Privacy Policy
How BuddyWorkflow collects, uses, protects, and shares your information — including financial data you connect through Plaid — and the choices you have over it.
1. Who We Are
BuddyWorkflow ("BuddyWorkflow," "we," "us," or "our") provides a cloud bookkeeping and small-business finance application that helps you track income, expenses, and cash flow, send invoices, and — with your consent — connect your financial accounts to import transactions. This Privacy Policy applies to our website and application (the "Service"). We are the data controller for the personal information described here.
2. Information We Collect
- Account information: your name, email address, and password (stored only as a salted hash), and workspace/business details you provide.
- Financial data via Plaid: when you connect an account, we receive account and transaction data (balances, transaction amounts, dates, descriptions, and account metadata) through Plaid. We never receive or store your bank login credentials — those are entered only inside Plaid Link.
- Data you enter: invoices, contacts, categories, notes, budgets, and any records you create or import (including CSV uploads).
- Billing information: subscription and payment details are processed by Stripe. We store limited billing metadata (plan, status, last four digits, billing email); full card numbers are handled by Stripe, not us.
- Usage & device data: log data such as IP address, browser type, and interactions with the Service, used for security and to operate the product.
3. How We Use Your Information
- To provide, maintain, and improve the Service — including importing and categorizing transactions, generating reports, and sending invoices.
- To authenticate you, secure your account (including multi-factor authentication), and prevent fraud and abuse.
- To process subscription billing through Stripe and provide customer support.
- To communicate service-related notices, and — only where permitted — product updates you can opt out of.
We do not sell your personal information, and we do not use your financial data for advertising.
4. How Plaid Is Used
We use Plaid Inc. ("Plaid") to connect your financial accounts. By connecting an account you authorize Plaid, through its own consent flow, to access account and transaction information and share it with us to power BuddyWorkflow. Your use of Plaid is governed by Plaid's own privacy policy. You can disconnect a linked account at any time, which stops further data retrieval and revokes the associated access token at Plaid.
5. How We Share Information
We share information only with service providers ("subprocessors") that help us operate the Service, under contracts that require appropriate safeguards. We may also disclose information where required by law, to protect our rights and users' safety, or in connection with a business transfer.
6. How We Protect Your Information
We encrypt data in transit (TLS 1.2+) and at rest (AES-256), isolate each workspace's data with database row-level security, enforce least-privilege access with multi-factor authentication on administrative systems, and never store bank credentials. Full details are in our Information Security Policy.
7. Data Retention
We retain your information for as long as your account is active and as needed to provide the Service. When you disconnect an account or delete your data, we delete your financial data — including balances, transactions, and Plaid access tokens — from production systems within 30 days, and purge it from encrypted backups on the normal backup-expiry cycle. Full details are in our Data Retention & Disposal Policy.
8. Your Rights & Choices
- Access & correction: view and update your account information at any time in the app.
- Disconnect: unlink any connected financial account, which stops further data retrieval through Plaid.
- Deletion: request deletion of your account and associated data by contacting us; we will honor verified requests as described in Section 7.
- Regional rights: depending on where you live (e.g., under GDPR or CCPA/CPRA), you may have additional rights to access, portability, restriction, or objection. Contact us to exercise them.
9. Consent
You accept our Terms of Service and this Privacy Policy at sign-up, and you explicitly authorize account connection through Plaid Link's consent screen before any financial data is retrieved. You may withdraw consent by disconnecting accounts or closing your account.
10. Children's Privacy
The Service is intended for business use by adults and is not directed to children under 16. We do not knowingly collect personal information from children.
11. Changes & Contact
We may update this Privacy Policy from time to time; material changes will be communicated through the Service or by email, and the effective date above will be revised. Questions or requests? Contact us at bryn@buddyworkflow.com.