Privacy Policy

1.1 Information You Provide

• Account Information: Name, email address, company name, password
• Financial Data: Revenue figures, expenses, projections, and other business metrics
• Payment Information: Processed securely through our payment providers
• Communications: Support tickets, feedback, and correspondence

1.2 Information Collected Automatically

• Usage Data: Features used, time spent, interaction patterns
• Device Information: Browser type, operating system, device identifiers
• Log Data: IP address, access times, pages viewed
• Cookies: Session management and preference storage

1.3 Third-Party Information

You choose which services to connect. We request read-only access wherever the provider offers it; where a provider offers no read-only option — QuickBooks does not — we request its narrowest available scope and block write operations in our own systems. We do not create, modify, or delete records in your connected services, with one exception: if you ask Andy to send an invoice you already have in QuickBooks, QuickBooks records that the invoice was emailed.

• Accounting (QuickBooks, Xero, Sage): Chart of accounts, transactions, balances, and related financial records, used to build your historical actuals
• CRM (HubSpot): Deal names, amounts, stages, close dates, pipeline and stage configuration, associated company names, and deal owner names and email addresses, used to produce pipeline-weighted revenue forecasts. Nothing is written back to your CRM.
• Messaging (Slack): Workspace, channel and user identifiers, and the content of messages you send Andy in Slack, whether by direct message or by mentioning it in a channel. Those messages are processed as described in section 4. Slack also receives information from us: the alerts you ask for, Andy's replies to you, and a summary on Andy's Slack home tab that can include your cash balance and runway.
• Design (Canva): Canva receives information from us rather than providing it. When you connect it and insert data into a design, we send the figures you select — headline metrics such as revenue, cash balance, burn rate, runway and headcount; income statement and cash flow rows; per-line revenue and expense breakdowns under your own line names; forecast-versus-actuals variance; and rendered charts.

2.1 Service Delivery

• Provide and maintain the Profitual service
• Process your financial projections and calculations
• Save and sync your data across devices
• Generate reports and analytics

2.2 Service Improvement

• Analyze usage patterns to improve features
• Develop new functionality based on user needs
• Fix bugs and enhance performance
• Create aggregated industry benchmarks (anonymized)

Data retrieved from the services you connect is excluded from aggregated benchmarks, and is never used to train or fine-tune AI or machine learning models. See section 4.

2.3 Communication

• Send service updates and important notices
• Respond to support requests
• Provide onboarding and educational content
• Send marketing communications (with consent)

2.4 Legal and Security

• Comply with legal obligations
• Prevent fraud and abuse
• Enforce our terms of service
• Protect rights and safety

3.1 Service Providers

We share information with trusted service providers who assist us in operating our business:

• Cloud Infrastructure: Google Cloud Platform (Google LLC) for hosting and file storage
• AI Processing: Google Cloud Vertex AI, as described in section 4
• Conversation Storage: MongoDB Atlas
• Payment Processing: Stripe for secure payments
• Authentication: Clerk for user authentication
• Analytics: PostHog for product analytics and session replay. Session replay records your interactions with the application — the pages you view, mouse movement, clicks and scrolling — so we can understand how features are used and diagnose problems. A recording can include the financial information displayed on your screen during the session.
• Email: Resend for transactional and notification email
• Bug Reporting: Marker.io, including screenshots you choose to submit

Each processes your information only on our instructions and for the purpose listed.

Canva and Slack are different. If you connect either, the information described in section 1.3 is sent to that service at your direction rather than ours, and what it does with that information is governed by your agreement with that service and its own privacy policy.

3.2 Legal Requirements

We may disclose information if required by law, court order, or governmental request, or if we believe disclosure is necessary to protect rights, property, or safety.

3.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.

3.4 Aggregated Data

We may share aggregated, anonymized data that cannot identify you personally for research, marketing, or business purposes.

Profitual includes an AI financial assistant ("Andy"). This section explains how it handles your data.

4.1 What Is Sent

To answer your questions and generate analysis, we send relevant business data, including data retrieved from the services you have connected, to Google Cloud Vertex AI, operated by Google LLC, which acts as our service provider. Google processes this data to return a response to us. It is not used to build profiles or for advertising.

4.2 We Do Not Train Models on Your Data

We do not use your data, or data retrieved from the services you connect, to train, fine-tune, or otherwise develop artificial intelligence or machine learning models, and we do not use it to generate labeled training data.

4.3 Conversation History

Your conversations with Andy, including any data retrieved to answer them, are stored so that you can return to them. We keep them until they are deleted: you can delete any individual conversation at any time from the conversation list in Andy, and you can ask us to delete your conversation history by writing to privacy@profitual.ai. We do not currently apply an automatic expiry to conversation history, and deleting an organization does not delete it.

5.1 Security Measures

We implement industry-standard security measures including:

• 256-bit SSL encryption for data in transit
• Encryption at rest for stored data
• Access tokens for connected services held in access-controlled storage and deleted when you disconnect. Tokens for our QuickBooks, Xero and HubSpot integrations are additionally encrypted at rest, and we are extending this to our remaining integrations.
• Access controls and authentication requirements
• Regular backups and disaster recovery procedures

5.2 Employee Access

Access to personal information is limited to employees who need it to perform their jobs. All employees are bound by confidentiality agreements.

5.3 Incident Response

In the unlikely event of a data breach, we will notify affected users within 72 hours and take immediate steps to secure the system.

6.1 Access and Portability

You can access, download, and export your data at any time through the Service. We provide standard formats including CSV and Excel.

6.2 Correction and Deletion

You can update your information through your account settings. To request deletion of your account and data, contact support@profitual.ai.

To delete data retrieved from a service you have connected, you can disconnect it and use the deletion control in your integrations settings, or contact us at privacy@profitual.ai.

6.3 Communication Preferences

You can opt out of marketing communications at any time. Service-related communications are necessary for account operation and cannot be opted out of while maintaining an account.

6.4 Cookie Management

You can manage cookie preferences through your browser settings. Note that disabling cookies may affect Service functionality.

We retain your information for as long as your account is active or as needed to provide services. Specifically:

• Active Account Data: Retained while account is active
• Closed Account Data: Deleted within 90 days of closure
• Session Recordings: Retained by our analytics provider for 30 days
• Backup Data: Retained for 30 days for recovery purposes
• Legal Records: Retained as required by law
• Anonymized Data: May be retained indefinitely

Data From Connected Services

• Accounting (QuickBooks, Xero, Sage): Financial records synced from the integration are deleted when you disconnect it
• CRM (HubSpot): Data we hold for a portal is deleted within 30 days of disconnecting. You can request immediate deletion from your integrations settings.
• Organization Deletion: Deleting an organization deletes the organization and the data we hold for its HubSpot portal. It does not by itself delete financial records synced from an accounting integration — disconnect that integration before deleting the organization, or contact us at privacy@profitual.ai and we will delete them for you.
• Conversation History: Retained as described in section 4

Profitual operates globally. Your information may be transferred to and processed in countries other than your country of residence, including the United States.

We ensure appropriate safeguards are in place for international transfers, including standard contractual clauses and compliance with applicable data protection laws.

Profitual is not intended for use by children under 18 years of age. We do not knowingly collect personal information from children. If we learn we have collected information from a child under 18, we will delete it.

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the new policy on this page
• Updating the "Last Updated" date
• Sending email notification for significant changes
• Obtaining consent where required by law