Privacy Policy

1. Who we are and what this covers

This Privacy Policy describes how Clef Technologies Inc. (“Clef,” “we,” “us,” or “our”), a Delaware corporation located at 8 The Green, STE B, Dover, DE 19901, handles information in connection with clefpro.com and the services offered there (together, the “Service”). The Service keeps the books for small businesses, using what you send us and, if you connect them, data from your bank accounts and your accounting software. It records income and expenses, sorts transactions, keeps QuickBooks up to date, prepares invoices and reminders, and, if you use it, follows up on overdue invoices. You use the Service mostly by text message, email, and phone. Our business-for-sale marketplace at tryclef.com has its own Privacy Policy.

We decide how the information we receive through the Service is used, and we are responsible for it. When you connect QuickBooks or a bank through Plaid, we act as an independent controller of the data we receive. We do not process it on behalf of Intuit or Plaid. When we contact your customers for you, we do so on your instructions and for your benefit.

2. Information we collect

From you

• Contact and identity. The phone number or Apple ID email address you message us from, your first name, your business name, its time zone, and its country and province or state. If you use our web app, the name and email address our sign-in provider gives us.
• What you send us. Text messages, photos, files, and voice messages, and emails you send to the private address we give your business. These include receipts, bills, bank and credit card statements, past years’ books, and sales reports. For emails, we keep the sender, subject, and attachments; we do not read the body. Voice messages are transcribed, and we keep the transcript, not the audio.
• About your business. What you tell us so we can keep your books correctly, such as what the business does, how customers pay, sales tax registration, employees and payroll service, vehicles, equipment, loans, your accountant, the accounts you use, and instructions about how you want things recorded.
• Calls with you. When you ask for a call, the number we call, the words you used to ask for or agree to it, the time and length of the call, a transcript, and a summary.
• Plan and billing. If you subscribe, you pay on Stripe’s page. We receive your plan, its status and renewal date, and your Stripe customer and subscription IDs. We never receive your card number.
• Communications. What you send us when you contact our team.

From your bank, through Plaid, when you connect it

Connecting a bank is optional. You sign in to your bank on Plaid’s page, and we never see your bank username or password. Bank connections are read-only: we cannot move money, make payments, or change anything at your bank. Through Plaid we receive:

• Accounts: account names, types, currency, and the last digits of each account number. Plaid may also send balances; we do not keep them.
• Transactions: up to the last 24 months when you connect, then new transactions as they post, with each one’s date, amount, description, merchant, and Plaid’s category.
• Connection details: the access token Plaid issues to us, which we store encrypted, and your bank’s name.

Plaid handles your information under its own End User Privacy Policy, which you can review when you connect.

From QuickBooks, when you connect it

When you connect your QuickBooks Online company, you authorize us to read and write the following. We keep a copy of what we read so the Service can work.

• We read: your company name, country, home currency, and sales tax settings; your chart of accounts; purchases, deposits, transfers, payments, and other transactions in your bank and credit card accounts from the last 24 months, including payee names, descriptions, and private notes; tax codes and rates; vendors, customers, and the products and services on your invoices; and your invoices and whether they are paid. When your books need it, we also read other records and reports in your QuickBooks, such as your profit and loss and balance sheet.
• We write: expenses and income you tell us about or that appear on statements you send, with the receipt or invoice attached; the vendors, customers, products and services, and bank or credit card accounts needed to record them; invoices, including ones you already sent; payments your customers made; and moves of transactions out of Uncategorized, Ask My Accountant, or another account we review into the account they belong in, without changing amounts. With your yes to the exact change, we also correct entries, such as adding a missing card payment or transfer, or fixing an amount. If you use collections, we add a short dated note to an overdue invoice after a call.
• We send: an invoice to your customer through QuickBooks’ own email, only after you tell us to.
• We void or delete an entry only after you say yes to it, such as an invoice or an expense recorded twice. QuickBooks keeps a voided invoice at zero, marked Voided.
• Connection details: your QuickBooks company ID and the access tokens Intuit issues to us, which we store encrypted.

If we add a feature that needs more of your QuickBooks or bank data, we will update this Policy and tell you what it reads before we read it.

From calls we make to your customers

If you use collections and we call one of your customers on your behalf, we collect the number called, the time of the call, a transcript, a summary, and the outcome, including anything your customer tells us, such as a date they will pay, a new email address for invoices, a dispute, or a request not to be called again.

From our website

If you use a form on clefpro.com, we receive what you enter: your name, email address or phone number, and your request. Our servers record technical information such as IP address, browser type, pages requested, and timestamps. We use cookies and similar browser storage to remember preferences such as your light or dark theme and to understand how visitors use our website: the pages they view, what they click, recordings of visits with typed fields hidden, and what they type into the request box, even if they do not send it. We do not use advertising cookies. The private pages we link you to, such as your books, plan, and data pages, use no cookies or analytics; they load fonts from a font service, which receives your IP address.

3. How we use information

• To keep your books. We read your messages, files, and transactions, sort them into the right accounts, match transfers and receipts, convert currencies, prepare monthly summaries and sales tax figures, and answer your questions about your books.
• To keep QuickBooks up to date, by writing to it as described in section 2.
• To help you get paid. We prepare and record invoices, remind you when one is due, and, if you use collections, follow up with your customers under your settings.
• To communicate with you by text message (iMessage, RCS, or SMS), email, and calls you ask for: answering you, asking about transactions only you can explain, checking in, and telling you about your plan and changes to the Service. Reply STOP to pause our texts.
• To bill you for your plan.
• To run and protect the Service. To operate, secure, and support the Service, limit spam and abuse, and fix problems.
• To meet legal obligations and enforce our Terms of Service.

Use of AI. Parts of the Service are performed by AI models from the providers listed in section 7: reading documents and messages, sorting transactions, and holding conversations by text and phone. AI can make mistakes. Tell us about anything that looks wrong and we will correct it.

4. How we handle QuickBooks and bank data

• We use QuickBooks data and bank data only to provide the Service to you, as described in this Policy.
• We never sell it, rent it, or use it for advertising.
• We never show one customer’s data to another customer.
• We do not use it to train AI models, and our AI providers are not permitted to train their models on it. Our service providers receive it only to provide the Service to you, as described in section 7.
• We do not use it to make credit, lending, insurance, or employment decisions about anyone, and we do not report anyone to credit bureaus.
• If we ever use information across customers, such as to understand how the Service performs, it is aggregated and de-identified so it cannot identify you, your business, or your customers.
• When you disconnect QuickBooks, by asking us in a text or from the Apps page in QuickBooks, we stop reading and writing your QuickBooks data right away. We delete the QuickBooks data we copied within 30 days unless you reconnect first. What you and we said about it in your messages stays in your conversation history until you delete it.
• When you disconnect a bank, from your data page or from Plaid, we stop receiving its transactions right away. Transactions already in your books stay there until you delete them.

5. Calls and the people we contact for you

Calls with you are recorded and transcribed so we can act on what you said. Where the law requires everyone’s consent to record, we say so at the start of the call.

If you tell us to send an invoice, QuickBooks emails it to your customer. If you use collections and Clef called you about an invoice, we were calling on behalf of the business that issued it, using contact details that business keeps in QuickBooks.

• We say which business we are calling for.
• Calls are recorded and transcribed so the business can see what was said. Where the law requires everyone’s consent to record, we say so at the start of the call.
• We call only between 8 a.m. and 9 p.m. in your local time, and only during the hours the business allows.
• To stop the calls, say so during a call, or email [email protected] with your phone number and the business’s name. We add your number to that business’s do-not-call list, and we will not call it again for that business.

6. Who can see your books

Anyone with access to your QuickBooks company, such as your accountant or staff, sees what we write there, including attached receipts and a note that an entry was recorded from what you told us. Your books, plan, and data pages open from private links without a sign-in, so anyone you share a link with can see that page. Ask us and we will replace your books link. Deleting your data requires a code we text to you.

7. How we share information

We do not sell personal information. We share it only as follows:

• Service providers that operate parts of the Service for us, under agreements that limit their use of the data to providing services to us:
  • Intuit, to connect to, read, and write your QuickBooks company and to email invoices.
  • Plaid, to connect your bank accounts.
  • Stripe, which processes payments for your plan.
  • AI model providers, which read your messages, files, and transactions, including QuickBooks and bank data, to keep your books.
  • Voice and phone providers, which provide the voice, the AI models that run on calls, the phone connection, and the transcription of voice messages. For a call with you, they receive your phone number and the details of your books needed for the call. If you use collections, for a call to your customer they receive your business name, your customer’s name and phone number, the open invoices with amounts and due dates, the billing email, recent contact history, and your callback number. They produce the call audio and transcript.
  • Messaging and email providers, which carry our text messages (iMessage, RCS, and SMS), receive the emails you send to your private address, and deliver messages from the forms on our website.
  • Hosting providers, which run our servers and database and store the files you send, in the United States, and host our website.
  • An analytics provider, which measures how visitors use our website, as described in section 2.
  • A team chat provider, which carries notifications to our team, such as your phone number and the start of your first message, or a message you asked us to pass on.
  • A sign-in provider, which handles sign-in to our web app.
  You can ask us at [email protected] for a current list of these providers.
• With your customers, when you tell us to send them an invoice and, if you use collections, on a call about their overdue invoices.
• Legal and safety. When we believe disclosure is required by law or legal process, or is needed to protect the rights, property, or safety of Clef, our users, or others.
• Business transfers. As part of a merger, acquisition, financing, or sale of assets, in which case the information stays subject to this Policy.
• With your consent or at your direction.

8. How long we keep information

• Your books and conversation (messages, the files you send and what we read from them, transactions, receipts, business details, and call transcripts): for as long as you use the Service, until you delete them. We keep the files you send so we can open them again when you or we need them, and we delete them when you delete your data.
• QuickBooks data: while your QuickBooks company is connected, and deleted within 30 days after you disconnect unless you reconnect first.
• Bank data: while you use the Service, including after you disconnect a bank, until you delete it.
• Copies our providers keep. Our messaging, email, payment, phone, team chat, and AI providers keep their own copies under their retention policies. When you delete your data, we delete the call records our voice provider keeps for us; for the rest, ask us and we will request deletion where the provider allows it.
• Do-not-call requests: kept for as long as we operate the Service, so we keep honoring them.
• Technical logs are kept for a short period for security and troubleshooting. We do not write QuickBooks data, bank data, message content, or call content to them.

Deleted data can remain in encrypted backups for a limited time until those backups expire. We do not restore it or use it in the meantime.

9. Security

We encrypt data in transit with HTTPS and at rest. QuickBooks and Plaid access tokens are additionally encrypted with AES-256. Access to production systems is limited to people who need it to run the Service. No system is perfectly secure, so we cannot guarantee absolute security. If a security incident affects your information, we will notify you, Intuit where your QuickBooks data is involved, Plaid where your bank data is involved, and regulators, as the law and our agreements require.

10. Where we process information

Clef is based in the United States and stores and processes information in the United States. If you are in Canada, your information is transferred to and processed in the United States, where it may be accessible to courts and authorities under United States law.

11. Your choices and rights

• Pause our texts by replying STOP. Reply START to turn them back on.
• Disconnect a bank from your data page, or from Plaid.
• Disconnect QuickBooks by asking us in a text, or from the Apps page in QuickBooks.
• Download your books from your books page, as your plan allows.
• Delete your data. From your data page, with a code we text to you, delete everything at once: your conversation, books, connections, and call records. Or email [email protected].
• Access, correct, or get a copy of your personal information by emailing [email protected].

California residents may request the categories and specific pieces of personal information we have collected, the purposes, and the categories of third parties we share it with, and may request correction or deletion. We do not sell or share personal information for cross-context behavioral advertising, and we will not discriminate against you for exercising these rights. Residents of other states with privacy laws have similar rights, which you can use the same way.

Residents of Canada may access and correct their personal information and withdraw consent to its use, subject to legal and contractual limits, by emailing [email protected]. You may also contact the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.

We may need to verify your identity before acting on a request.

If your information came to us from a business that uses Clef, such as when we called you or your name appears in its books or invoices, we may refer your request to that business and help it respond.

12. Children

The Service is for businesses and people at least 18 years old. We do not knowingly collect information from children.

13. Changes to this Policy

We may update this Policy. If we make material changes, we will update the date above and tell you by text or email before the changes take effect.

14. Contact

Questions or requests: [email protected], or Clef Technologies Inc., 8 The Green, STE B, Dover, DE 19901.