What this site keeps, and what it does not.

Who runs this.

Ledgerfoot is a service of NexusMKTG.com, LLC, in Boston, Massachusetts. Questions about this page go to Brett Wharton, Founder, at brett@nexusmktg.com.

What is collected.

Your email address, to sign you in and to send the emails this page lists. The PDF statements you upload. The rows, balances, checks, exceptions, categories, and rules extracted and made from them. The names you give workspaces, which are usually your clients' names. Payment records from Stripe: the amount, the date, and a Stripe customer id, never a card number. Your referral code and the count and value of purchases made through it; a referrer never sees who bought. Server logs with request paths and timing, kept for three days by Cloudflare.

Ledgerfoot does not use advertising trackers. It uses Cloudflare Web Analytics, which does not use cookies and does not identify you.

What is sent to a model provider.

To read a statement, the text of its pages, or, for a scan, the pages themselves, is sent to Anthropic's API. The call asks for rows in a fixed shape and nothing else. To suggest categories, the transaction descriptions and the workspace's category list are sent to Anthropic's API as well. Anthropic's API terms govern that call. A page that could not be read may be sent to OpenAI's API when we have the fallback on; the batch page says when it was used. OpenAI's terms govern that call.

We train nothing on your statements and sell nothing about you to anyone. Each provider's published terms for its API, as of the date at the top of this page, state that data sent through the API is not used to train its models, and we rely on those terms. If a provider changes that, we will change providers or update this page.

How long data is kept.

Uploaded PDFs are deleted after 30 days by default. Pro accounts can set 7 to 90 days or keep them until deleted. The extracted rows, checks, exceptions, and rules stay while your account exists. The files made for a finished batch stay with the batch, and their download links expire after 30 days; fresh links are always on the workspace page. Sign-in codes expire after ten minutes and sessions after ninety days. Payment records are kept as long as tax and accounting law requires.

Where it is stored, and how it is protected.

Files are stored on Cloudflare R2 and the database on Cloudflare D1, both operated by Cloudflare, Inc. in the United States. Both encrypt data at rest, and every connection to the site is encrypted in transit. Access is limited to what running the service needs. Email is sent through Resend. Payments are handled by Stripe. Model calls go to Anthropic, and to OpenAI only as the section above says. Email you send us is read in Google Workspace. We share data with no other party. If we learn that your data was accessed without authority, we email you without undue delay and in any case within 72 hours of confirming it. If you use the service from outside the United States, your data comes to the United States.

Deleting and changing.

You can delete any workspace, and with it every file and row in it, from the workspace page. You can delete your account, and with it everything above except payment records, from the account page; Stripe keeps its own record under its privacy policy. You can change the retention period on Pro. You can ask for a copy of what is held about you by email.

Cookies.

One cookie signs you in, and a second, which holds no id, tells the site's pages that you are signed in. One keeps a statement you drop on the home page with your browser for 24 hours, until you sign in. One remembers a referral link for 60 days. There are no others. The app also keeps a few small notes in your browser's own storage, so a page can pick up where you left off.

Children.

The service is for people doing bookkeeping work and is not for anyone under 18. We do not knowingly collect data from children, and we delete it if we learn we have.

Independence.

Ledgerfoot is independent and not affiliated with Intuit, QuickBooks, Xero, or any bank. Their names appear only to say which file format or which bank's statement is supported.

Changes.

When this page changes, the date at the top changes, and the change is noted at the top of this page.