookkeeping service for accounting firms and small businesses. AI agents do much of the bookkeeping work, and people review it. This policy says what data we collect, why, who handles it, and what you can do about it. The service is run by Lower Coast Labs, LLC.
What we collect
Account data. Your name, your email address, and how you sign in:
- A password, which we store only as a salted hash (PBKDF2-SHA256).
- Passkeys, where we store the public key and not the private key.
- Google sign-in, where we store Google’s stable account identifier, your verified email and your name. We do not store Google access tokens.
- Two-step sign-in, where we store the authenticator secret encrypted and your recovery codes as hashes.
Business and financial data you bring. Books, transactions, receipts, statements and other files you upload, reports, questions and answers, and the audit trail of changes. If you connect a bank account, we receive account details, balances and transactions through our bank data provider. We never see your bank password. If you connect Stripe, we read charges, payouts and fees with read-only access. We cannot move money.
Email you send to your books address. Each company can have its own books email address. We keep the messages and attachments sent to it, with the sender and recipient addresses, and the questions and replies we exchange with you.
Device and session data. When you sign in we record the sign-in method, a short browser and system label such as “Chrome on macOS”, an approximate place (city, region and country) that Cloudflare adds to the request, and the last time the session was active. We do not keep your IP address in the session record. We use your IP address to limit repeated sign-in attempts. Your browser also sends its time zone once, so the work week starts on your Monday.
QuickBooks Online data
When the QuickBooks connection is available, an admin can import company details, accounting preferences, accounts, customers, vendors, items, classes, departments, transactions and reports. Slashbooks refreshes imported data for ongoing bookkeeping review, reconciliation, report comparisons and category suggestions. Slashbooks does not write changes back to QuickBooks. Intuit’s permission permits writes.
Imported data follows this policy, including authorized AI processing. We do not train AI models with it. Credentials are encrypted and not sent to AI providers.
Disconnecting in Settings › Connections stops syncs and removes saved credentials from active systems. If Intuit revocation fails, revoke access in QuickBooks Connected Apps. Previously imported records and reports stay in Slashbooks, but access and further processing require reconnection. Delete the company to remove them; the deletion wait and backup retention periods below apply.
Cookies and tracking
Slashbooks sets only cookies that the service needs to work:
- Session cookie (
__Host-slashbooks_session): keeps you signed in. It is HttpOnly, Secure and lasts at most 90 days. - Device cookie (
__Host-slashbooks_device): a random value, valid for up to 400 days, so that we can tell you about a sign-in from a browser we have not seen. It is not a credential. - Google sign-in cookie: short-lived, set only while you sign in with Google.
The app also keeps a few settings in your browser storage, such as your time zone and the last company you opened. We use no advertising cookies and no analytics in the app. When you connect a bank, the bank connection window loads from Plaid and Plaid’s own terms apply there.
On our public pages (not inside the app), we count visits with PostHog, Inc., an analytics provider. We record the page, the site you came from (without its full address), any campaign tags in the link (utm_ values), your country, and the buttons you select. We do not use cookies or store anything on your device for this, and we do not send your IP address, name or email to PostHog. When you request access, we store the campaign tags and the first page you opened with your request.
Why we use your data
- To provide the service: keep the books, prepare reports, and run the AI agents you turn on.
- To secure accounts: sign-in checks, new-device notices, rate limits and an audit trail.
- To send service email, such as invitations, security notices and questions about your books.
- To support you when you write to us.
- To meter AI use against your credits.
Slashbooks does not sell or share your data, except with the providers below that process it for us. We do not use your business data to train AI models.
Who processes your data
These companies process data for us. They act under their own terms and security programs.
- Cloudflare: hosting, database, file storage, compute containers, AI gateway, email screening and network delivery. All customer data is on Cloudflare.
- OpenAI: the AI model for scheduled bookkeeping automation. Requests go through Cloudflare AI Gateway and carry transaction text, evidence extracts and questions.
- Google: the AI model for Ask Slashbooks Help. It receives your question and Help article text, and no company data. Google also provides Google sign-in, if you use it.
- AgentMail: company books inboxes, inbound email delivery and our outbound notifications.
- BankSync: bank connections. BankSync holds the bank access tokens, and uses Plaid to log in to your bank and read your data. Only US institutions are enabled.
- Stripe: if you connect it, we read your Stripe data with read-only access. We do not take payments through Stripe.
- PostHog, Inc.: counts visits on our public pages, with no cookies and no IP address.
If we add a provider that handles customer data, we will update this list.
Where your data is
Slashbooks runs on Cloudflare’s global network. We do not choose or promise a data region.
How long we keep it
- Books, files, emails and reports stay while the company is active.
- Sessions for accountants, firm owners and platform staff end after 7 days without use, or 30 days after sign-in. Other sessions end after 30 days without use, or 90 days after sign-in.
- When a company admin deletes a company, a 72-hour wait applies. After that, we remove its database records and files and check that none remain.
- Database backups are kept for 35 days. Backup copies of files are kept for 30 days. When an off-site backup copy is enabled, it is kept for 70 days. We do not edit backups to remove one company early, so deleted data leaves backups when they expire.
- If a plan ends with a refund, the books are read-only for 30 days so you can export them. After that, deletion follows the normal process.
- Sealed audit records, which hold fingerprints of audit events and not their text, are kept for 730 days. We keep a record that a deletion happened, with no company name or data.
- AI diagnostic details are kept for 30 days, detailed operational events for 90 days, and cost and quality totals for 13 months.
Security
- All traffic uses HTTPS. Data at rest is encrypted by Cloudflare. Stripe and QuickBooks connection tokens get an extra layer of encryption by Slashbooks.
- Backups are encrypted.
- You can use passkeys and two-step sign-in. Platform administrators must use two-step sign-in.
- Each company’s data is separate. An accountant sees only the clients assigned to them.
- You can see your signed-in devices and sign out any of them.
No system is perfectly secure. We are preparing for a SOC 2 audit and we do not claim SOC 2 compliance today. If we confirm a breach that affects you, we will tell you within 72 hours.
How AI uses your data
When you turn on bookkeeping automation, AI agents read your company’s transactions, documents and emails. They categorize, reconcile, prepare reports and draft questions for you. Each run happens in an isolated container with no internet access and no credentials. The agent cannot pay, approve or close a period, change access, or send free-form email. People review and approve the books.
The onboarding voice meeting sends your audio to OpenAI to run the conversation. We ask OpenAI not to store it, and we do not store it. Model requests go through Cloudflare AI Gateway to OpenAI. We ask OpenAI not to store them, and the gateway keeps metadata but not prompt or response text. We do not promise that the provider keeps no copy. Incoming email is screened first, and its text is treated as data and never as instructions. AI output is a draft that you or your accounting firm must review.
When you connect your own AI assistant, such as Claude or ChatGPT, Slashbooks sends the books data that the assistant asks for to that assistant. The assistant’s provider handles it under your own agreement with that provider. Slashbooks does not control that provider.
Your rights and choices
- Export. You can export reports and data as CSV and XLSX.
- Deletion. A company admin can delete a company in settings. To delete your account, write to us.
- Access and correction. Write to us to see or correct your account data.
If your firm or employer set up your account, they control the company data and we process it for them.
Changes
We will post changes here and update the date above.
Contact
Write to hi@slashbooks.co. Our mailing address is Lower Coast Labs, LLC, 627 Opelousas Ave STE 36155, New Orleans, LA 70114.