Privacy Policy

Last updated: 30 October 2026

What we collect

• Account data: your email, hashed password (Argon2id), your first name if you choose to give one (optional; you can change or remove it on your Security page), the firm name and slug you choose, and the role of each teammate you invite.
• QuickBooks connection state: realm IDs of the QBO companies you connect, the encrypted OAuth refresh tokens needed to call QBO on your behalf, and the most recent token-refresh timestamp.
• Xero connection state: the ids and names of the Xero organisations you connect, the encrypted OAuth refresh token, and the Xero user id and email address of the person who approved the connection. See Xero.
• Bank feed data: for firms that connect a bank through Plaid, the bank's transactions and the names and last four digits of its accounts. See Bank feed (Plaid).
• Usage data: per-tool-call records (firm, realm, tool name, success/failure, duration, error code, timestamp) for billing, debugging, and abuse detection.
• Product analytics: a tool_call event per tool call, sent to PostHog. It carries your firm ID, the QBO realm ID, the tool name, success/failure, duration, and error code. It isnot tied to you as an individual, and it does not carry your QBO records, report contents, or message text. See Product analytics below.
• Report runs: when you save a report, we store its output — the text your AI assistant produced for that company — along with the report type, company, and timestamps, so you can read it again from the dashboard. Deleting the company or your firm deletes these too.
• Generated PDFs (temporary): when you generate a report PDF, the file is held on our server only long enough for you to download it — up to 24 hours — and is then deleted automatically. We don't keep a copy or use it for anything else.
• Billing: we don't store your card. Stripe does. We store the Stripe customer ID and subscription status that Stripe sends us via webhook.
• Server logs: request metadata (IP, user agent, timestamps, structured event names) shipped to Better Stack.

What we don't do

• We don't sell your data.
• We don't train AI models on your QBO data.
• We don't run advertising or cross-site tracking inside the product. Every page behind your login is free of ad networks and third-party trackers: no Google Analytics, no Meta pixel. We do use one privacy-focused product-analytics tool for our own product metrics — see Product analytics.
• One exception, and it is on the public pages only: our sign-up, legal, status and help pages carry the LinkedIn Insight Tag, so we can see which LinkedIn ads lead to a sign-up. Our sign-in, password-reset and email-verification pages do not: those URLs and forms carry credentials. See Advertising.

Advertising

We advertise NumbersGame on LinkedIn, and our public pages carry the LinkedIn Insight Tag so we can tell which of those ads led to a sign-up. It sets LinkedIn cookies, and reports the public page you are on to LinkedIn, which may use that for ad measurement and for targeting on its own platform under LinkedIn's privacy policy.

• Where it runs: the public pages only — /signup, /login, password reset and email verification, /legal/*, /guide, /quick-start, /status and /support.
• Where it does not run: anywhere behind your login. The dashboard, your companies, your reports and the admin pages don't load it, so it never sees your firm, your client companies, or anything from QuickBooks.
• Turning it off: LinkedIn members can switch off ad tracking in LinkedIn's own advertising settings. Any tracker-blocking extension or browser also blocks it, and nothing in NumbersGame depends on it — block it and the product works exactly the same.

Product analytics

We use PostHog to understand which features are used and where they fail. PostHog is hosted in the European Union (eu.i.posthog.com), so this data does not leave the EU.

• From the AI connector: one tool_call event per tool call, containing the tool name, whether it succeeded, how long it took, a normalized error code, the QBO realm ID, and your firm ID as the identifier.
• From this web dashboard: page views (which page, when) and session replays — see below. Autocapture is deliberately off, because it would record the text of whatever you click, and on this dashboard that is client financial data.
• Onboarding progress: when you sign up, we record where you are in setting up your account: that you signed up, confirmed your email, and completed each setup step (created your firm, chose a plan, connected a company, made your first AI call), with the time of each. For the reminder emails this leads to, we also record whether each one was delivered, bounced, marked as spam, opened or clicked (not which link, and not from where). These events use your user ID, so we can remind you if you stop part way. They carry no email address and nothing else about you.
• What we don't send: your QBO data, report contents, file contents, message text, email addresses, names, or passwords. Apart from the onboarding progress above, analytics are recorded at the firm level only, so they are not tied to an individual teammate.
• Why: product improvement, reliability monitoring, and diagnosing errors — not advertising or resale.

We deliberately do not send a per-user identifier from either surface — the dashboard and the AI connector both report against your firm. Because PostHog retains events for 7 years, we keep them tenant-level so no individual's activity is tracked over that period. The onboarding progress events are the one exception. They record only a few milestones from your first days, and we delete them from PostHog when your account is deleted.

Session replay

We record replays of dashboard sessions to diagnose bugs and confusing screens, with strict masking on: every input and all on-screen text is masked before the recording leaves your browser. A replay shows the shape of a page and where you clicked — never account balances, customer names, amounts, or anything else you can read on screen. Replays are attributed to your firm, not to you individually, and PostHog deletes them after 3 months. Replay does not run on your QuickBooks data itself, only on this dashboard.

Where data lives

Application data sits in a Postgres database hosted on Oracle Cloud (Amsterdam region). Nightly backups go to Cloudflare R2 for off-cloud durability. Stored connection tokens (QuickBooks, Xero, Plaid, Ramp, Stripe, Square, Shopify and BILL) are encrypted with AES-256-GCM, with keys stored separately from the database. Server-to-AI calls go through Anthropic and OpenAI under their own privacy terms when you use their MCP clients with NumbersGame.

Who we share with

• Intuit (QuickBooks Online): when you authorize NumbersGame, Intuit issues OAuth tokens that let us call QBO on your behalf. Tool calls move between NumbersGame and Intuit as you direct them.
• Xero: when a firm connects a Xero organisation, Xero issues OAuth tokens that let us read and write that organisation's books on the firm's behalf. Tool calls move between NumbersGame and Xero as you direct them. See Xero.
• Plaid: when a firm connects a client's bank account through Plaid, Plaid retrieves that account's transactions for us, read-only. We send Plaid our own id for the person connecting, nothing else about them. See Bank feed (Plaid).
• Anthropic / OpenAI: when you connect NumbersGame to their AI clients, the requests you make and the data those requests return pass through them under their own privacy terms.
• PostHog (EU): product-analytics events as described above.
• Nimbia (Hyper Labs B.V.): our in-app guide and voice assistant, on the pages behind your login only, and never while our staff are signed in as you. It receives your user id, email, first name (if you gave one) and sign-up date, your firm's id and name, and the pages you open and what you click there. If you start a voice call, it also receives what you say and a recording of the page for the length of the call. For calls it uses LiveKit, and it sends its own error reports to Sentry, with an id but not your email.
• Ramp: when a firm connects a client's Ramp business, Ramp issues OAuth tokens that let us read that business on the firm's behalf, read-only. See Ramp integration.
• Stripe: for billing. Separately, when a firm connects a client's Stripe account, Stripe issues OAuth tokens that let us read that account, and act in it when a person confirms, on the firm's behalf. See Stripe connector.
• Square: when a firm connects a client's Square account, Square issues OAuth tokens that let us read that account, and act in it when a person confirms, on the firm's behalf. See Square connector.
• Shopify: when a firm connects a client's Shopify store, Shopify issues OAuth tokens that let us read that store on the firm's behalf, read-only. See Shopify.
• BILL (Bill.com): when a firm links a client's BILL organization, it gives us a sync token the client created in BILL, which lets us read that organization, and draft vendors and unpaid bills in it when a person confirms, on the firm's behalf. See BILL connector.
• Resend: for transactional email (verification, password reset, invites), and a few reminders while you finish signing up: to confirm your email, and to complete setup. Each setup reminder has a link that stops them.
• Better Stack: for log search and alerting.
• Cloudflare: R2 for backups and data exports.
• LinkedIn: visits to our public pages, via the Insight Tag described under Advertising. Never anything from behind your login.

We don't share with anyone else without your explicit consent except where compelled by law.

How long we keep things

• Account and QBO connection data: for as long as your firm exists. On deletion, see Your rights.
• Backups: nightly database backups in Cloudflare R2 are deleted automatically after 30 days by bucket lifecycle policy. Data you delete can therefore persist in backups for up to 8 weeks before ageing out. A copy we take on our server before a maintenance change is deleted after 7 days, and weekly snapshots of the server's disk at Oracle Cloud after 4 weeks.
• Generated report PDFs: deleted automatically 24 hours after they are generated, whether or not you downloaded them. Download links expire on the same schedule.
• Report runs: kept until you delete the company or your firm, or until the retention period set for that report type elapses, whichever comes first. Where no retention period is set, they are kept until you delete them.
• Payroll departments: kept until you change or remove an employee's department, or delete the company or your firm.
• Log archive: we also keep a rolling local copy of shipped logs on our own server for 90 days.
• Expired credentials: OAuth authorization codes are purged 7 days after expiry; access tokens, refresh tokens, sessions, and verification tokens 30 days after they expire or are revoked.
• Server logs: retained in Better Stack for 3 days, then deleted. Metrics derived from them are retained for 30 days. On our own server, request logs (IP address, user agent, URL) and application logs are deleted after 90 days.
• Product analytics: PostHog retains analytics events for 7 years on our plan, and session replays for 3 months. We don't send AI prompts or responses to PostHog. These events identify your firm, not individual users, except the onboarding progress events, which identify your user account and are deleted from PostHog when your account is deleted.
• Usage and audit records: per-tool-call usage records and audit-log entries are retained after firm deletion as business records — we need them for billing history, security investigations, and legal obligations. They identify the firm and tool activity, not your QBO record contents.

Ramp integration

A firm can connect a client's Ramp business so Claude can read it through the NumbersGame – Ramp connector. It is read-only and only for firms that have the Ramp integration enabled.

• What we can read: the Ramp data covered by the read-only permissions the client's Ramp admin approves on Ramp's own consent screen: bills, vendors, approvals, card transactions, reimbursements, receipts, statements, cashbacks, transfers, purchase orders and the goods received against them, departments, locations, users, entities and Ramp's accounting setup. We never create, approve, pay or change anything in Ramp.
• What we store: the Ramp business's id and name, the entity a company reads, the permissions granted, connection health, and the OAuth tokens, encrypted with AES-256-GCM using keys kept separately from the database. We do not store Ramp records. They are read when you ask, passed to the AI client you are using, and not kept by us. As for every tool, our logs record that a call happened (firm, company, tool, success, duration, error code), not its results.
• Personal data: employees' names appear in results where Ramp records them (a cardholder, an approver); their email addresses, phone numbers and bank details are never passed on.
• Removal: disconnecting the Ramp business in NumbersGame revokes our access at Ramp immediately and wipes the stored tokens; deleting your firm does the same. Deleting a company only unlinks it: the Ramp business stays connected to your firm, unlinked, until you link it to another company or disconnect it. Disconnecting the company pauses its Ramp link without ending it, and reconnecting the company resumes it. Removing Numbers Game's access inside Ramp also ends it, and the firm's owners are emailed so they know.

BILL connector

A firm can link a client's BILL (Bill.com) organization to that client's company, so Claude can read it through the NumbersGame – BILL connector and draft vendors and unpaid bills there for the client's own approval. Only for firms that have the BILL connector enabled.

• What we can read: what the client's BILL sync token can read: bills and their approval status, vendor payments, vendors, vendor credits, recurring bills, customer invoices, received payments, credit memos, BILL's coding lists, and the names of BILL users who approve. If the firm also adds a Spend & Expense API token: card transactions, reimbursements and budgets.
• What we can change, and only when a person confirms: create or edit a vendor (never its bank details or autopay), create or edit an unpaid bill, and attach a document to a bill. We never pay, approve, send or void anything in BILL.
• What we store: the BILL organization's id and name, connection health, and the sync token, BILL session and any Spend & Expense token, encrypted with AES-256-GCM using keys kept separately from the database. For each change a person confirms, we keep what they were shown and what BILL answered, as the record that it was confirmed. We do not store BILL records otherwise: they are read when you ask, passed to the AI client you are using, and not kept by us. As for every tool, our logs record that a call happened (firm, company, tool, success, duration, error code), not its results.
• Personal data: names appear in results where BILL records them (an approver, a cardholder, a vendor's contact email). Tax ids, bank details and card numbers are never passed on; for a tax id we say only whether one is on file.
• Removal: unlinking BILL in NumbersGame, or deleting the company or your firm, ends the link and overwrites the stored tokens. BILL has no way for us to cancel a sync token: the client deletes it in BILL (Settings → Sync & Integrations → Tokens) if it will not be used again.

Stripe connector

A firm can connect a client's own Stripe account to that client's company, so Claude can book the client's Stripe activity into their QuickBooks Online or Xero books. This is separate from how a firm pays NumbersGame, and only for firms that have the Stripe connector enabled.

• What we can read: the Stripe data covered by the permissions the client's Stripe administrator approves when installing the NumbersGame app: balance transactions, charges, disputes, invoices, credit notes, events, products, prices, subscriptions, customers, payment attempts, coupons and Revenue Recognition reports.
• What we can change: only when a person asks Claude to and confirms a preview of the change: customers, invoices (including marking one uncollectible or paid outside Stripe), subscriptions and payment records. A firm viewer, and any company the firm set read-only, cannot change anything in Stripe. NumbersGame never emails invoices to the client's customers.
• What we store: the Stripe account's id, whether it is live or test, the company it books into, the setup the firm chose (which accounts, which bank each payout goes to, the cadence and start date, which income account each Stripe product books to), the payer names learned from confirmed wire matches (a bank's payer text and the Stripe customer it belongs to, removable on the company's page), and the OAuth tokens, encrypted with AES-256-GCM using keys kept separately from the database. For each period and payout we book, we keep a record of what was booked (totals per line, and the Stripe ids, invoice numbers and amounts of items held back) so nothing is booked twice. We do not store Stripe customers' contact details. Stripe records are read when you ask, passed to the AI client you are using, and not kept by us.
• Removal: disconnecting in NumbersGame stops our use of the account and overwrites the stored tokens; the app stays installed in Stripe until it is removed there. Uninstalling the app in Stripe also disconnects it. Disconnecting the company stops our use of the account until the company is reconnected. Deleting the company deletes the connection and its tokens; deleting your firm overwrites the tokens at once. Stripe offers no way for us to uninstall the app, so in both cases it stays installed in Stripe until it is removed there. The record of what was booked is kept while the company is, because it is what stops a period being booked twice; deleting the company or your firm deletes it.

Xero

A firm can connect a client's Xero organisation so Claude can work in its books, as it can in QuickBooks Online. Only firms that have Xero enabled can connect one, and an owner or administrator must first agree to the Xero data-sharing terms, which name the AI provider that will receive Xero data.

• What we can read and change: the permissions the person signing in to Xero approves on Xero's own consent screen: organisation settings, contacts, invoices, payments, bank transactions, manual journals and attachments (read and write), and the balance sheet, profit and loss, trial balance, bank summary, 1099 and budget reports (read only). Changes are made only when a tool call asks for them, as you direct.
• Payroll (Xero UK Payroll only, read only): connections approved on or after 14 October 2026 also ask for read access to payroll employees, pay runs and payslips. Xero grants it only when the organisation runs Xero's UK payroll and the person approving is a Xero Payroll Administrator. We never change payroll. Australian and New Zealand payroll are not read.
• What we store: the organisation's id and name, the encrypted OAuth refresh token, and the Xero user id and email address of the person who approved the connection. We do not copy Xero records into our database; they are read when you ask and passed to the AI client you are using. The one exception is payroll departments: when you tell us which department an employee works in, we store the Xero payroll employee id, the employee's name and that department, so payroll cost can be grouped by department every month. Payslips and pay are not stored.
• Personal data (payroll): when you ask about payroll, employees' names, employee numbers, start and leaving dates, departments and pay (earnings, employer and employee National Insurance and tax, pension, benefits, deductions and net pay) are passed to the AI client you are using. Dates of birth, addresses, contact details, National Insurance numbers and bank details are never passed on. Owners and administrators of firms with a UK Xero organisation are asked in the portal to agree to payroll data being sent to Anthropic, and their answer is recorded.
• Removal: disconnecting the company in NumbersGame releases our connection to that organisation at Xero. When our Xero authorisation covered only that organisation, it is also revoked at Xero and the stored refresh token is overwritten; when it also covers other organisations your firm has connected, it stays for them until the last of them is disconnected. Deleting the company does the same, and deletes the stored token once no other organisation uses it; deleting your firm revokes at Xero any authorisation that still covers an organisation, and overwrites every stored Xero token. Removing NumbersGame inside Xero also ends our access; we check for that every night.

Bank feed (Plaid)

A firm can connect a client's US or Canadian bank or credit-card account through Plaid, so Claude can code and book its transactions into that client's QuickBooks Online or Xero books. Only firms that have the bank feed enabled can use it; an owner or administrator connects it after agreeing to the bank-feed terms, and the bank login is entered in Plaid's own window, never given to us. Firm viewers cannot see bank data.

• What we read: the connected accounts (name, type and the last four digits of the account number) and their transactions, up to two years back and then as new ones arrive. We never write anything to the bank or to Plaid.
• What we store: each transaction's date, amount, currency, the bank's description, the merchant and counterparty names Plaid provides, and its category; the account names and last four digits; the institution's name; and the Plaid access token, encrypted with AES-256-GCM. We do not store full account or routing numbers, balances, or your bank login. For each transaction booked into the ledger, we keep a record of what was booked and by whom, so nothing is booked twice.
• Booking: by default nothing is posted until a person approves it. A firm can choose to let matching rules or high-confidence suggestions post automatically; flagged transactions always wait for a person.
• Personal data: bank descriptions and counterparty names can name individuals (for example a transfer to a person), and account names can include the account holder's name.
• Removal: disconnecting a bank in NumbersGame removes the connection at Plaid and deletes its stored transactions; the record of what was booked, and the account-to-ledger mapping, are kept with the company. Disconnecting the company only pauses its banks: we stop reading and booking them, the connection at Plaid and the stored data are kept, and reconnecting the company resumes them. Deleting the company or your firm deletes all of it and removes the connection at Plaid.

Square connector

A firm can connect a client's Square account to that client's company, so Claude can book the client's Square sales and payouts into their QuickBooks Online or Xero books. Only firms that have the Square connector enabled can use it, and an owner or administrator connects it.

• What we can read: the Square data covered by the permissions approved on Square's own consent screen: the business profile, payments, orders, payouts, catalog items, bank accounts, gift cards, disputes, cash drawers, customers, invoices and subscriptions.
• What we can change: only when a person asks Claude to and confirms a preview of the change: customers, invoices (create or cancel) and subscriptions (create, change plan or cancel).
• What we store: the Square account's id and business name, which permissions were granted, the setup the firm chose (which accounts and classes each category books to), the OAuth tokens, encrypted with AES-256-GCM, and for each period and payout we book, a record of what was booked (journal lines per location and category, amounts and Square ids) so nothing is booked twice. We do not store Square customers, orders or payments; they are read when you ask and passed to the AI client you are using.
• Personal data: Square customers' names, email addresses and phone numbers appear in results where Square records them.
• Removal: disconnecting in NumbersGame revokes our access at Square and wipes the stored tokens; removing NumbersGame inside Square does the same. Disconnecting the company only pauses the Square connection: we stop using it, the tokens are kept, and reconnecting the company resumes it. The record of what was booked is kept while the company is; deleting the company or your firm revokes our access at Square and deletes the record and the stored tokens.

Shopify connector

A firm can connect a client's Shopify store to that client's company, so Claude can book the store's sales and payouts into the client's QuickBooks Online or Xero books on the firm's instruction. It is read-only: we never change anything in the store. Only firms that have the Shopify connector enabled can use it, and an owner or administrator connects it.

• What we read: the store's orders, refunds and order transactions (amounts, taxes, discounts, shipping and payment method), products, locations and Shopify Payments payouts.
• What we store: the store's myshopify domain and name, the permissions granted, and the OAuth tokens, encrypted with AES-256-GCM using keys kept separately from the database. We do not store the store's orders, refunds or payouts; they are read when you ask and passed to the AI client you are using. We do keep what your firm sets up and books: the revenue rules you save (which product types, vendors or products book to which account), and for each period or payout booked into your books, a record of what was booked (the totals per ledger line, and the order numbers of any orders held back, with the reason). None of it is customer personal data.
• Personal data: we do not read the store's customers' names, email addresses, phone numbers or addresses. When Shopify sends us a customer data request or a customer redaction request, we answer it: we hold no customer personal data.
• Removal: disconnecting the store in NumbersGame uninstalls the app from the store and wipes the stored tokens; uninstalling the app inside Shopify makes us drop the tokens at once. When Shopify then sends its shop redaction request, 48 hours after the uninstall, we erase the store's name, tokens, settings, revenue rules and booking records (the journals already in your books stay: they are your books). Disconnecting the company only pauses the Shopify connection: we stop using it, the tokens are kept, and reconnecting the company resumes it. Deleting the company or your firm uninstalls the app from the store and deletes the stored tokens.

Slack integration

When you connect Slack to NumbersGame (“NumbersGame AI agent”), we request only the access needed to post task updates and route them correctly.

• What we store: your workspace's bot token (encrypted at rest with AES-256-GCM), your workspace ID and name, the IDs and names of channels you assign to companies, a cached channel-canvas ID, and a mapping of your firm's members to their Slack user IDs (matched by email or manual self-link) so only authorized members can act on tasks.
• What we read: your channel list (so you can pick a channel) and Slack user email/identity (to match Slack users to NumbersGame members). We read a channel's canvas only to locate and update our own section. We do not read your channel messages, files, or direct messages.
• What we write: task messages and updates, and a “NumbersGame” section in the canvas of the channels you assign — nowhere else.
• What we never do: we don't post to channels you haven't assigned, and we don't sell or share your Slack data with third parties.
• Removal: disconnect Slack anytime from Settings (revokes our access and clears channel assignments); uninstalling the app from Slack revokes our bot token immediately.
• Bot permissions requested: chat:write, channels:read, groups:read, users:read, users:read.email, canvases:read, canvases:write.

Your rights

• Access / export: request a zip of your firm's data from the dashboard at any time.
• Deletion: delete your firm from the billing page. Soft-deleted immediately, hard-deleted 30 days later. You can also delete a single connected company from the dashboard. After hard deletion, copies may persist in backups for up to 8 weeks, and usage and audit records are retained as described in How long we keep things.
• Correction: email us if data we hold about you is wrong — we'll fix it.
• Objection: email us if you want your firm's product-analytics events excluded, and we'll suppress them.

Contact

Questions: privacy@numbersgame.xyz