Privacy Policy

Our role

We generally act as a service provider or processor for information a business puts into ClearSum or makes available through a connected account. That business controls the data and your organisation's administrator controls who may access it. We act as a controller for account administration, security, billing, marketing, and our direct communications with you.

Information we collect

• Account and company details — name, email address, authentication identifiers, profile preferences, companies, roles, invitations, and subscription information.
• Accounting data — data made available by QuickBooks Online or Xero, such as accounts, transactions, contacts, invoices, bills, tax rates, attachments, and reports, plus records ClearSum creates at your direction.
• Email data — if an administrator connects Gmail, mailbox identity, message metadata and content, labels, and attachments within the authorised mailbox boundary. Depending on the features used, ClearSum may search messages, mark messages read, or move messages to trash at a user's direction. An empty label restriction means the connected mailbox is available to the company.
• Files and work product — receipts, bills, spreadsheets, working-paper source files, extracted text, classifications, drafts, approvals, and other content you upload or create.
• Assistant conversations — prompts, responses, tool actions, feedback, and related company context. In voice mode, microphone audio is streamed to our AI provider; we retain the resulting text transcript in the conversation, not the raw audio recording.
• Website and lead information — waitlist details, messages sent through the public website assistant, and marketing preferences. Public-assistant transcript text is not stored by ClearSum after the short-lived session, although service providers may retain request data under their own business-service retention terms.
• Technical and security data — IP address, browser and device information, timestamps, request and error logs, cookie or local-storage choices, and events such as sign-in, provider connections, and company-access changes.

We collect information from you, your organisation and its users, the services you choose to connect, and automatically from your browser or device.

How and why we use information

• Provide, secure, troubleshoot, and support ClearSum, including authenticating users and enforcing company permissions.
• Read connected data, extract document details, answer questions, prepare drafts, and carry out actions that an authorised user requests.
• Improve accuracy for your account, such as vendor matching and category suggestions, and evaluate service quality using appropriately limited data.
• Send account, security, service, and billing communications and respond to requests.
• Prevent abuse, comply with law, enforce our terms, and establish or defend legal claims.
• Measure marketing performance only where you have allowed marketing tracking.

Where a law requires a legal basis, we rely on performance of our contract, legitimate interests in operating and securing the service, consent where requested, and legal obligations. You may withdraw consent at any time without affecting processing already completed.

AI processing

ClearSum sends relevant prompts, document content, connected data, and tool results to AI service providers to generate responses and proposed actions. We contract for business/API services that do not use this data to train their general models. Provider abuse-monitoring logs may be retained for a limited period under those services' terms. AI output can be inaccurate; review it before relying on it or posting it to your books.

When we share information

We disclose information only as needed to operate the service or where the law permits:

• Supabase for database, authentication, and private file storage.
• Fly.io and Vercel for application hosting and delivery.
• OpenAI for AI model and realtime voice processing.
• Intuit, Xero, and Google when you choose to connect their services. Those companies separately control data in their own services.
• Sentry for error monitoring, Resend for transactional email, and Cloudflare for security and bot protection.
• Meta for marketing measurement only after you accept optional cookies. Meta may receive page, browser, device, and network information under its own privacy terms.
• Professional advisers, regulators, law enforcement, or a buyer in a corporate transaction where reasonably necessary and legally permitted.

We do not sell personal information or accounting data.

International processing

ClearSum and its providers may process information outside the country where you live. Privacy protections may differ. Where required, we use contracts or other recognised safeguards for international transfers.

Cookies and marketing choices

Essential cookies and local storage keep you signed in, remember company and display choices, and protect the service. Meta Pixel is optional and does not load until you select Accept. You can change that choice usingCookie settings on a public page. Browser settings can also limit cookies, but blocking essential storage may prevent the application from working.

Security

• Traffic is encrypted in transit and production data is encrypted at rest.
• OAuth credentials receive an additional layer of application-level encryption, with keys kept outside the database.
• Company access is permission-checked in the application and enforced with database access controls.
• Receipt files are private and delivered through short-lived, authorised links.
• Security-relevant events are recorded and production access is limited to people who need it.

No system is perfectly secure. Please report suspected issues to the address below.

Retention and deletion

We retain account and company content while needed to provide the service. When an owner deletes a company, ClearSum deletes its active database records and stored receipt and working-paper files, requests revocation of associated providers, and removes any Gmail grant no longer used by another company. A provider may retain data already held in its own service.

Short-lived public-assistant session state expires after about one hour. Security records are retained for at least one year where required for audit and incident response. Versioned legal-acceptance records are retained as long as reasonably needed to evidence the agreement and establish or defend legal claims, taking applicable limitation periods into account. Limited encrypted backups, fraud-prevention records, and information required by law may remain until their normal expiry or the legal need ends. We delete or de-identify other information when it is no longer needed.

Your choices and rights

• Disconnect QuickBooks, Xero, or Gmail from Settings → Integration. Disconnecting a shared Gmail grant removes that company's access; the grant remains only if another company still uses it.
• Limit the Gmail labels available to your company and separately limit the labels the assistant may use.
• Delete a company from the application. Export anything you need first because active data deletion is irreversible.
• Ask for access to, correction of, portability of, or deletion of your personal information, or object to or restrict certain processing, where applicable.
• Withdraw optional-cookie consent through Cookie settings and unsubscribe from optional emails using the link provided.
• Complain to your local privacy regulator. If New Zealand law applies, this includes the Office of the Privacy Commissioner.

We may need to verify your identity and may refer a request concerning business data to the organisation that controls it. Some rights are subject to legal exceptions.

Children

ClearSum is a business service and is not intended for anyone under 18.

Changes to this policy

We will post revisions here and update the date above. If a change materially affects how we handle information, we will provide additional notice and request renewed acknowledgement where appropriate.

Contact

Privacy questions, rights requests, and security reports: help@clearsum.ai.