Privacy Policy
1. INTRODUCTION
Zaifi ("Company," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Zaifi mobile application, web application, and related services (collectively, the "Service").
Please read this policy carefully. If you disagree with its terms, please discontinue use of the Service.
2. INFORMATION WE COLLECT
A. Information You Provide Directly
- Account information: email address, name, and password (or OAuth tokens via Google or Apple sign-in)
- Two-step sign-in: every account signs in with a second step. If you choose text messages, we collect your mobile phone number. It is held by our authentication provider, Google Firebase, used only to text you sign-in codes, and removed when you remove that sign-in method or delete your account. If you use an authenticator app instead, no phone number is collected. Backup codes are stored only in a scrambled form that cannot be turned back into the codes, and each is deleted once used.
- Business profile: business name, address, phone number, and business email
- Tax profile: filing status, estimated income, state of residence, business structure, EIN
- Invoices and customer records you create within the Service
- Books you import: if you bring in your books from other accounting software, the General Ledger and Profit & Loss Detail files you choose are read on your device, and what they hold — your accounts, transactions and balances, and the customers and vendors they name — is stored with your account as your books. The files themselves are not uploaded. If Zaifi cannot work out how such a file is laid out and you ask it to, its column headings and about 40 of its rows are sent to our AI provider (see Anthropic in section 4).
- Financial goals, budgets, and savings targets you enter manually
B. Financial Data via Plaid
When you connect a bank account, Plaid Technologies (our bank connectivity provider) retrieves:
- Account balances and transaction history
- Account and routing numbers (used only for identification, not stored by Zaifi)
- Institution name and account type
We receive transaction data (date, amount, merchant name, category) from Plaid and store it to provide the Service. We do not receive or store your bank login credentials.
C. Usage and Device Data
- We do not track how you use Zaifi. No analytics or advertising tools record the screens you open, what you tap, or how long you stay.
- Error reports, when something goes wrong in the app: the kind of error, where in Zaifi's own code it happened, and whether it happened on Android, an iPhone or the website. They are sent to our own servers and kept with our server logs. They contain nothing you have entered and nothing from your bank or payment accounts, and carry no name, email address or account details.
- Server logs. Like any website, our servers record the requests they receive, including your IP address and the kind of browser or app that sent each one. We use these logs to keep the Service running and secure (for example, to limit repeated attempts at recovering a sign-in or at booking through a booking page), keep them for 30 days, and do not use them to work out where you are.
- A push notification token, if you allow notifications. This is an identifier issued by Apple or Google that lets us send messages to your device. We store it against your account, noting which person on the account signed in on that device, so we can reach the right device and a notice meant for one person reaches only theirs. We delete it when you turn notifications off, sign out, or the token is withdrawn by the operating system. It does not identify you to anyone else and we do not use it for advertising.
D. Receipts and Documents
If you use a scanning feature, you may upload images of documents: receipts, bills, mortgage statements (if you record a home), paperwork from selling a business asset, and a Schedule K-1 (if your business has other owners). With your permission (see Anthropic in section 4), these images are sent to our AI provider, Anthropic, to read the figures printed on them. They are also stored on our servers with your account, except a Schedule K-1: it shows your name, address and taxpayer identification number, and the business's, so we read only your ownership percentage and the tax year from it, and its image is not kept.
A mortgage statement contains more than the figures we extract from it: it typically shows your loan account number, your property address, and your outstanding balance. We extract and retain only the payment breakdown, the balance, the interest rate, and the statement date. The uploaded image itself is stored with your account until you delete it.
E. Property Information
If you record a home, we store what you tell us about it: what you paid, when you bought it, and the metropolitan area it is in. We do not ask for or store the property address. We estimate what the home is worth using published Federal Housing Finance Agency house price data, which is applied on your device — we do not send your property details to any valuation service.
F. Card Payments on Your Invoices (Stripe)
If you connect your own Stripe account to one of your businesses, so customers can pay its invoices by card:
- We keep which Stripe account each business is connected to, and who connected it — you, or a household member on your account.
- When an invoice carries a card payment link, we create that link in your Stripe account. We send Stripe the invoice number, the customer name on the invoice, the amount, which of your businesses it is for, and an internal identifier of your Zaifi account, so a payment reaches the right books. This information is held in your own Stripe account, under Stripe's terms with you.
- When a customer pays through a link, Stripe tells us the invoice number, the amount, and the name the customer entered at checkout, and we mark the invoice paid.
- To keep your books in line with Stripe, we read your Stripe balance and your recent payouts: their amounts, dates, and the fee on each payment.
- We never see or store card numbers. Your customers enter them on Stripe's own payment page.
- When you disconnect Stripe, connect a business to a different Stripe account, or delete your Zaifi account, we revoke our access to the Stripe account concerned, unless another of your businesses is still connected to it. Card links already sent keep working, and payments through them still reach that Stripe account.
3. HOW WE USE YOUR INFORMATION
We use your information to:
- Provide, operate, and improve the Service
- Automatically categorize transactions and generate financial reports
- Estimate tax liabilities (for informational purposes only — see Terms of Service Section 3)
- Generate financial tips and insights from your own records
- Process subscription payments and manage your account
- Send transactional communications (receipts, account notices, security alerts)
- Comply with legal obligations
- Detect and prevent fraud, abuse, and security incidents
We do not use your financial data for advertising targeting and do not sell your personal information.
4. THIRD-PARTY SERVICE PROVIDERS
We share your data with third-party service providers solely to operate the Service:
- Google Firebase (Google LLC): Authentication, cloud database (Firestore), and delivering push notifications (Firebase Cloud Messaging). Data may be stored on Google's global infrastructure. Privacy policy: policies.google.com/privacy
- Plaid Technologies, Inc.: Bank account connectivity and transaction data retrieval. When you connect a bank account, you also agree to Plaid's End User Privacy Policy at plaid.com/legal. Plaid may share transaction data with us as described in their policy.
- RevenueCat, Inc.: Subscription and in-app purchase management. RevenueCat receives your app user ID and subscription status. Privacy policy: revenuecat.com/privacy
- Anthropic, PBC: Zaifi's AI features. We send Anthropic: images of documents you scan (receipts, bills, mortgage statements, paperwork from selling a business asset, and a Schedule K-1), so the figures on them can be read; the payee name, description and amount of payments Zaifi cannot sort with its own rules (money you receive is never sent); the messages you type to the help chat; and, if Zaifi cannot work out how a General Ledger or Profit & Loss Detail you import is laid out and you ask it to, the file's column headings and about 40 of its rows, so its columns can be identified (the rest of the file is read on your device). We send nothing to Anthropic until you allow it, and you can withdraw permission at any time in Settings → Privacy & Security. Without it, Zaifi sorts your transactions with its own rules, and scanning, the help chat and reading an imported file ask for permission before they are used. Anthropic processes this data on our behalf, and its terms with us do not permit it to train AI models on it. Anthropic's privacy policy is available at anthropic.com/privacy.
- Stripe, Inc.: Payment processing for web subscriptions and, if you connect your own Stripe account, the card payment links on your invoices (see Section 2.F). Stripe collects and processes payment card data; we do not store full card numbers. Privacy policy: stripe.com/privacy
- Apple Inc. / Google LLC: In-app purchase processing on iOS and Android respectively.
These providers are contractually required to protect your data and use it only as directed by us.
5. HOUSEHOLD SHARING
Business Premium subscribers may invite one additional household member to access their account. When a household member is invited and accepts:
- The invited member gains read-write access to all financial data in the account
- Both parties can view and modify transactions, reports, invoices, and other account data
- The account owner is responsible for managing access and can remove the member at any time. A member who is removed loses access to the account, and the invitation they joined with cannot be used again
- A household member can connect or disconnect Stripe for the owner's businesses. If a member connects a business to a different Stripe account, the account owner is told, by a notification and a notice in the app
- The invited member's email address is stored in the owner's account profile
6. ACCOUNTANT ACCESS
You may invite an accountant or bookkeeper to access one or more of your businesses. This is sharing your financial data with another person, and you should treat the decision accordingly.
When you invite an accountant and they accept:
- They gain access to the financial data of each business you grant them, including transactions, reports, invoices, and tax figures
- They can categorise and correct transactions, and those corrections change your records
- They may hold access to several clients' accounts, and choose which to work in; they see only the businesses they have been granted
- Their email address is stored against your account so the invitation can be managed
- You may withdraw their access at any time, and doing so takes effect immediately
We do not share your data with an accountant unless you invite them, and we do not introduce or recommend accountants. Your arrangement with them, including what they may do with what they see, is between you and them.
7. DATA SHARING AND DISCLOSURE
We do not sell, rent, or trade your personal information. We may disclose your information:
- To service providers listed in Section 4
- To comply with applicable law, regulation, court order, or legal process
- To enforce our Terms of Service or protect the rights, property, or safety of Zaifi, our users, or others
- In connection with a merger, acquisition, or sale of substantially all of our assets (with notice to you)
8. DATA SECURITY
We implement industry-standard security measures including encryption in transit (TLS) and at rest, authentication controls, and access limitations. However, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.
If you believe your account security has been compromised, contact us immediately at support@zaifibooks.com.
9. DATA RETENTION
We retain your data for as long as your account is active or as needed to provide the Service.
A. If you delete your account
We will delete or anonymize your personal data within 30 days, except where we are required to retain it for legal, tax, or accounting purposes (typically up to 7 years for financial records, as required by law) or to resolve disputes.
B. Accounts that are no longer used
We do not keep your records indefinitely if you stop using Zaifi. If you have not opened the app for 24 months, we will delete your account and the data in it.
You will not lose anything without warning. Before that happens we email the address on your account, at least 30 days beforehand, to tell you the account is about to be deleted. Opening the app and signing in is all it takes to keep it — you do not need to reply to us or fill anything in, and the clock starts again from that day. If you would like a copy of your records but not the account, email support@zaifibooks.com and we will send you an export before anything is removed.
We check for inactive accounts every three months rather than continuously, so an account may remain a little beyond 24 months before the notice is sent.
10. YOUR RIGHTS AND CHOICES
Regardless of your location, you may:
- Access: Request a copy of the personal data we hold about you
- Correction: Request correction of inaccurate personal data
- Deletion: Request deletion of your account and associated data
- Portability: Request your transaction data in a machine-readable format
- Withdraw consent: You can disconnect a bank account in the app at any time. Transactions already imported stay in your books, because your financial records depend on them. You can also withdraw your consent directly with your bank or through Plaid (my.plaid.com). When we are notified that you have done so, we stop accessing that account immediately, and the transactions and account details imported from it are deleted from your books the next time the Zaifi app syncs. If you reconnect the account later, its history can be imported again.
To exercise these rights, contact us at support@zaifibooks.com. We will respond within 45 days.
11. CALIFORNIA PRIVACY RIGHTS (CCPA / CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
- Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the purposes for collection, and the categories of third parties with whom we share it.
- Right to Delete: You may request deletion of personal information we have collected, subject to certain exceptions.
- Right to Correct: You may request correction of inaccurate personal information.
- Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising.
- Right to Limit Use of Sensitive Personal Information: We use sensitive personal information (such as financial data) only to provide the Service and do not use it for inferring characteristics unrelated to the Service.
- Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
To exercise your California privacy rights, contact us at support@zaifibooks.com or submit a request through the app's Settings → Privacy section. We will verify your identity before processing your request and respond within 45 days (extendable by an additional 45 days with notice).
Categories of personal information collected in the last 12 months:
- Identifiers (name, email, IP address)
- Financial information (bank transactions, account data via Plaid)
- Commercial information (subscription status, billing history)
- Internet/electronic activity (server logs of requests, including IP address, kept for 30 days; error reports)
- Professional/employment information (business name, EIN, business structure)
- Inferences drawn from the above to create a financial profile for the purpose of delivering the Service
12. VIRGINIA PRIVACY RIGHTS (VCDPA)
If you are a Virginia resident, you have rights under the Virginia Consumer Data Protection Act (VCDPA), including the right to access, correct, delete, obtain a copy of, and opt out of the processing of your personal data for targeted advertising or profiling. We do not process personal data for targeted advertising or sell personal data as defined by the VCDPA. To exercise your rights, contact support@zaifibooks.com.
13. COLORADO PRIVACY RIGHTS (CPA)
If you are a Colorado resident, you have rights under the Colorado Privacy Act (CPA), including the right to access, correct, delete, and obtain a portable copy of your personal data, and to opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling. Contact support@zaifibooks.com to exercise these rights.
14. CONNECTICUT PRIVACY RIGHTS (CTDPA)
If you are a Connecticut resident, you have rights under the Connecticut Data Privacy Act (CTDPA) similar to those described above. Contact support@zaifibooks.com to exercise your rights.
15. TEXAS PRIVACY RIGHTS (TDPSA)
If you are a Texas resident, you have rights under the Texas Data Privacy and Security Act (TDPSA), including the right to access, correct, delete, and obtain a portable copy of your personal data. We do not sell personal data or process it for targeted advertising. Contact support@zaifibooks.com to exercise your rights.
16. WHERE THE SERVICE IS OFFERED
Zaifi is built for United States taxpayers and small businesses. Its tax calculations, filing statuses, and reporting are specific to U.S. federal and state rules, and the Service is intended for use in the United States only.
We do not offer the Service in the European Economic Area, the United Kingdom, or Switzerland, and we do not target users in those regions. Accordingly this policy does not set out rights under the EU or UK General Data Protection Regulation. If you access the Service from outside the United States, you do so on your own initiative, and your information will be stored and processed in the United States, where privacy laws differ from those in your country.
17. CHILDREN'S PRIVACY
The Service is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If we learn we have collected such information, we will delete it promptly. If you believe we have inadvertently collected information from a child under 13, contact us at support@zaifibooks.com.
18. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time. We will notify you of material changes by updating the version number and date at the top of this document and, where appropriate, by in-app notification. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.
19. CONTACT
Questions or requests regarding this Privacy Policy may be directed to:
Zaifi Books LLC — Privacy Team support@zaifibooks.com