Privacy Policy
The short version. Your client files never leave your computer. The BooksTied engine is JavaScript that runs inside your browser; there is no upload step and no server that processes files. The offline edition makes no network requests at all. The only personal data we hold is what you give us to pay or to receive a license: an email address, a name, a plan, and a monthly count of how many engagements you ran. Our website statistics are cookie-free and aggregated.
1. What we do not collect
- Your files. Financial statements, ledgers, vouchers, reports, workpapers: none of them, and none of their contents (file names, sheet names, company names, amounts, text), are sent to us or to anyone else. Processing happens in the browser's memory on your device.
- Your drafts and exports. Generated in the browser and saved by you to your own disk.
- Your review notes, sign-off state and manual edits. Stored in your browser's local storage on your device only. We cannot see them. Clearing site data deletes them.
- Cookies. We set none. Language and theme preferences are kept in local storage on your device.
You can verify this: open your browser's developer tools, Network tab, then drop a folder into BooksTied. No request leaves the page. The Security page has step-by-step instructions and a test with the network switched off.
2. What we do collect, and why
| Data | When | Purpose | Legal basis (GDPR / UK GDPR) | Kept |
|---|---|---|---|---|
| Email address, name, billing country, plan, Stripe customer ID | You buy Pro, Offline or Firm | Provide the plan, issue receipts and licenses, send service notices | Contract | Account lifetime + 7 years for tax records |
| Monthly engagement count (a number) | Web edition with an account | Enforce plan limits and bill overage | Contract | 24 months |
| License key (signed text containing your email and update expiry) | You buy the offline edition | Let the offline edition verify your license locally | Contract | License lifetime |
| Support emails | You write to us | Answer you | Legitimate interest | 3 years |
| Website statistics (page URL, referrer, country derived from IP and then discarded, browser type, event names such as “try_done”) | You visit the website or use the web edition | Understand which pages and languages people use | Legitimate interest; no cookies, no identifiers, aggregated | Aggregated indefinitely; no raw IP stored |
| Marketing email address and consent record | You sign up for updates, or are a US business contact we write to | Send product news; you can unsubscribe in one click | Consent, or legitimate interest for US B2B under CAN-SPAM | Until unsubscribe + 3 years suppression |
Payment card numbers are collected and stored by Stripe, not by us. We see only the last four digits and the card brand.
3. Product analytics: what an “event” contains
Our statistics script sends event names and a short list of allow-listed attributes: the interface language, the traffic source (for example “youtube” or “direct”), the edition (web or offline), and bucketed numbers such as “≤5 seconds” or “≤10 exceptions”. It never sends file names, company names, amounts, exception text or anything typed into the application. The offline edition does not load the script at all, and the script respects the browser's Do Not Track and Global Privacy Control signals. The full list of events is published in our documentation.
4. Who we share data with
| Processor | What | Where |
|---|---|---|
| Stripe, Inc. | Payments, receipts, tax calculation | USA (EU/UK transfers under Stripe's standard contractual clauses) |
| Vercel, Inc. | Hosting of the website and web edition; server logs with IP addresses kept briefly for security | USA / edge locations |
| Supabase, Inc. | Database for accounts, plans, engagement counts and cookie-free website statistics | USA |
| Email provider | Transactional and marketing email | USA |
We do not sell personal data and do not share it for cross-context behavioral advertising. We disclose data only to these processors, to comply with law, or to protect our rights.
5. International transfers
We are a US company. If you are in the EEA, UK or Switzerland, account data is transferred to the US under the processors' standard contractual clauses. Because your client files are never transferred anywhere, using BooksTied does not by itself cause a cross-border transfer of your clients' data. If you are in mainland China, note likewise that no client data or personal information in your files is transferred outside China by the Service; only the account data in section 2 is held in the US, with your consent at purchase.
6. Your rights
Depending on where you live (GDPR, UK GDPR, CCPA/CPRA and other US state laws, PIPL, PDPA and others) you may have the right to access, correct, delete or export your personal data, to object to or restrict processing, to withdraw consent, and to complain to a supervisory authority. Email privacy@asteryn.com; we answer within 30 days and will verify your identity by replying to the account email. We do not discriminate against you for exercising these rights. California residents: we do not “sell” or “share” personal information as defined by the CPRA, and we honor Global Privacy Control.
7. Security
The strongest control is architectural: there is no server that holds your files, so there is nothing to breach. Account data is stored encrypted at rest and in transit, access is limited to the people who need it, and payment data never touches our systems. Offline edition licenses are verified with a public key embedded in the application; the private key is kept offline. If a breach affecting your personal data ever occurs, we will notify you and the relevant authority as required by law.
8. Children
The Service is for professionals and not directed to anyone under 18. We do not knowingly collect data from children.
9. Changes
We will post changes on this page with a new date. If a change reduces your rights or collects new categories of data, we will notify account holders by email at least 14 days in advance.
10. Contact
Asteryn LLC, [REGISTERED ADDRESS] · privacy@asteryn.com. EU/UK representative: [to be appointed if required under Article 27].