App Privacy Policy
BRS Accounting Solutions App Privacy Policy
Effective date: November 10, 2026
Applies to: the BRS Accounting Solutions bookkeeping application ("the App"), including bank connection links we send to our clients.
Website policy: our website, bookkeepingbrian.com, has its own policy at https://www.bookkeepingbrian.com/privacy. This policy covers the App only.
1. Introduction
BRS Accounting Solutions ("we," "us," "our") provides accounting and bookkeeping services. We use the App to keep our own books and our clients' books: we import bank and credit-card transactions, categorize them, reconcile them against bank statements, and prepare financialstatements.
This policy explains what information the App collects, why, who we share it with, and how we protect it. It is written to meet the same laws our website policy follows, including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), the Virginia Consumer Data Protection Act and other U.S. state privacy laws, and, because we are a firm that provides tax and accounting services, the privacy and safeguards rules of the Gramm-Leach-Bliley Act ("GLBA") as enforced by the Federal Trade Commission. For our clients' data, we act on their behalf as their accountant. For our own staff accounts in the App, we are the business that decides how that data is used.
2. Principles of data processing
As on our website, we follow the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability. In the App this means we ask banks only for the data bookkeeping needs, and we use it only to keep the books.
3. Core privacy commitments
We do not sell your information, and we do not share it for advertising. We do not use bank data for lending, credit decisions, or marketing. We never see or store your online banking username or password. Bank and financial data is stored only in the United States. The App has no advertising, analytics, or tracking cookies.
4. Who uses the App
Our staff sign in to the App to do your bookkeeping.
Business clients and their owners do not have App accounts. When you connect your bank, we send you a single-use link. It opens one page with a "Connect your bank" button, and nothing else in the App. The link works once, expires within 30 days, and we can cancel it at any time. The App is for businesses. It is not directed to consumers or to children, and we do not
knowingly collect information from anyone under 18.
5. Information the App collects and why
a) Bank and credit-card data (through Stripe Financial Connections). When you connect an account, you sign in to your bank through Stripe, not through us. With your permission, Stripe gives us:
the account's name, type (checking, savings, or credit card), and last four digits;
current and available balances;
transactions: date, amount, description as shown by your bank, and status (pending, posted, or removed).
We use this to record your transactions in your books, suggest how each should be categorized, reconcile your accounts, and prepare your financial statements. We do not receive your full account number, routing number, or the name and address on the account, and we do not ask for them. The App refreshes this data about once a day while the connection is active.
b) Accounting records we import or create. Reports exported from QuickBooks (chart of accounts, balance sheet, transaction history, and vendor and customer contact lists), journal entries, reconciliations, and financial statements. Contact lists may include names, email addresses, phone numbers and mailing addresses of your vendors and customers.
c) Documents you or we upload. Bank statements, receipts, and payroll reports (for example
an ADP payroll register). Payroll reports can contain employee names and pay and tax-withholding
amounts. We use them to record transactions and to support entries in your books.
d) Staff account and security data. Name, email address, password (stored only as a secure hash by our sign-in provider), optional two-factor authentication, and sign-in records such as time and IP address. The App also keeps an audit log of every change: who made it, what changed, and when.
e) Connections to other accounting systems. If we connect your QuickBooks Online or ADP account, we store the access tokens those services issue, encrypted. We do not store your passwords for them. We do not collect health, biometric, precise location, or similar sensitive personal data.
6. How AI is used
The App uses artificial intelligence to suggest how transactions should be categorized and to read figures from uploaded documents. A person on our staff reviews AI suggestions; only suggestions with high confidence may be posted automatically, and every automatic posting can be reviewed and reversed. Our AI providers (Section 8) process the data only to provide this service to us. Our AI providers do not use your data to train their models.
7. Cookies
The App uses only strictly necessary cookies: a secure, HttpOnly sign-in session cookie for staff, and the cookies Stripe sets on its bank connection window to secure that connection (governed by Stripe's privacy policy). The App has no advertising, analytics, or tracking cookies. Because we use no optional cookies, the App shows no cookie banner.
8. Third-party processors
We share App data only with the service providers below, each under contract and only to run the App for us.
Provider
What it does for us Data it handles
Stripe, Inc. (Financial Connections) Connects to your bank and delivers balances and transactions Your bank login (handled by Stripe and your bank, never by us), account details, balances, transactions
Supabase, Inc. Database, file storage, and staff sign-in (hosted in the U.S., Ohio region) All App data
Vercel Inc. Hosts and runs the App Data passing through the App while it is in use
TypeSafe (Jev) AI that suggests transaction categories Transaction descriptions, amounts, dates, and related account history
Anthropic, PBC (Claude) AI that reads figures from uploaded documents and writes short explanations Uploaded documents and related transaction details
ADP Payroll records Payroll run totals
We may also disclose information when the law requires it, for example in response to a valid subpoena, or to protect against fraud. Stripe's handling of your bank data is also described in Stripe's own privacy policy and its Financial Connections notice, shown to you when you connect: https://stripe.com/privacy.
9. Disconnecting a bank
You can ask us to disconnect a bank account at any time, and you can also revoke access through Stripe or, at many banks, from your online banking settings. After a disconnection, we stop receiving new data. Transactions already imported stay in your books, because they are part of your accounting records.
10. Data retention
Accounting records, imported transactions, and documents: 7 years after the end of the fiscal year they relate to, matching the retention of transaction records on our website policy and professional record-keeping requirements. [Brian's Answer: confirm 7 years, and what happens when a client leaves the firm: hand over a copy, then delete after the retention period?]
Audit log: for as long as the records it describes.
Staff accounts: deleted when the staff member leaves, except for audit log entries. Unused bank connection links: expire within 30 days. We keep only a scrambled (hashed) form of the link, never the link itself.
11. How we protect your information
All connections to the App use HTTPS.
Staff must sign in; two-factor authentication is available.
Each client's data is kept separate from every other client's data at the database level.
Uploaded documents are private and opened only through short-lived links.
Tokens for connected services are encrypted. Our secret keys are kept only in our server environment, never in the database or the browser. Every change is recorded in an audit log. The database is backed up daily.
12. Data breach notification
As on our website, we notify affected clients and regulators within 72 hours of a known breach, or sooner where the law requires.
13. Your rights
Depending on where you live, you may ask us to:
Access a copy of your information;
Correct inaccurate information;
Delete your information, subject to the record-keeping rules in Section 10;
Port a copy of your data in a usable format (we can export your books and documents);
Restrict or object to certain processing, or withdraw consent, including by disconnecting your bank (Section 9).
How to exercise these rights: email Brian@bookkeepingbrian.com or call (571) 444-5032. We respond within the legally required time (typically 30 to 45 days, with an extension where the law allows). We may need to verify your identity first, for example by confirming details yougave us before. If we cannot verify it, we will explain why.
Appeals: if we deny your request, email Brian@bookkeepingbrian.com with the subject line "Privacy Request Appeal." We respond within 60 days. Virginia residents who are unsatisfied may contact the Virginia Attorney General.
Authorized agents (California): you may authorize an agent to act for you by giving written permission and verifying your identity.
14. Do not sell or share (California)
We do not sell or share personal information as defined by the CPRA, and we offer no financial incentives in exchange for it. If this ever changes, we will update this policy and provide a visible opt-out link.
15. Changes to this policy
We will update this page when the App changes how it handles information, and change the effective date above. If a change is significant, we will tell our clients directly before it takes effect.
16. Contact
BRS Accounting Solutions
Brian R. Schobel, CPA
Brian@bookkeepingbrian.com · (571) 444-5032