Privacy policy

Who we are

With a client's permission, our software connects to the client's accounting, banking, email and business-management accounts and keeps the client's books up to date. We are a software and bookkeeping service. We are not a bank, we do not hold or move client funds, and our connections to bank and card accounts are read-only.

Information we collect

Website. If you submit the Get started or Book a free demo form, we collect your first and last name, your business name, your email address and, on the Get started form, your phone number. The website does not ask for a password, does not use analytics, advertising or tracking technologies, and sets no cookies. Our website host automatically keeps standard server logs (such as IP address, browser type, the page requested and the time) so the site stays available and secure.

Client portal account. When an account is set up for you or your business, we collect your name, email address and business name. You create your own password in the portal. The portal keeps you signed in using a session stored in your browser, which is used only for sign-in and is not used for advertising.

Connected-service data. When you authorize a connection, we receive the data needed to keep your books. Depending on what you connect, this can include:

• bank and credit card account details, balances and transactions (through Plaid);
• accounting records such as invoices, bills, vendors, customers and the chart of accounts (through QuickBooks);
• invoices, receipts and related email messages and attachments from the inboxes you connect (through Gmail or Outlook);
• jobs, customers, payments and spend data from your business tools (such as ServiceTitan, Jobber, JobNimbus or BILL); and
• documents you upload to the portal.

How we use information

We use information only to provide, secure and support the service for the client who authorized it. That includes reading and categorizing transactions, matching documents to payments, preparing entries and posting them to the client's accounting system according to the client's approval settings, reconciling books to bank activity, answering the client's questions about its own books, communicating with you, billing, preventing fraud and abuse, and meeting legal obligations. We do not sell personal information and we do not use it for advertising.

Bank connections through Plaid

We use Plaid Technologies, Inc. ("Plaid") to connect to your financial accounts. When you use Plaid Link, Plaid collects your login credentials and other information directly, under the Plaid End User Privacy Policy at https://plaid.com/legal/#end-user-privacy-policy. We never see or store your bank username or password. We receive from Plaid the account and transaction information you authorize, for read-only use.

Data we receive through Plaid is used only to provide the service to the client who connected the account. It is not used for advertising, is not sold, and is excluded from any analysis across clients and from any de-identified dataset. You can disconnect a bank connection at any time in the portal or by contacting us, and you can manage your connections with Plaid at https://my.plaid.com.

Google and Microsoft account data

If you connect a Gmail or Outlook inbox, we request only the access needed to find and read invoices, receipts and related messages so we can code them to your books. For Gmail, that means permission to read messages and attachments, to mark processed messages as read and file them under a label, and to send approval requests and notifications from the connected account. We use that content only to provide that service to you. We do not use it for advertising, we do not sell it, we exclude it from cross-client analysis and from any de-identified dataset, and we do not allow humans to read it except where you ask for support, where it is necessary for security or abuse investigation, or where the law requires.

Margin Pulse's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke our access at any time in your Google Account permissions or Microsoft account settings, or by contacting us.

Automated processing

To provide the service, some client documents and transactions are processed by an artificial-intelligence service from Anthropic through its commercial API. This is used to extract invoice details, suggest account coding, flag possible duplicates and power the portal's read-only question feature. Our provider processes this data on our behalf to provide the service. Entries that change a client's books are reviewed or approved according to the client's settings. AI output can contain errors, which is why clients review it.

Who we share information with

We share information only with service providers that help us deliver the service, and only as needed. Our current providers are:

• Supabase: database, user login and an encrypted secrets vault;
• Vercel: website and client portal hosting;
• Railway: backend and integration services;
• Anthropic: AI processing of bills and transactions;
• Stripe: subscription billing and payments;
• Resend: transactional email; and
• FormSubmit: relays website form submissions to us by email when our own email sending is unavailable.

Services you connect

When you connect them, we access Plaid, Intuit QuickBooks, Google (Gmail), Microsoft (Outlook), ServiceTitan, Jobber, JobNimbus and BILL on your behalf. These services are governed by their own terms and privacy policies.

We may also disclose information if the law requires it, or to protect rights and safety. If Margin Pulse is sold or merged, client data transfers only with the business and under the same commitments made here, and clients are told. We do not sell personal information.

Your consent and choices

We collect and process connected-service data only after you, or the business you act for, agree to our client agreement and authorize each connection. You can withdraw consent at any time by disconnecting a service in the portal, revoking access in the provider's own settings, or contacting us. Withdrawing consent stops further collection but does not affect what was done before.

Retention and deletion

We keep client data for the life of the client relationship and only as long as needed to serve that client.

• When a client ends service, we disconnect its connections, including removing Plaid connections and revoking accounting, email and other tokens.
• The client may ask for an export of its data within 30 days after service ends.
• Within 60 days after service ends, we delete the client's data from our production database and storage, or irreversibly de-identify it, and we delete its stored credentials.
• You may ask us to delete your information at any time by emailing admin@marginpulse.io. We confirm each request, complete it within 30 days and keep a record of it, subject to legal holds and records we are required by law to keep.
• Backups age out under our hosting provider's schedule and are not restored for deleted clients. Billing records are kept as tax and accounting rules require, and security logs are kept only as long as needed.
• We may keep de-identified, aggregated learnings that do not identify any client, individual or account. We do not re-identify them, and they never include data received through Plaid, Google or Microsoft.

Security

We use safeguards designed to protect information, including encryption of data in transit and at rest, storage of connection credentials in an encrypted secrets vault that is read only by our server-side systems, access limited to the people who need it, multi-factor authentication on our administrator accounts, individual logins for client users, automated daily database backups, an audit log of postings and approvals, and a written information security policy that we review at least annually.

No system is completely secure. If we confirm that client data was accessed or disclosed without authorization, we will notify affected clients without undue delay and no later than 72 hours after confirmation.

Your privacy rights

Depending on where you live, you may have the right to know what personal information we hold about you, to correct it, to delete it, and to receive a copy. We do not sell personal information or share it for cross-context advertising. To make a request, email admin@marginpulse.io. We may need to verify your identity.

For data we process for a business client, that client controls the data and we act as its service provider. If your request concerns a business client's data, we will refer you to that client unless the law requires otherwise.

Children

Our service is for businesses and is not directed to people under 18. We do not knowingly collect information from children.

Changes to this policy

We may update this policy. We will change the date at the top and, for material changes, notify clients before they take effect. If we add analytics, another form, or anything else that collects information on this website, we will update this policy before that change goes live.