Privacy Policy

Who this covers

This policy covers two things: the public website at www.deepsum.com (the "website") and the DeepSum reporting application at www.deepsum.com/reports (the "application"). "DeepSum", "we" and "us" mean the team that operates both. Privacy questions and requests go to hello@deepsum.com.

1. The website

The website has no accounts and does not ask you to sign in. We run no analytics, no advertising networks, no session recording and no social-media pixels on it, and we set no cookies of our own. The contact form opens your own email program with a pre-filled message; nothing is sent to us until you choose to send that email. The pages are delivered by our hosting provider (Vercel), which processes your IP address and browser details for the time it takes to serve a page and to protect the service from abuse. If you email us, we keep your message and address for as long as the conversation is relevant.

2. The application: your account and organization

When you create an account we collect your name, email address and a password (or your Google account identity if you sign in with Google), the name of your organization and its account type, the companies you add (name, country, data source) and the plan you choose. Sign-in is handled by Clerk, our authentication provider, which sets the strictly necessary session cookies that keep you signed in; we do not use cookies for anything else. If you invite colleagues, we send them an invitation email with the address you give us.

3. QuickBooks Online data you connect

DeepSum connects to QuickBooks Online only when you authorize it through Intuit's OAuth 2.0 consent screen, with the accounting scope. We never see or store your Intuit password. The connection is read-only: DeepSum does not create, change or delete anything in your QuickBooks company.

To build your reports we read your chart of accounts, transactions and general-ledger detail (invoices, bills, payments, expenses, journal entries, deposits and similar), open customer and supplier balances, company preferences such as your home currency, and the standard financial reports (Profit & Loss, Balance Sheet, Cash Flow, General Ledger, receivables and payables ageing). We keep a normalized copy of this data in our database so that reports, dashboards, drill-downs and PDF exports are produced from DeepSum's own ledger rather than by calling QuickBooks each time. After the first import, DeepSum checks QuickBooks for changes on a schedule (about every 30 minutes) and refreshes history in batches; you can also trigger a sync yourself.

The OAuth tokens that let DeepSum read your company are stored encrypted (AES-256-GCM) with a key held in a managed secret store, and are never written to logs. You can disconnect a company at any time from the application; disconnecting deletes the stored tokens, and you may additionally revoke DeepSum's access in your Intuit account settings. Intuit's own privacy statement governs what Intuit does with your data.

4. Files you upload

Financial imports. If a company's data comes from an Excel or CSV file instead of QuickBooks, we store the file and the accounting data in it to produce that company's reports, and we keep a record of each import so later imports can be reconciled against earlier ones.

Documents. If you upload documents such as receipts or bills for extraction, the content of that document is sent to a third-party large-language-model provider (OpenRouter) solely to extract fields such as the supplier, date, amount and line items, which are then shown to you for review. This is the only use of AI models in DeepSum. No data obtained from QuickBooks Online is ever sent to any AI or model provider, and we do not use your data to train models.

5. What we use data for

To provide the service: importing and synchronizing your accounting data, producing reports, dashboards, management packs and PDFs, and showing data health and sync status. To run the service: authentication, access control, backups, security monitoring and support. To meet legal obligations. We do not sell personal data, do not share it with advertisers, and do not use it for purposes unrelated to the service.

6. Who else processes data for us

DeepSum runs on Google Cloud in the United States (region us-central1): application servers, the database that holds your data, and the secret store that holds credentials. The website and the application's static files are delivered by Vercel. Clerk provides authentication. OpenRouter processes documents you upload for extraction (section 4). Intuit provides the QuickBooks Online API when you connect a company. Each provider processes data only to perform its function for us. Your data is stored in the United States; if you use DeepSum from elsewhere, your data is transferred to and processed there.

7. How long we keep data

Account and organization data is kept for as long as your account exists. Accounting data imported from QuickBooks or from files is kept while the company exists in DeepSum, so your reports and history remain available; disconnecting QuickBooks deletes the access tokens immediately but keeps the imported ledger until you remove the company or ask us to delete it. Database backups are taken daily and expire automatically within a short, fixed period. When you ask us to delete your account or a company's data, we delete it from the live system within 30 days and from backups when those expire.

8. Security

All traffic to the website, the application, our database and QuickBooks uses TLS. Data is encrypted at rest; QuickBooks tokens are additionally encrypted at the application level. Access to production systems follows least privilege, secrets live only in a managed secret store, and application logs never contain passwords, tokens or secrets. See our Security page for more.

9. Your rights and choices

You can ask us for a copy of the personal data we hold about you, ask us to correct it, export your accounting data, disconnect a QuickBooks company, remove a company, or delete your account. Where the law gives you additional rights (for example in the EEA or the UK: restriction, objection, portability, and the right to complain to a supervisory authority), you can exercise them the same way. Email hello@deepsum.com; we answer within 30 days.

10. Children

DeepSum is a business service and is not directed at children. We do not knowingly collect personal data from anyone under 18.

11. Changes to this policy

If we change this policy we will update the effective date at the top of this page and, for material changes, tell signed-in users in the application. Continued use after a change means you accept the updated policy.

Contact

Privacy questions, access or deletion requests: hello@deepsum.com