Oikos Books — Privacy Policy

Effective date: July 5, 2026

Last updated: July 5, 2026

Contact: [email protected] · Oikos United LLC, Commonwealth of Virginia, USA (mailing address available on request)

Plain-language summary (not a substitute for the full policy)

• Oikos Books is your accounting software. Your books are your financial data. We treat them as confidential.
• Desktop version: your books stay on your own device. We don't receive them.
• Cloud version ($45/mo): your books are stored as an encrypted snapshot so you can sync and share them. We only use your data to run the Service — we never sell it, and we never use your financial records to train AI models.
• We use a small set of trusted providers (for hosting, payments, bank connections, and the AI assistant). They're listed below.
• You can export or delete your data. We tell you how.

1. Who we are and what this policy covers

This Privacy Policy explains how Oikos United LLC ("Oikos," "we," "us") collects, uses, shares, and protects information when you use Oikos Books (the "Service") — including the free downloadable desktop application, the cloud subscription at app.oikosbooks.com, the pay-links service at pay.oikosbooks.com, the trial/demo, and the marketing site at oikosbooks.com.

Oikos Books is offered two ways, and how your data is handled depends on which you use:

• Desktop (own-it): The application and your books run entirely on your own computer. Your accounting data is stored locally on your device and is not transmitted to Oikos unless you separately opt into a cloud or online feature. If you never connect an online feature, we do not receive your financial records at all.
• Cloud (subscription): Your books are stored on our infrastructure (as described below) so you can access them across sessions, sync, invite your accountant, get paid online, and use bank feeds and the AI assistant.

This policy applies to both, and calls out where they differ.

2. Information we collect

2a. Information you provide

• Account information (cloud): name, email address, password (stored only as a secure hash), and organization/business name.
• Billing information (cloud): your subscription plan and billing status. Card/payment details are collected and stored by Stripe, our payment processor — we do not receive or store your full card number.
• Your books / financial data: everything you enter or import — chart of accounts, journal entries, invoices, bills, customers, vendors, contacts, transactions, tax settings, budgets, attachments/receipts, and notes. On cloud, this is stored as an encrypted database snapshot associated with your account. On desktop, it stays on your device.
• Support communications: anything you send us when you contact support.

2b. Information collected automatically

• Authentication and usage data (cloud): sign-in events, session tokens, subscription-status checks, and basic technical logs (timestamps, IP address, error logs) needed to operate and secure the Service.
• Device/technical data: browser or app version and operating system, for compatibility and troubleshooting.
• We keep analytics and tracking minimal: as of the effective date we run no third-party product-analytics or advertising trackers. If an analytics or error-reporting tool is ever added, it will be listed here as a sub-processor first.

2c. Information from connected services (only if you opt in)

• Bank and financial-account data via Plaid: if you connect a bank or credit-card account, Plaid provides us with account and transaction information (account name and mask, balances, and transaction details) so Oikos Books can import and reconcile transactions. See §5 (Plaid) for Plaid's own disclosures and your rights.
• Payments you receive via Stripe Connect: if you use "get paid online," Stripe processes your customers' payments and reports payment status to us so we can mark your invoices paid. See §4 and §6.

2d. What we do NOT collect

• We do not collect the full card numbers of you or your customers (Stripe handles those).
• We do not use your financial records to train, fine-tune, or improve AI models. See §7.
• We do not knowingly collect information from children under 13. The Service is a business product not directed to children.

3. How we use information

We use information only to provide and operate the Service:

• To create and secure your account and authenticate you (cloud).
• To store, sync, and let you share your books (cloud).
• To process your subscription and manage billing (via Stripe).
• To import and reconcile bank transactions when you connect an account (via Plaid).
• To let you get paid online and mark invoices paid (via Stripe Connect).
• To answer your questions through the Oikos AI assistant (see §7).
• To provide support, fix bugs, prevent fraud and abuse, and keep the Service secure.
• To comply with law and enforce our Terms.

We do not sell your personal information or your financial data, and we do not share it for cross-context behavioral advertising. We do not use your books for advertising of any kind.

Legal bases (for users in the EU/UK, where applicable): performance of our contract with you (operating the Service), our legitimate interests (security, fraud prevention, improving reliability), your consent (optional connections like Plaid and AI), and compliance with legal obligations.

4. How we share information — service providers (sub-processors)

We share information only with providers that help us run the Service, each bound to protect it and use it only to perform services for us. Our current sub-processors:

Notes:

• Email: when you send an invoice, statement, or payment reminder from the app, it is delivered by our email provider (Resend); we share only the recipient address and the message being sent. You can always download the document and send it yourself instead.
• We may also share information (a) to comply with law, legal process, or lawful requests; (b) to protect the rights, safety, and property of Oikos, our users, or the public; and (c) in connection with a merger, acquisition, or sale of assets, in which case we will notify you and any successor will be bound by this policy.
• A current sub-processor list is maintained and, for business customers, a Data Processing Addendum is available on request.

5. Plaid — bank connections (required disclosures)

If you choose to connect a financial account, we use Plaid Inc. ("Plaid") to do so securely. When you connect an account:

• You may be asked to enter your bank credentials directly into Plaid's interface. Oikos Books does not see or store your bank login credentials — Plaid handles that connection.
• Plaid collects and processes your financial-account information (such as account and routing identifiers in masked form, balances, and transactions) in accordance with Plaid's own privacy policy, available at https://plaid.com/legal/#end-user-privacy-policy. By connecting an account, you also agree to Plaid's end-user policy.
• Plaid acts both as our service provider (delivering account data to Oikos Books) and, for its own connection service, as an independent controller of the data you provide to it. Your rights regarding data held by Plaid — including access and deletion — can be exercised through Plaid using the tools Plaid provides (see Plaid's privacy policy and https://my.plaid.com).
• You can disconnect a linked account at any time in Oikos Books. Disconnecting stops future imports; transactions already imported into your books remain in your books until you delete them.
• Financial-data (GLBA) note: bank and financial-account information is sensitive. We treat it as confidential, use it only to provide the Service, and do not sell it. Where the Gramm-Leach-Bliley Act (GLBA) or similar financial-privacy rules apply to this data, we handle it consistent with those obligations.

6. Stripe — billing and getting paid online

• Subscription billing (cloud $45/mo): Stripe processes your subscription payments. Stripe collects and stores your payment-card details under Stripe's own privacy policy (https://stripe.com/privacy). We receive only your subscription and billing status, not your full card number.
• Get paid online (Stripe Connect): If you enable payments, you create a Stripe Connect account and agree to Stripe's Connected Account Agreement. Payments from your customers are processed by Stripe and settle directly to you — you are the merchant of record for your customers' payments. Oikos does not take custody of those funds and charges no platform fee. We receive payment status so we can mark your invoices paid. Your customers' card data is handled by Stripe, not Oikos. See the Terms of Service.
• PCI DSS: card data is collected and stored only by Stripe (a PCI Level 1 provider). The Service is designed so that Oikos does not receive, process, or store full card numbers (SAQ-A posture).

7. Oikos AI — how the assistant uses your data

The Oikos AI assistant is powered by Anthropic's Claude API. It is designed to protect your ledger:

• When you ask a question, Oikos AI first classifies it as a "how-to" question (answered from our help content) or a "data" question about your books.
• For data questions, the assistant generates a read-only database query that runs in your browser/app against your own books — the query executes locally, and, as the feature is currently designed, your raw financial records are not sent to the AI provider. What is sent to Anthropic is your question, the database schema (table/column structure, not the row data), and relevant help content. If we ever change this design so that additional data is sent to the AI provider, we will update this policy before doing so.
• We do not use your data — financial or personal — to train AI models. Anthropic processes API inputs as our service provider under its commercial API terms; per those terms as of the effective date of this policy, Anthropic does not use API inputs or outputs to train its models. This describes Anthropic's stated practice under its terms, not a warranty by Oikos; Anthropic's terms govern its own processing.
• AI answers can be wrong and are not professional advice. Always verify. See the Disclaimers page and Terms of Service.
• Oikos AI is an optional feature: it runs only when you use an AI action (asking a question, snapping a receipt, quick entry, or requesting categorization). Don't use those features and no data is sent to the AI provider.

8. Data retention

• Desktop: your books are retained on your device for as long as you keep them; deletion is under your control (delete the file/app data). We have no copy.
• Cloud: we retain your account and books snapshot while your account is active. Retention differs by data type:
• Account/profile data: deleted within 30 days of account deletion.
• Your books / financial records: because financial and tax records often must be kept for multiple years, if you delete your account we retain your books snapshot for the shorter of the period you instruct and any applicable legal or tax retention period and then delete or de-identify it. You can (and should) export your books before deleting your account — after deletion we may not be able to recover them.
• Billing records: retained as required for tax/accounting/audit (typically several years).
• Backups: we retain a rolling window of recent snapshot versions (currently your last 15 saves) plus provider-level backups purged on the provider's standard cycle.

• You can export your books at any time (see §9).

9. Your rights and choices

Regardless of where you live, you can:

• Access and export your books at any time from within Oikos Books (export to file). On desktop you already hold the file.
• Correct your information by editing it in the app or contacting us.
• Delete your account and cloud data by emailing [email protected] from your account email; we action deletion requests within 30 days. See §8 for retention exceptions.
• Disconnect Plaid bank connections and turn off optional features at any time.

EU/UK (GDPR) users additionally have rights to access, rectification, erasure, restriction, portability, and objection, and may withdraw consent for optional processing and lodge a complaint with a supervisory authority. California (CCPA/CPRA) users have rights to know, access, delete, correct, and to opt out of "sale" or "sharing" — we do not sell or share personal information as those terms are defined — and the right not to be discriminated against for exercising these rights. To exercise any right, contact [email protected]; we may need to verify your identity. For business-customer (controller/processor) terms, a Data Processing Addendum is available on request.

10. Security

• We use technical and organizational measures designed to protect your data: TLS in transit; storage on our providers' infrastructure (Supabase/Render/Cloudflare) with access controls; secure password hashing (never plain text); and least-privilege access to production systems.
• No method of transmission or storage is 100% secure, and we do not guarantee absolute security. Statements in this policy describe our intended design and are subject to ongoing verification and improvement; they are not a warranty that any particular safeguard is in place at a given moment. Specifics we can state today: connections use TLS in transit; cloud snapshots are stored on managed infrastructure with provider-level encryption at rest; bank-connection tokens are additionally encrypted at the application layer before storage; database access is role-restricted with row-level tenant isolation.
• If a breach affecting your personal data occurs, we will notify affected users and authorities as required by applicable law.

11. International data transfers

The Service is operated from the United States and your information is processed there. If you access the Service from outside the US, you consent to processing in the US. For EU/UK personal data, transfers rely on appropriate safeguards where required. All production infrastructure is currently hosted in the United States, and the Service is offered in the United States only.

12. Children's privacy

Oikos Books is a business product intended for adults. It is not directed to children and we do not knowingly collect personal information from anyone under 13 (or the minimum age in your jurisdiction). If you believe a child has provided us information, contact us and we will delete it.

13. Changes to this policy

We may update this policy. If we make material changes, we will notify you (for cloud users, by email or in-app notice) and update the "Last updated" date. Continued use after the effective date means you accept the updated policy.

14. Contact us

Oikos United LLC

Commonwealth of Virginia, USA (mailing address available on request)

Privacy: [email protected]

General: [email protected]