Privacy Policy

1. Summary-Only, Zero-PII Data Storage

Payout Ledger is built around a strict Summary-Only, Zero-PII data model. When reconciling a Payout from a connected payment gateway, Payout Ledger aggregates Settlement Transactions in memory into accounting category totals (Gross Sales, Refunds, Disputes, Other Adjustments, Stripe Fees, and Net Payout) and stores only the resulting aggregated Payout Summary and per-month category totals (Monthly Splits).

We never store individual Settlement Transaction rows, customer names, customer email addresses, billing or shipping addresses, cardholder details, or end-customer IP addresses.

2. Read-Only Gateway Connection Permissions

Gateway Connections in Payout Ledger operate strictly on read-only credentials:

• Restricted API Keys Only: We only accept Stripe Restricted API Keys (rk_live_* or rk_test_*). Full secret keys (sk_*) and publishable keys (pk_*) are rejected immediately.
• Minimum Read Scope: Upon connection, we verify read-only access to Payouts and Balance Transactions (plus optional read-only account profile metadata for your business display name and Accounting Timezone). Payout Ledger cannot create charges, issue refunds, initiate transfers, or modify your Stripe account.
• Encryption at Rest: Your Restricted API Key is encrypted at rest using AES-256-GCM before being stored.

3. In-Memory Journal Export Streaming

Journal Exports (Xero Manual Journal, QuickBooks Journal Entry, and Generic Journal CSVs) are generated on the fly in memory from your Payout Summary and Workspace Ledger Account mappings. We do not cache or store exported CSV files in external file storage.

4. User Account & Billing Information

To authenticate your Workspace, we store your account email address, an industry-standard salted password hash, and encrypted HTTP-only session cookies. For paid subscriptions, billing checkout and payment processing are handled by Lemon Squeezy; we store only your Workspace plan tier and subscription status.

5. Data Retention & Deletion

You may revoke a Gateway Connection's Restricted API Key at any time in your Stripe Dashboard or delete your Gateway Connection inside Payout Ledger. Deleting a Workspace permanently removes its encrypted credentials, Ledger Account mappings, and Payout Summaries.