Privacy Policy

This Privacy Policy explains how BillGuardRail (“BillGuardRail,” “we,” “us,” or “our”) collects, uses, shares, retains, and protects information when you use our website, applications, and related services (collectively, the “Service”).

By using the Service, you understand that we will process information as described in this Privacy Policy.

1. Information we collect

Account information

We collect information you provide when creating or using an account, including your email address and information needed to authenticate and administer your account.

QuickBooks Online connection information

When you connect a QuickBooks Online company, we collect information made available through the permissions you authorize. This may include:

• QuickBooks Online company metadata, such as company name and realm ID.
• Encrypted QuickBooks OAuth access and refresh credentials needed to maintain the authorized connection.
• Normalized bill information necessary to provide monitoring, change history, and exception detection. This may include bill identifiers, vendor information, bill amounts, bill dates, due dates, line-item information, bill status, and timestamps.
• Information about detected bill changes, possible duplicates, review actions, alert settings, vendor thresholds, and reconciliation activity.

Bookkeeper-plan users may connect multiple QuickBooks Online companies. Each connected company’s information is logically separated under the applicable BillGuardRail account.

Billing and support information

Payments are processed by Stripe. We receive subscription and billing-status information necessary to administer your plan, such as Stripe customer, subscription, price, invoice, payment-status, and cancellation information. We do not receive or store complete payment-card numbers.

We may collect information you provide in support requests, feedback, emails, or other communications with us.

Service, security, and log information

We may collect technical and operational information generated through use of the Service, such as authentication events, connection status, error information, device/browser information, IP-address-related security data, request logs, and service-performance information. We use this information to operate, secure, troubleshoot, and improve the Service.

2. Information we do not collect

BillGuardRail does not access, collect, or store full bank account numbers or ACH payment credentials through its QuickBooks Online monitoring connection. BillGuardRail does not initiate, approve, block, or make payments through QuickBooks Online.

3. How we use information

We use information to:

• Provide, operate, maintain, secure, and support the Service.
• Connect to authorized QuickBooks Online companies and monitor bill activity.
• Generate bill snapshots, change history, exceptions, review records, reconciliation results, and configured alert emails.
• Authenticate users, administer accounts, enforce plan limits, and manage subscriptions and billing.
• Respond to support requests and communicate about the Service, account, billing, security, or operational matters.
• Detect, investigate, and prevent fraud, abuse, security incidents, unauthorized access, and violations of our Terms of Service.
• Troubleshoot errors, maintain system integrity, and improve the Service, including through aggregated or de-identified information where practical.
• Comply with legal obligations, enforce our agreements, and protect the rights, safety, and property of BillGuardRail, our users, and others.

4. How we share information

We do not sell personal information or QuickBooks Online data.

We may share information with service providers that help us operate the Service, including providers of cloud hosting and databases (for example, Vercel and Neon), email delivery (MailerSend), payment processing (Stripe), authentication, security, and QuickBooks Online/Intuit connectivity. These providers may process information only as needed to provide services to us, subject to applicable agreements, their own terms, and applicable law.

Alert emails sent through MailerSend may include QuickBooks-derived bill and vendor fields needed for the alert (such as company name, bill identifiers, amounts, vendors, and change summaries). MailerSend is used as an email delivery processor, not as a general export or analytics destination for QuickBooks data. We do not currently send QuickBooks payloads to error-monitoring or analytics products.

We may also disclose information:

• When required by law, regulation, legal process, or a valid government request.
• To protect the security, rights, safety, or property of BillGuardRail, our users, or others.
• To investigate or address suspected fraud, abuse, security incidents, or violations of our Terms of Service.
• In connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business or assets, subject to applicable law.

5. QuickBooks Online credentials and security

We use QuickBooks Online OAuth credentials only to maintain the connections you authorize and provide the Service. Stored QuickBooks OAuth credentials are encrypted at rest using AES-256-GCM. We limit access to credential material to systems and personnel that need it to operate, secure, or support the Service.

We use reasonable administrative, technical, and organizational measures designed to protect information. No method of internet transmission, storage, or electronic processing is completely secure, and we cannot guarantee absolute security.

6. Data retention and deletion

Active monitoring

We retain bill snapshots, change history, exceptions, vendor-threshold settings, review records, and related monitoring information while the applicable QuickBooks Online company is actively monitored.

Disconnecting an individual company

If you disconnect an individual QuickBooks Online company while your BillGuardRail account remains active, we stop monitoring that company and revoke or delete its stored QuickBooks OAuth credentials. We delete or anonymize the disconnected company’s associated monitoring data, subject to applicable law, security and fraud-prevention needs, dispute-resolution needs, and residual copies in routine backups.

Subscription or trial ending

If your subscription or trial ends, BillGuardRail stops monitoring connected QuickBooks Online companies. This includes new synchronization, reconciliation, exception generation, and alert delivery.

After cancellation becomes effective, historical BillGuardRail data remains available in read-only form for 30 days. We then archive retained records for up to 180 additional days, revoke stored QuickBooks OAuth credentials, and delete or anonymize the data afterward, subject to applicable law, security and fraud-prevention needs, dispute-resolution needs, and residual copies in routine backups. Total retention after cancellation becomes effective is up to approximately 210 days.

Account deletion

If you delete your account, we stop monitoring and process account-associated data according to the same deletion and retention process described above unless a different period is required by law.

Backups and logs

Deleted or anonymized information may remain in encrypted routine backups for a limited period before those backups are overwritten under normal backup-retention processes. We do not restore deleted information from backups except when necessary for disaster recovery, security, or legal obligations.

Email-delivery and operational logs may be retained for a limited period for security, troubleshooting, deliverability, abuse-prevention, and service-operation purposes. Where practical, we remove or limit links between retained logs and deleted bill-event data.

7. Your choices and privacy requests

You may manage connected QuickBooks Online companies, alert settings, and subscription settings through the Service where those features are available. You may disconnect a QuickBooks Online company or delete your account through the Service where available.

Depending on where you live, you may have rights to request access to, correction of, or deletion of personal information we hold about you. To make a privacy request, email privacy@billguardrail.com. We may need to verify your identity and authority before responding.

If you use BillGuardRail on behalf of a client or another organization, requests concerning that organization’s QuickBooks Online data may need to be submitted or confirmed by an authorized account holder.

8. International processing

BillGuardRail is operated from the United States. Information may be processed in the United States and other locations where our service providers operate. Privacy laws in those locations may differ from the laws of your jurisdiction.

9. Children’s privacy

The Service is designed for business use and is not directed to children. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact us at privacy@billguardrail.com.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice through the Service, by email, or by updating the “Last updated” date above. Your continued use of the Service after the effective date of an updated policy is subject to the updated policy.

11. Contact

For privacy questions or requests, contact us at privacy@billguardrail.com.

© 2026 BillGuardRail. All rights reserved.