Privacy Policy

Effective Date: May 1, 2025 Last Updated: April 15, 2026

ELGADA ("Numbra," "we," "us," or "our") operates the Numbra platform (the "Service"), a multi-client practice management tool designed for solo bookkeepers and small accounting firms. This Privacy Policy describes how we collect, use, share, and protect personal information when you use our Service.

By using Numbra, you agree to the practices described in this Policy. If you do not agree, please do not use the Service.

1. Who This Policy Applies To

This Privacy Policy applies to:

• Bookkeepers: independent professionals or small firms who subscribe to Numbra to manage their client engagements.
• Client End-Users: businesses whose financial data is managed by a Bookkeeper through Numbra, who may access Numbra's Client Portal.
• Visitors: anyone who interacts with our website (numbra.tech) or marketing materials.

For clarity: when a Bookkeeper uses Numbra to manage their client's books, Numbra acts as a data processor for that client's data, while the Bookkeeper acts as the data controller. The Bookkeeper is responsible for obtaining consent from their clients to share data with Numbra.

2. Information We Collect

2.1 Information You Provide Directly

• Account information: name, email address, password (stored hashed via Argon2id), business name, phone number, billing address.
• Authentication data: time-based one-time passwords (TOTP), MFA recovery codes (stored hashed), security questions.
• Profile information: profile photo, time zone, language preferences.
• Payment information: collected and processed by our payment processor (Stripe). We do not store full credit card or bank account numbers on our servers.
• Client business data: information about the client businesses you manage, including business name, contact details, industry, pricing tier.
• Communications: emails, support tickets, feedback, and other communications with us.

2.2 Financial Data You Upload or Import

• Bank transactions: imported via Plaid integration or manual upload, including transaction descriptions, amounts, dates, vendor names, account balances.
• Invoices and bills: PDF documents, extracted text via OCR, vendor information, payment amounts, due dates.
• Receipts: PDF/image files, extracted data via OCR (Anthropic Claude vision).
• Accounting records: imported from QuickBooks Online or Xero via OAuth, including chart of accounts, journal entries, categorizations, reconciliations.
• Vendor information: vendor names, contact details, banking information (account and routing numbers, stored encrypted at rest using AES-256-GCM), W-9 forms.

2.3 Information Collected Automatically

• Device information: browser type, operating system, device identifiers, IP address, screen resolution.
• Usage data: pages visited, features used, time spent, clicks, error logs.
• Cookies: see Section 9 below.
• Performance and crash data: collected via Sentry (errors are scrubbed for personally identifiable information before transmission).

2.4 Information from Third Parties

When you connect third-party services (QuickBooks Online, Xero, Plaid, Google Drive, Stripe), we receive information from those providers as authorized by you via OAuth, including:

• Account identifiers and tokens (OAuth refresh tokens stored encrypted at rest using AES-256-GCM)
• Financial transactions and account balances
• Customer and vendor lists
• Document files (in the case of Google Drive Migration Assistant)

We only access data you explicitly authorize via OAuth scopes.

3. How We Use Your Information

We use your information to:

• Provide and operate the Service: process transactions, generate financial reports, send invoices, manage workflow.
• Authenticate and secure your account: verify identity, enforce MFA, detect suspicious logins, prevent fraud.
• Communicate with you: send transactional emails (login alerts, password resets, billing notifications, system updates), respond to support requests.
• Improve the Service: analyze usage patterns, fix bugs, develop new features.
• Process payments: charge your subscription, debit your client's accounts via ACH for billing on your behalf (with their authorization).
• AI-powered features: send transaction descriptions and document content to Anthropic Claude API for automatic categorization, rule suggestions, and document classification. We do not use this data to train Anthropic's models (per our agreement with Anthropic).
• Comply with legal obligations: respond to lawful requests from authorities, enforce our Terms of Service, comply with FTC Safeguards Rule (16 CFR Part 314).
• Send marketing communications (only if you opt in): product updates, tips, newsletters. You can opt out at any time.

We do not sell your personal information to third parties for monetary consideration. See our CCPA Disclosure for more details.

4. How We Share Your Information

4.1 Sub-processors

We use the following sub-processors to operate Numbra. Each is contractually bound to protect your data and use it only for the specified purpose:

We will update this list when we add or remove sub-processors. Material changes will be communicated to active users via email.

4.2 With Other Parties

• Your client end-users: if you invite a client to the Client Portal, that client can see their own data and your interactions with them.
• Legal authorities: when required by law, court order, or to protect our rights or others' safety.
• In case of business transfer: if Numbra is acquired or merged, your data may be transferred to the new entity (subject to this Policy or an equally protective replacement).

4.3 Aggregate or Anonymized Data

We may share aggregated, anonymized statistics (e.g., "average number of transactions per bookkeeper") that cannot be used to identify you.

5. Data Retention

• Active account data: retained for the duration of your subscription.
• Financial records (transactions, statements, audit logs): retained for 7 years after creation, in compliance with FTC Safeguards Rule and standard accounting record retention requirements.
• Billing records: retained for 7 years for tax and audit purposes.
• Account deletion: upon request, we delete your account and personal information within 90 days, except financial records retained for legal/regulatory compliance.
• Backups: we keep encrypted, off-site backups on a rolling schedule (recent daily backups, then weekly and monthly copies) retained for up to approximately six months. When you delete data, it is removed from the live system immediately (or within the account-deletion window above); residual copies in encrypted backups then age out and are permanently purged within this backup-retention window.

You can request deletion of your account at any time by contacting contact@elgada.tech. See Section 7 for details on your rights.

6. Data Security

We implement industry-standard security measures, including:

• Encryption in transit: all data transmitted via TLS 1.3.
• Encryption at rest: database encryption via Postgres TDE; sensitive fields (OAuth tokens, vendor banking info, account numbers) encrypted with AES-256-GCM using a key stored in a separate key management system.
• Authentication: passwords hashed with Argon2id (OWASP 2024 parameters); multi-factor authentication (TOTP) required for all accounts.
• Access controls: Row-Level Security (RLS) at database level; application-level authorization checks (tenant isolation tested via automated tests).
• Audit logs: all access to financial data logged in an immutable audit log, retained for 7 years.
• Network security: HTTPS-only, HSTS, strict Content Security Policy with nonce, CSRF protection.
• Vulnerability management: weekly automated security scans, dependency updates via Dependabot, annual penetration testing.
• Incident response: documented incident response plan with severity levels and notification procedures. We commit to notifying affected users within 72 hours of confirming a data breach.
• Employee access: limited to a need-to-know basis; all employees sign confidentiality agreements; production access requires MFA and is logged.

Compliance frameworks: we operate in accordance with the FTC Safeguards Rule (16 CFR Part 314).

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at contact@elgada.tech.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Right to access: request a copy of the personal information we hold about you.
• Right to correct: request correction of inaccurate or incomplete information.
• Right to delete: request deletion of your personal information (subject to legal retention requirements).
• Right to export: request your data in a portable, machine-readable format (JSON or CSV).
• Right to restrict processing: ask us to limit how we use your data in certain situations.
• Right to object: object to processing for specific purposes (e.g., direct marketing).
• Right to withdraw consent: where processing is based on consent, withdraw at any time.

To exercise these rights, contact us at contact@elgada.tech. We will respond within 30 days (or 45 days for CCPA requests, see CCPA Disclosure).

California residents have additional rights. See our CCPA Disclosure.

EU/UK residents (GDPR/UK GDPR): we currently do not target the EU/UK market, but if you are located there and use our Service, contact us to discuss your rights.

8. International Data Transfers

Numbra is operated from the United States. By using the Service, you understand that your information will be transferred to, stored, and processed in the United States and other countries where our sub-processors operate (see Section 4.1).

For users in jurisdictions with data protection laws (EU, UK, Canada, etc.), we rely on Standard Contractual Clauses (SCCs) and other approved transfer mechanisms with our sub-processors to ensure your data receives adequate protection.

9. Cookies and Similar Technologies

We use the following types of cookies:

• Strictly necessary cookies: required for authentication, security (CSRF protection), session management. Cannot be disabled.
• Functional cookies: remember your preferences (theme, language). Set only after you make a choice.
• Analytics cookies (opt-in only): used by PostHog to understand usage patterns. We mask all input fields by default.

We do not use advertising cookies or third-party tracking cookies.

You can control cookies via your browser settings, but disabling strictly necessary cookies will break Service functionality.

10. Children's Privacy

Numbra is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with information, contact us immediately and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes:

• We will update the "Last Updated" date at the top.
• We will notify active users via email at least 30 days before the changes take effect.
• For California residents and EU/UK users (when applicable), we will obtain renewed consent for material changes that require it.

Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

12. Contact Us

For privacy questions, data requests, or to report a security issue:

ELGADA Email: contact@elgada.tech General inquiries: contact@elgada.tech

For security vulnerabilities, please use responsible disclosure: contact@elgada.tech

This Privacy Policy is governed by the laws of the United States, without regard to conflict of law principles.