Privacy Policy

Qualaby LLC, a Florida limited liability company ("Qualaby," "we," "our," or "us"), operates the personal finance application at https://app.qualaby.com and the public website at https://www.qualaby.com. This Privacy Policy explains what information we collect on both, how we use and protect it, how long we keep it, and the choices you have. The short version: we collect what we need to keep your books and run the service, we do not sell your data or use it for advertising, we do not use it to train artificial-intelligence models, and the only people who can see your books are you, the people you choose to share them with, and our administrator when you ask for help.

Account and sign-in: your email address, your password (stored only as a one-way hash by our authentication provider, never in a readable form), and the secret for the authenticator app you set up as your second sign-in step, together with one-time recovery codes (also stored hashed). Every account signs in with an authenticator. Waitlist: your name, email address, and how you found us, if you join our waitlist. We use it only to tell you when Qualaby opens and to send the occasional update you asked for. Financial account data: when you choose to link a bank, card, loan or investment account, we receive through Plaid Inc. ("Plaid") the account names and types, balances, and transaction history, and we keep a daily record of each linked account's balance so that your reports can show history. We do not receive or store your bank username, password or one-time codes; those go to Plaid only (see section 5). Your books: the chart of accounts, transactions, journal entries, budgets, forecasts, loans, property values, retirement details and settings you enter, and the files you upload to bring data in (CSV and Excel statements, QuickBooks reports, chart-of-accounts and vendor templates). Qualaby also keeps an audit trail of changes to your books (what a record looked like before and after a change, and who made it), so that your history can be trusted. People you add: if you set up recap emails, the names and email addresses of the people you send them to; if you give an accountant access, the fact of that access and a record of when they used it. You are responsible for having those people's permission (section 10). Support: the messages and attachments you send through the Help & Support page or by email, and our replies. Billing: our payment processor, Stripe, collects your card details directly; we never see or store the card number. We store your Stripe customer id, your plan and your subscription status. Consent records: when you agree to a notice, such as the one shown before you connect a bank, we record the date, the version of the notice you saw, and your IP address and browser type. Technical and usage data: our hosting and database providers keep standard server logs (IP address, browser type, the pages or endpoints requested, timestamps). We keep logs of bank-connection events and errors (what Plaid reported, its request ids, the bank's name and an error code; never tokens, credentials or account details). Product analytics are described in section 4. We do not collect Social Security numbers or full bank account numbers.

We use your information to: • Keep your books: display your accounts, balances and transactions; categorize, analyze and report on them; sync new transactions from linked institutions; build your forecasts and statements. • Run your account: sign you in securely, bill you through Stripe, and answer your support requests. • Send email you asked for or that the service needs: sign-in and account-recovery messages, reminders when a bank connection needs attention, the recap emails you set up, replies to your support messages, and waitlist and launch news you signed up for. Every marketing-style email has an unsubscribe link; service messages about your account do not. • Understand and improve the product: see which pages are visited and which features are used, find errors, and learn which of our own pages bring people to Qualaby (section 4). • Protect Qualaby and its members: prevent abuse, investigate security problems, and meet legal obligations. We do not sell, rent or share your personal information for advertising. We do not show ads. We do not use your data to train artificial-intelligence models. We share information only with the service providers in section 9, which process it for us under contract, with the people you choose to give access to, and when the law requires it.

Public website analytics (Vercel). Our public pages at https://www.qualaby.com use Vercel Web Analytics, which counts page views without cookies and without identifying you. Product analytics (PostHog). We use PostHog, a product-analytics service, on our public website and inside the app, to see how people move through them: which pages are opened, which buttons and features are used, whether a visitor who arrived from a particular link later signed up, the type of browser and device, and a general location worked out from your IP address (city or region, not an exact location). PostHog sets a first-party cookie and browser storage on qualaby.com and app.qualaby.com, kept for up to one year, so that your visits can be told apart and a sign-up can be connected to how you found us. We configure PostHog to discard your IP address once the general location is worked out. What PostHog never receives: your account balances, transactions, amounts, account names, vendor names or anything else from your books; anything you type into a form; your password; and no recordings of your screen. Session recording is switched off. The events we send are named actions ("opened the Balance Sheet", "linked a bank") with no financial values attached. Your choices: if your browser sends the Global Privacy Control signal, we do not load PostHog at all. You can also block or delete cookies in your browser; the app keeps working without the analytics cookie. To ask us to remove the analytics data tied to your account, email us (section 13). Cookies and storage we set ourselves: • Sign-in cookies (set by our authentication provider, Supabase). Required; they keep you signed in and expire or are cleared when you sign out. • "qualaby_onboarding_dismissed". Remembers that you finished or skipped the setup wizard, for one year. • Your theme and a few display choices (such as how a dashboard tile is drawn) are saved on your account so they follow you between browsers. Your open tabs stay in browser storage on your device; never sent to us. • On checkout and billing pages, Stripe sets its own cookies for fraud prevention. In the bank-linking window, Plaid sets its own. Each is governed by that company's policy (section 9). We do not use advertising cookies, cross-site tracking or data brokers.

Qualaby uses Plaid to connect to your financial institutions. Before you connect your first bank, we show you a short notice of what we receive and how we use it, and we keep a record of your agreement (section 2). When you link an account, you interact directly with Plaid's secure Link interface. Qualaby receives and stores only the access token and account information returned by Plaid; your bank credentials are never seen or stored by Qualaby. You can disconnect any bank at any time in Linked Accounts, or at https://my.plaid.com. When you disconnect, or within 30 days after your access to Qualaby ends, we tell Plaid to close the connection and we delete the access token. Transactions already in your books stay in your books under section 7. Plaid's own privacy policy is available at https://plaid.com/legal/. By linking a financial account, you also agree to Plaid's End User Privacy Policy.

Your data is stored by Supabase, a cloud database platform that encrypts data at rest using AES-256 and in transit using TLS 1.2 or higher. Access to your data is enforced by row-level security policies in the database itself, so other Qualaby members cannot see your books. The people who can see them are you, anyone you choose to give access to (for example your accountant), and Qualaby's administrator, who looks at your data only when you ask for support. An accountant's access is recorded. Every account is protected by a second sign-in step with an authenticator app. Plaid access tokens are stored in our encrypted database and are used only to retrieve your account data on your behalf. Our application runs on Vercel. Our infrastructure providers hold independent security audits; what that does and does not mean about Qualaby itself is explained on our Security page.

We keep your data for as long as you have an active Qualaby account. If you cancel a paid subscription, we keep your books for 12 months. During that time you can subscribe again to get everything back, or ask us for an export of your records. After 12 months we move your books to an archive that is not available in the app, keep it for up to 7 years from the date your access ended so that you can still ask us for your records, and then delete it. If your free trial ends and you do not subscribe, we delete your data 90 days later. Bank connections made through Plaid are closed within 30 days after your access ends, and right away when you remove a bank in the app. Logs of bank-connection events are kept for up to 180 days and logs of connection errors for up to 90 days, then deleted. You can ask us at any time to delete your account and all associated data, and we will do so within 30 days of confirming your request. Copies held in our database backups are removed as the backups expire (about seven days). Our payment processor, Stripe, keeps its own billing records under its own policies. Analytics data in PostHog is kept in aggregate; data tied to your account is removed when your account is deleted. To make a request, contact us at the email address below.

You have the right to: • Access the personal data we hold about you. • Request correction of inaccurate data. • Request deletion of your data at any time. • Export your books from within the application (Excel and CSV). • Revoke Plaid's access to your financial institution in Linked Accounts, by contacting us, or at https://my.plaid.com. • Opt out of product analytics (section 4) and unsubscribe from non-essential email using the link in any such message. Qualaby is offered to people in the United States. Several states give their residents specific privacy rights; we honor the rights above for everyone, wherever they live, and we do not discriminate against anyone for exercising them. To exercise any of these rights, contact us at support@qualaby.com. We may ask you to confirm your identity first.

Qualaby uses the following companies to operate. Each receives only what it needs to do its job for us, and each has its own privacy policy governing its handling of data. • Supabase (database and authentication) — supabase.com/privacy • Vercel (hosting, deployment, and cookie-free page-view analytics on our public pages) — vercel.com/legal/privacy-policy • Plaid (financial data connectivity) — plaid.com/legal/ • Stripe (billing and payment processing) — stripe.com/privacy • Resend (sends our transactional email) — resend.com/legal/privacy-policy • PostHog (product analytics, configured as described in section 4) — posthog.com/privacy • Google Workspace (our support mailbox; a message you send to support@qualaby.com is received and stored there) — policies.google.com/privacy

If you send recap emails to someone, give an accountant access to your books, or let a member of your household use your sign-in, you are sharing your data with them by your own choice, and you are responsible for having their permission before entering their name and email address. Recap recipients can stop receiving email with the unsubscribe link in every recap; you can remove them, or an accountant's access, at any time in Settings.

Qualaby accounts are for adults. Qualaby is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page, and if a change materially affects how we use your information we will also email the address on your account. Continued use of Qualaby after changes constitutes acceptance of the updated policy.

For any privacy-related questions, requests, or concerns, contact us at: support@qualaby.com Qualaby LLC, 7901 4th St N, Ste 300, St. Petersburg, FL 33702