Privacy Policy

MatchLedger(“Company,” “we,” “us,” or “our”) operates the MatchLedger web application at app.matchledger.ai (the “Service”) and the marketing website at matchledger.ai (the “Website”). This Privacy Policy explains how we collect, use, store, share, and protect your information when you use the Service and the Website.

By using the Service or the Website, you agree to the practices described in this Privacy Policy. This Privacy Policy is incorporated into our Terms of Service by reference.

If you do not agree with this Privacy Policy, do not use the Service or the Website.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• First and last name
• Email address
• Password (stored as a salted hash — we never store your password in plain text)
• Company or organization name
• Country and default currency preference

If you sign up using Google OAuth, we receive your name and email address from Google. We do not receive or store your Google password.

1.2 Financial Documents You Upload

When you use the Service, you may upload:

• Bank statements (PDF, CSV)
• Credit card statements (PDF, CSV)
• Ledger reports from accounting software (PDF, CSV)

These documents contain sensitive financial information including account numbers, transaction details, balances, and merchant names. We treat all uploaded documents as confidential.

1.3 Data Extracted from Your Documents

The Service uses artificial intelligence to extract structured data from your uploaded documents, including:

• Transaction dates, descriptions, and amounts
• Account numbers and card numbers (last 4 digits)
• Merchant and payee names
• Balance information

This extracted data is stored in our database to provide reconciliation and export features.

1.4 Reconciliation and Export Data

When you run reconciliation jobs, we generate and store:

• Match results between transactions and ledger entries
• Confidence scores and match reasons
• Export files (CSV, Excel) generated from your reconciliation results

1.5 Usage Information

We automatically collect:

• Features used and actions taken within the Service (e.g., reconciliation jobs created, exports generated)
• Subscription plan, usage counts (jobs and transactions per month)
• IP address, browser type, and device information when you access the Service
• Timestamps of account activity

1.6 Website Analytics

Our marketing website (matchledger.ai) uses Google Analytics to collect aggregated, anonymous usage data including pages visited, time on site, referral source, and general geographic region. See Section 7 (Cookies) for details.

The MatchLedger application (app.matchledger.ai) does not use Google Analytics or any third-party analytics tools.

2. How We Use Your Information

We use your information for the following purposes:

• Providing the Service— processing your uploaded documents, running AI extraction, performing reconciliation, and generating exports
• Account management— authenticating your identity, managing your subscription, and communicating with you about your account
• Service improvement— analyzing usage patterns to improve features, fix bugs, and optimize performance
• Security— detecting and preventing fraud, unauthorized access, and abuse
• Legal compliance— responding to legal requests and fulfilling our obligations under applicable law
• Communications— sending transactional emails (extraction complete, export ready, password reset) and, with your consent, product updates

3. How We Share Your Information

We share your information only with the following third-party service providers, solely for the purpose of operating the Service:

We do not share, sell, rent, or trade your personal information or financial documents with any other third parties. We do not share data with advertisers. We do not allow our service providers to use your data for their own purposes.

3.1 Legal Disclosures

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, or investigate fraud.

4. Data Storage and Security

4.1 Where Your Data is Stored

All Customer Data is stored on servers located in the United States.

• Uploaded files are stored on Linode Object Storage (US region)
• Extracted data and account information are stored in a PostgreSQL database hosted in the US
• Temporary processing data is stored in Redis (in-memory, US region)

4.2 Data Isolation

Each organization's data is isolated using PostgreSQL Row-Level Security. Users in one organization cannot access data belonging to another organization. This isolation is enforced at the database level.

4.3 Security Measures

We implement the following security measures to protect your data:

• All data transmitted between your browser and our servers is encrypted using TLS (HTTPS)
• Passwords are stored using bcrypt hashing with salt
• Authentication uses stateless JWT tokens with configurable expiration
• Database access is restricted by Row-Level Security policies per organization
• File storage uses per-organization path isolation with time-limited access URLs
• Administrative access requires separate credentials and is audit-logged

4.4 Breach Notification

In the event of a data breach that affects your personal information, we will notify affected users by email within 72 hours of becoming aware of the breach, consistent with applicable law.

5. Data Retention

We retain your data only as long as necessary to provide the Service:

After the retention period, data is permanently deleted from our servers, including from backups.

You may request earlier deletion of your data at any time by contacting us at support@matchledger.ai.

6. Your Rights

6.1 All Users

You have the right to:

• Accessyour data through the Service's built-in features (view uploaded documents, extracted data, reconciliation results)
• Exportyour data at any time using the Service's export features (CSV, Excel, Google Sheets, subject to your plan)
• Delete your data by requesting deletion at support@matchledger.ai — we will process deletion requests within 30 days
• Close your accountfrom your account settings — you will have 30 days to export your data before automatic deletion
• Correct your account information from your account settings

6.2 California Residents (CCPA Rights)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with the following additional rights:

• Right to Know— You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete— You may request that we delete your personal information, subject to certain exceptions (e.g., legal compliance, completing a transaction you requested).
• Right to Non-Discrimination— We will not discriminate against you for exercising any of your CCPA rights.
• Right to Opt-Out of Sale— We do not sell your personal information. No opt-out is necessary.

To exercise your CCPA rights, contact us at support@matchledger.ai. We will verify your identity before processing your request and respond within 45 days.

6.3 Do Not Track

Some browsers transmit “Do Not Track” (DNT) signals. The MatchLedger application does not track users across third-party websites and does not respond to DNT signals because no cross-site tracking occurs. Our marketing website uses Google Analytics, which may be affected by browser-level tracking prevention settings.

7. Cookies and Browser Storage

7.1 MatchLedger Application (app.matchledger.ai)

The MatchLedger application does not use cookies. Instead, we use browser localStorage to store:

This data is stored only in your browser and is cleared when you log out. No tracking cookies, advertising cookies, or third-party cookies are set by the application.

7.2 Marketing Website (matchledger.ai)

Our marketing website uses Google Analytics (GA4), which sets the following first-party cookies:

These cookies collect anonymous, aggregated data about how visitors use the website (pages viewed, time on site, referral source). No personal information or financial data is collected through these cookies.

You can opt out of Google Analytics by:

• Using the Google Analytics Opt-out Browser Add-on
• Adjusting your browser's cookie settings to block third-party cookies
• Using your browser's “Do Not Track” setting

8. Third-Party AI Processing

The Service uses Anthropic's Claude artificial intelligence to extract structured data from your uploaded financial documents. When you upload a document and extraction is triggered:

• The contents of your document are transmitted to Anthropic's API servers via encrypted HTTPS connection
• Anthropic processes the document and returns extracted structured data
• We do not control how Anthropic handles data transmitted through their API — Anthropic's use of this data is governed by their own Usage Policy and Privacy Policy

We encourage you to review Anthropic's policies. By using the Service, you acknowledge and consent to this data processing.

We send only the document content necessary for extraction. We do not send your account information, organization details, or data from other users to Anthropic.

9. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@matchledger.ai and we will delete that information.

10. International Users

The Service is designed for and directed to users in the United States. All data is stored and processed in the United States. By using the Service, you consent to the transfer and processing of your data in the United States.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will:

• Publish the revised Privacy Policy with a new effective date
• Notify you by email at least 30 days before material changes take effect
• Note the changes in an in-app notification

Your continued use of the Service after the updated Privacy Policy takes effect constitutes your acceptance of the changes. If you do not agree with the updated Privacy Policy, you may export your data and close your account.

12. Contact Us

If you have questions about this Privacy Policy, want to exercise your rights, or have concerns about how your data is handled, please contact us at:

MatchLedger
Email: support@matchledger.ai

For CCPA-specific requests, please include “CCPA Request” in the subject line.