Privacy Policy
Last updated
ZapBooks connects to your email and your accounting software, which means we handle data that matters. This page explains exactly what we access, what we keep, and what you can do about it.
This policy applies to zapbooks.app and the ZapBooks application. ZapBooks is operated by Everyday Software LLC.
What we collect
We collect three categories of data, and only these three.
- Account data: your name, email address, company name and billing details. You give us this when you sign up.
- Connected mailbox data: messages and attachments that our classifier identifies as invoices, bills or receipts, plus the sender address, subject and date of those messages. We request read-only access.
- Extracted invoice data: vendor, invoice number, dates, amounts, tax, line items, purchase order references and currency, taken from the documents we process.
- Usage data: pages visited, features used, and error diagnostics, collected through our analytics providers.
How we access your mailbox
Mailbox access uses OAuth. You authenticate directly with Google or Microsoft and grant a scoped permission; we never receive, request or store your email password.
The permission we request is read-only. ZapBooks cannot send, move, modify or delete mail. You can revoke access at any time from your Google or Microsoft account security settings, or by disconnecting inside ZapBooks. Revocation takes effect immediately.
If you scope the connection to a specific label or folder, we only examine messages within it.
How we use your data
- To identify which messages are invoices and extract structured data from them.
- To match vendors and apply your coding rules so bills post correctly.
- To detect duplicates and flag anomalies such as changed vendor bank details.
- To write bills into the accounting system you connected.
- To provide support, investigate faults and improve extraction quality.
- To bill you and to send service messages about your account.
What we do not do
- We do not sell your data, and we do not share it with data brokers or advertisers.
- We do not use the contents of your mailbox for advertising or profiling.
- We do not move money, initiate payments or access your bank accounts.
- We do not read messages our classifier does not identify as invoices, bills or receipts beyond what is necessary to make that classification.
Sub-processors
We use third-party services to run ZapBooks. Each has access only to the data needed for its function, and each is bound by its own data processing terms.
- Cloud hosting and storage providers, for running the application and storing documents and extracted data.
- AI model providers, for document classification and data extraction.
- Payment processing, for subscription billing. Card details are handled by the payment processor and never stored by ZapBooks.
- Analytics and product telemetry providers, for usage data.
- Email delivery providers, for transactional messages.
How long we keep data
- Extracted invoice data and source documents are retained while your account is active, so you can search and re-sync them.
- After you cancel, your data remains accessible for 90 days, then is deleted.
- You can request deletion at any time before that, and we will delete within 30 days of the request.
- Backups are retained on a rolling basis and purged on their normal cycle, which may extend deletion of backup copies beyond the primary deletion.
- Account and billing records are retained as long as required for tax and accounting purposes.
Security
Data is encrypted in transit using TLS and encrypted at rest by our storage providers. Access to production systems is restricted to personnel who need it.
No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you without undue delay.
Your rights
Depending on where you live, you may have rights to access, correct, export or delete your personal data, and to object to or restrict certain processing. Residents of the EU and UK have these rights under GDPR; California residents have comparable rights under the CCPA and CPRA.
To exercise any of them, email [email protected]. We will respond within the timeframe the applicable law requires.
Children
ZapBooks is a business product and is not directed at anyone under 16. We do not knowingly collect data from children.
International transfers
ZapBooks is operated from the United States and data may be processed there and in other countries where our sub-processors operate. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses.
Changes to this policy
If we make a material change we will update the date at the top of this page and notify account holders by email before the change takes effect.
Contact
Questions about this policy, or any request about your data: [email protected].