How we handle your information

Account information: name, business name, email address, entity type (LLC, S-Corp, etc.), Stripe customer ID.

Financial data you provide: documents you upload or forward (invoices, receipts, bank statements, contracts), extracted data from those documents (vendor, amount, date), journal entries posted to your books, monthly reports generated.

Usage data: sign-in times, pages viewed in the portal, download events. Minimal; no third-party analytics.

To provide the bookkeeping service: classify your documents, post transactions to your chart of accounts, reconcile bank activity, generate monthly reports, and send you email updates.

To improve the service: anonymized usage signals only. We do not train models on your data.

To comply with legal obligations: tax, audit, and subpoena responses.

Two humans can access your books: you (via sign-in) and Saad Kakakhel (the bookkeeper). No other staff, contractors, or third-party services have access.

Sub-processors (vendors we rely on):

• Supabase — database and authentication (US, SOC 2)
• Vercel — web hosting (US, SOC 2 + ISO 27001)
• Google Workspace / Drive — document folder (US, SOC 2)
• Stripe — payment processing (US, PCI DSS Level 1)
• Resend — transactional email (US, SOC 2)
• Anthropic / OpenAI — document classification and extraction (US; zero-retention API where available)

Each has their own privacy/security posture. We do not sell your data to anyone.

All data is stored in US-based facilities by the sub-processors above. We retain your books for as long as your account is active plus seven years after closure (matching typical US tax-record retention requirements).

You can request export or deletion at any time by emailing hi@1folder.xyz. We'll respond within 30 days.

Depending on where you live, you may have the right to access, correct, delete, or export your data. You can also object to or restrict processing. To exercise any of these, email us at the address above.

California residents: see the additional rights under the CCPA. European residents (if any): see GDPR Article 15–22 rights.

Data is encrypted in transit (TLS 1.3) and at rest. Per-customer isolation is enforced at both the application and database layers. See our Security page for details.

If we ever experience a security incident affecting your data, we'll notify you within 72 hours of discovery.

We'll post material changes here with a revised date, and email you when changes are significant enough to warrant it.

1folder is operated by SaadLLC (Saad Kakakhel).
Email: hi@1folder.xyz