Privacy Policy

Ledger AI is a business copilot made and operated by Hey Ledger AI Corp. ("we", "us"), an Alberta corporation: it connects to the tools you already run your business on and answers questions about your own data. This page explains, plainly, what we collect, why, where it lives, who else touches it, and how to get rid of it.

What we collect, and why

We only collect what's needed to run the features you turn on. Every connection below requires your explicit consent — nothing connects itself.

• Account & billing — your name, email, and subscription status, so you can sign in and we know your plan is active. Card details are handled entirely by Stripe; they never reach our servers.
• QuickBooks Online — invoices, customers, and sales/P&L data, so the assistant can answer questions about your books and, when you ask it to, draft invoices or expenses. Nothing posts to QuickBooks without your confirmation.
• Gmail — read access so Receipt Radar can find supplier receipt and invoice emails on its own (incoming costs get captured instead of you forwarding them by hand), and so the assistant can list, search or open a message when you ask it to. Send access so the assistant can send a reply from your own address — each one waits for your tap unless you've given the assistant standing permission to send in Settings — and so the morning day sheets you schedule for your crew go out from your address at the hour you chose.
• Google Calendar — read and create access, so the assistant can tell you what's booked and add appointments you ask it to schedule.
• Google Business Profile — your business reviews, so the assistant can surface and help you respond to them.
• Receipt photos — images you snap of paper receipts, stored privately and accessed only through signed, time-limited URLs.
• Conversations with the assistant — what you type or say, plus the business data needed to answer it, so the assistant can hold a conversation and remember context within a session.
• Your customers and crew — the names, phone numbers, emails, addresses, vehicles, invoices, appointments, hours worked and clock-in times you enter or that arrive through your booking page, phone line and crew links. This is your business's data about the people you serve and employ; we hold and process it only on your instructions and you're responsible for collecting it lawfully.
• Crew location (Crew Command, Ledger Pro) — while a crew member is clocked in, their crew link sends their position on each status tap and clock punch, and about every 30 seconds while the link is open on their phone, so you can see a live map with drive times and send customers an honest arrival estimate. Nothing is sent off the clock — the server refuses it — and the crew member sees on their link whether sharing is on. You choose whether location is required or optional at your shop; declining never blocks a clock-in. Customers who get an arrival text see an estimate and a status, never a map dot or coordinates.
• Business phone — if you use a Ledger-provided number or forward your own line: call logs, caller numbers, text messages in both directions, voicemail recordings and their written transcripts, so missed calls, texts and voicemails show up in the app.
• Vehicle lookups — a VIN or licence-plate you scan or type is sent to a vehicle-data service to identify the year, make, model and tire sizes. Nothing else about the customer goes with it.
• Inventory & price lists — the spreadsheets you upload, so the assistant can quote from your own numbers.
• Business memory — facts you tell the assistant to remember (rates, policies, suppliers), kept until you change or delete them.
• Push notifications — a device token for your iPhone or browser, so we can alert you when a customer texts, a review lands or a job needs cover. You can turn these off in your device settings.
• Usage metering — token counts and cost per request, plus text-message counts, so we can enforce your plan's monthly AI and texting allowances.
• Cookies and analytics — none. We don't run advertising trackers or third-party analytics on our website or in the app; the only thing stored in your browser is what keeps you signed in.

Where it lives

Your account data, receipts, and conversation history are stored with Supabase (database, authentication, and file storage) in their Canadian region (Montréal), so your business data stays in Canada at rest. Some processors below run outside Canada — the AI providers, Stripe and the phone carrier are US-based — and receive only what's needed for the feature in use. Receipt images are kept in private storage and served only through signed URLs that expire — they are not publicly accessible.

How we protect it

Sensitive data — including everything we receive from Google APIs (Gmail message content, Calendar events, and Business Profile reviews) — is protected by the following controls:

• Encrypted in transit. All traffic between your browser or app, Ledger AI, and every connected service runs over TLS (HTTPS). We do not accept unencrypted connections.
• Encrypted at rest. Your database records, receipt images, and stored files are encrypted at rest by our hosting provider, Supabase.
• Google tokens are held in an encrypted vault, never in the app. Your Google access and refresh tokens are written to Supabase Vault, which stores them encrypted. Our database keeps only a reference to the vault entry — never the token itself. The functions that read a token are server-side and privileged: they are explicitly revoked from every browser and app session, so a signed-in client cannot retrieve your Google credentials even if it asks for them.
• Your workspace is isolated. Row-level security is enabled on every tenant table and every policy is scoped to your workspace, with controls designed to prevent one customer from accessing another customer's Gmail, Calendar, or business data.
• Least privilege. We request the narrowest Google scopes each feature needs, and only after your explicit OAuth consent. Gmail access is read and send: reading is used by Receipt Radar and by the assistant when you ask about a message; sending happens only on your instruction, from your own address. Calendar access is limited to reading and creating events you ask for.
• You can revoke us at any time. Removing Ledger AI at myaccount.google.com/permissions immediately ends our access to your Google data.
• Limited human access. No Ledger AI staff member reads your Gmail, Calendar, or business data as a matter of course. It happens only where needed to resolve a support request you have raised, with your knowledge.
• No training, no ads, no resale. Google user data is never used to train AI models, never used for advertising, and never sold or transferred to anyone beyond the named processors required to operate the features you switch on.
• Deletion removes the credentials too. Deleting your account deletes your stored Google tokens out of the vault along with your workspace data — see Deletion below.

Who processes it

We don't build our own AI models or payment rails — we use a small number of named processors to run the service:

• Anthropic (Claude models) — receives your conversation content and the business data needed to answer it, as the processor behind the AI assistant's text responses.
• OpenAI (Realtime API) — receives audio/conversation content when you use voice mode, as the processor behind spoken conversations.
• Supabase — hosts our database, authentication, and file storage.
• Stripe — processes your subscription payments and, if you turn on card payments, your customers' payments through your own Stripe account. The supported card-entry flows run on Stripe. Do not put card numbers, security codes, or card photographs into Ledger notes, messages, or uploads.
• Telnyx — the carrier behind Ledger-provided business numbers: routes calls and texts, stores voicemail recordings and produces the written transcripts.
• Resend — delivers the emails we send on your behalf (invoices, estimates, account confirmation and password-reset emails, receipts).
• Apple (Push Notification service) and your browser's push service — deliver notifications to your devices. They see the device token and the notification text, nothing else.
• Wheel-Size and the US NHTSA vehicle database — decode the VIN or plate you look up into year, make, model and tire sizes.
• Google (Gmail, Calendar, Business Profile) and Intuit (QuickBooks Online) — the source systems you connect; we read from and, where you direct us to, write to their APIs under the OAuth permissions you grant.

What we never do

• We do not sell your data to anyone.
• We do not use your data to train AI models — yours or anyone else's.
• We do not share your data beyond the named processors above, and only for the purpose of running the service.

Retention

We keep your workspace data — receipts, conversations, and connected-account data — for as long as your account is active. Account deletion removes active workspace records and files. Encrypted recovery backups may retain earlier copies until they expire under the backup retention schedule; they are restricted to recovery and security purposes, and deleted accounts must not be reactivated from them. Usage metering records are kept for billing and support purposes for the life of the account. If your subscription ends, access to your workspace is suspended, but your data is kept for at least 90 days so you can export it or come back; after that we may delete it permanently. Business phone numbers are held for 30 days after cancellation and then released.

Deletion

You can delete your account and all associated data two ways:

• In-app — Settings → Delete account.
• By email — write to [email protected] and ask us to delete your account.

Either verified path removes your active workspace, receipts, conversations, and connected-account tokens. Removal cannot be undone through the app. Recovery-backup retention is described above.

Full instructions, including what is deleted and what is kept: Delete your account.

Gmail and Google user data

Ledger AI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Contact

Questions about this policy or your data: [email protected].

Hey Ledger AI Corp. (Ledger AI) · 911 48 Ave SE, Calgary, Alberta T2G 2A7, Canada · Alberta corporate access number 2028509954.

Preventing repeated introductory-credit claims

For trial eligibility and fraud prevention, we keep keyed, non-reversible matching identifiers for verified account, email, sign-in-provider and phone identities, together with minimal credit-claim and spending records. These records are separate from your workspace and survive account deletion so the same introductory credit cannot be claimed again. We do not retain the verification code. Our phone-verification provider receives the phone number needed to deliver and check your code.

Limited, keyed network identifiers help rate-limit verification requests; they are not used for advertising or to identify your browsing elsewhere. We do not use device fingerprinting for this offer. Credit-eligibility records are retained while the introductory offer remains available and as necessary to prevent repeat redemption, resolve disputes and meet legal obligations; we review that need periodically. Transient verification records are retained for up to 30 days. Contact us to review an eligibility decision or exercise applicable privacy rights.