Privacy Policy

Plain language

1. Scott Applications LLC, Waco, Texas, sells software. We are not a bank, not a payment processor, and not a CPA firm.
2. When you pay us for a plan, Scott Apps is the merchant. When your customer pays your invoice, you are the merchant. Their card charge is on your Stripe or PayPal account. We do not hold that money.
3. You own your books. Your clients' names, addresses, and tax identifiers are your data. We store them to run the software you asked for. We do not sell them.
4. Tax screens produce drafts for you or your CPA. We do not file returns, we do not e-file 1099s, and we do not give tax advice.
5. If you connect an AI assistant through a future integration, you are authorizing that assistant to read the scopes you approved. You can revoke that in Settings. We are not the model provider.

Who we are

The company is Scott Applications LLC, Waco, Texas. The service is the website at https://www.scottapps.com and the software on it, including Accounting Software. Job Applications, TalusPro, Truestock, and QuoteForge have their own screens. Job-board terms and job-applicant privacy stay on those pages. This policy covers Accounting Software and the account you use to sign in.

We do not offer the service outside the United States. We do not run a VAT program. We do not claim that European privacy rules govern this service. A California resident still has the rights that statute gives: to know, to delete, to correct, and to be told we do not sell personal information.

Your customers are not our clients

If you are a subscriber, the people on your invoices are your customers. You need your own basis for putting their information into the software. The customer portal is your page, with your name and your look. We do not become that person's accountant because a Pay button loaded.

What Accounting Software stores

Each company's books sit in that company's database. We store the following to run the product you asked for. We do not sell it. Staff who operate the service can see it when a support ticket or an incident requires that. Processors see only what their own connection needs.

• Account. Name, email, and a hashed password, so you can sign in. Kept while the account exists.
• Business profile. Name, address, phone, branding, portal address, and the document look. Kept while the company exists.
• Clients and contacts. Names, addresses, email, and phone, so documents and statements can be addressed. Kept while the company exists.
• Documents. Invoices, estimates, quotes, contracts, bills, credits, payments, and comments. Kept while the company exists.
• People who help. Employee name, email, a title, and permission grants. An invite link's token is stored only as a hash and expires in 72 hours. Kept while that person is on the company.
• Time, mileage, and expenses when you enter them. Kept with the books.
• Books. Journal entries, the chart of accounts, reconciliations, fixed assets, and OFX statement files you import. Kept with the books. We do not connect a live bank feed.
• Vendor W-9 fields, including a taxpayer identification number, when you save a W-9. Kept with the vendor. We do not file the form.
• Stripe and PayPal linkage. A connected-account id or merchant linkage. Not the seller's secret API key. Sellers do not paste keys. Not card numbers.
• ACH mandate records where ACH is used: the authorization text, a timestamp, and an IP address.
• AI calls. A log row with the company, the person, the task, an estimated cost, and whether the input was clipped. A receipt file is not saved as a bill unless you save it yourself. The log is kept for allowance and cost limits. We have not set a shorter clock.
• Support tickets. Name, email, product, and the message, so we can reply. Kept so we can answer the ticket.
• A future connected assistant. If that ships, we would store the token's name, scopes, created time, last use, and revocation. Not the raw token after it is shown once. That product is not on yet.

We also store usage data the server already sees: IP address, browser, and the page requested. That is for sign-in, abuse limits, and fixing errors. It is not sold.

Who else sees it

These are the companies we actually call. Counsel can replace this list when a vendor changes. We do not name a vendor we do not call.

• Stripe for software subscriptions, and for a subscriber's own connected account when they turn card payments on.
• PayPal for the same two flows, when the subscriber connects PayPal.
• The VPS host (the machine that runs the site) and MongoDB on that machine. The database is not a separate hosted database product.
• SMTP2GO to send mail. The From address is ours. Reply-To on a document email is the subscriber's business email.
• Cloudinary for files the subscriber uploads, such as a logo.
• Anthropic or xAI, when a model call is on. A document the person submitted may be sent to either one. We send that document, not the whole company.
• Our own error log on the server. We do not send errors to a separate error-tracking vendor.

How long it stays

Books, clients, invoices, and the company file stay while the account is open and the plan is paid. The retention clocks start the day the account closes. Books, clients, invoices, and the company file are kept 1 year after that, then deleted. Support mail is kept 1 year. Sign-in logs are kept 90 days. Receipt photos and an extractor draft are kept 30 days, or sooner if you never save the bill. A backup can still hold a deleted file until the next backup cycle. Invite tokens expire in 72 hours. The company-choice cookie lasts 30 days. A remembered sign-in lasts 30 days. Details are on the data retention policy.

Security

Pages are served over HTTPS. Some database fields are encrypted with the field-level encryption map on the collections that map covers. Each company's books are in their own database. Passwords and invite tokens are stored as hashes. This is not a promise that the service cannot be breached. We have not completed an independent security-audit report.

Cookies and similar storage

Sign-in uses a session cookie. It lasts 24 hours, or 30 days if you check Remember me. The sign-in handshake also sets short CSRF and callback cookies. An OAuth sign-in sets auth-flag for 5 minutes. Accounting Software sets invoicing-desk for 30 days after you choose the company you are opening. Those are required for the feature you asked for.

The cookie notice stores your choice in the browser under cookieConsent. That is local storage, not a cookie. Page measurements run only if you accept. They use a random id in session storage, the path, the referrer, and the IP address long enough to derive an approximate city. We do not use Google Analytics. If you have not chosen, or you decline, those measurements are not sent.

Pressing Accept, Decline, or Manage still saves one record of that choice: the choice itself, the IP address, an approximate city, and the device, operating system, and browser. That is how we can show what you chose. It is not a page-by-page history.

Children

The service is not directed at anyone under 18. We do not knowingly create accounts for children.

California requests

We do not sell personal information. To ask what we have, to correct it, or to delete it, email contact@scottapps.com or open a ticket at /support. Say know, correct, or delete. There is not a separate account page for this yet, and there is not a portal for every state. Support is email only, Monday through Friday, 7am to 7pm Central.

Changes

The signup record uses terms version tos-2026-09-25.

Contact

• By ticket: scottapps.com/support
• Scott Applications LLC, 212 Dallas St, Waco, TX 76704
• By email: contact@scottapps.com