1. Scope and privacy roles
This Privacy Policy explains how Aqqrue Inc. ("Aqqrue," "we," "us") collects, uses, discloses, and safeguards personal information when people visit aqqrue.com, contact us, register for demos or events, administer a firm account, or otherwise interact with Aqqrue in a business capacity.
For accounting records, client documents, prompts, and other information a firm submits to the Aqqrue application ("Customer Data"), Aqqrue ordinarily acts as a service provider or processor to the firm, or as a subprocessor where the firm acts for its own client. The firm determines why and how its client information is processed. Such data is handled under the agreement with that firm and the Data Processing Agreement. If you are an individual whose information appears in a firm's accounting records, please direct access, correction, or deletion requests first to that firm. For Aqqrue's own website visitors, prospects, and account and billing contacts, Aqqrue determines the relevant business purposes and is responsible for this Policy.
2. Information we collect
| Category | Examples |
|---|---|
| Contact and account | Name, business email, phone, company or firm, job title, user role, login identifiers, invitations, preferences. |
| Subscription and business operations | Subscribed plan, billing contact, transaction and payment status, support history, commercial correspondence. Payment-card data may be handled by an external payment provider rather than stored by Aqqrue. |
| Usage and technical | IP address, browser and device details, log events, session and product-usage information, diagnostics, cookies, page visits, referrals, and approximate location derived from network information. |
| Communications and marketing | Demo requests, event registrations, survey responses, email engagement, feedback, and messages to support. |
| Customer Data handled on firms' behalf | Client names and contacts, vendor and employee details, invoices, transaction records, bank-feed metadata, files, prompts, workpapers, and accounting outputs, as determined by the firm; governed primarily by the DPA. |
Aqqrue does not offer tax-return preparation or healthcare processing services. The Services are not intended for intentionally submitting Social Security Numbers, full payment-card credentials, protected health information, or other highly sensitive information unrelated to supported accounting workflows. Incidental inclusion in documents may nevertheless occur; Aqqrue cannot guarantee such data is never present.
3. Sources of information
We obtain personal information directly from you and authorized firm administrators; from integrations and third parties enabled by a firm (such as QuickBooks Online, Gmail, and Google Drive); from service providers supporting billing, communications, hosting, and analytics; and automatically from devices and browsers interacting with our website or application. Customer Data from connected systems is received at the firm's direction.
4. How we use information
- Provide and administer accounts, subscriptions, payments, authentication, support, onboarding, and service notifications.
- Deliver firm-authorized accounting workflows, AI inference, integrations, document handling, and exports on behalf of customers under the DPA.
- Detect fraud or misuse, investigate security issues, maintain logs, troubleshoot errors, and secure the platform.
- Measure product performance and usage, diagnose problems, and improve functionality using appropriately limited telemetry and aggregated or de-identified information.
- Respond to requests, manage commercial relationships, run webinars or events, and send business communications subject to applicable opt-out requirements.
- Comply with legal obligations, enforce agreements, and protect legal rights.
Where applicable law requires a legal basis, we rely as appropriate on performance of a contract, compliance with law, legitimate interests in operating and securing our business, and consent where required (for example, for certain cookies or marketing). We do not use customer financial documents or prompts to train Aqqrue or third-party foundation models.
6. AI processing
To fulfill firm-authorized accounting tasks, the application may transmit necessary portions of prompts, accounting documents, and relevant context to AI model providers. These providers process customer information solely to deliver Aqqrue's services. OpenAI and Anthropic operate under zero-data-retention arrangements for covered services and models. Google Gemini and Mistral AI are used through commercial APIs under applicable data protection terms, including restrictions on the use of customer data for model training. Aqqrue does not authorize its AI providers to use customer data to train their general-purpose AI models. Customer information is not used to train foundation models. The AI model providers we use are OpenAI, Anthropic, Google (Gemini API), and Mistral AI, each accessed through its commercial API on a paid tier; we do not opt in to any provider's data-sharing or model-improvement program, and we do not operate self-hosted or offline AI models. Aqqrue restricts access to Customer Data and uses technical controls intended to reduce unauthorized disclosure, prompt-injection risks, and inadvertent inclusion of sensitive data in telemetry.
7. Google API Services and Limited Use
Aqqrue connects to Google services such as Gmail and Google Drive only when a firm user authorizes the connection through Google's consent screen. Aqqrue's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs, including through AI/ML models, will adhere to the Google User Data Policy, including the Limited Use requirements.
We use Google user data only to provide and improve the features the user requests, such as reading invoices, bills, and statements from a connected mailbox or drive and preparing draft replies. We do not sell Google user data, use it for advertising, or transfer it to data brokers or information resellers. Humans do not read Google user data except with the user's explicit consent, where necessary for security purposes or to comply with applicable law, or where the data has been aggregated and anonymized for internal operations.
Google user data may be processed by the AI model providers named in the AI processing section solely to deliver these features. Each provider is used under commercial API terms that prohibit using the data to train or improve its models, we do not opt in to any such training, and we do not operate self-hosted or offline AI models. Users can disconnect a Google account at any time from the application's integration settings or from their Google Account permissions, after which Aqqrue stops accessing that data and deletes stored Google user data in line with the Retention and deletion section.
8. Cookies and choices
Our website and Services use necessary cookies for sessions, security, and core functionality, and may use analytics or advertising-related cookies or similar technologies on marketing pages. Cookie categories and available preferences are presented through the Cookie Settings control where supported. You can also use browser controls to delete or block cookies; disabling essential cookies may affect functionality. If our advertising or analytics implementation constitutes a "sale," "sharing," or targeted advertising under applicable state law, we will provide the legally required opt-out mechanism and honor applicable browser-based opt-out signals as required by law.
You can opt out of marketing email using the unsubscribe link or by contacting us. You can opt out of Aqqrue marketing texts at any time by replying STOP. We may still send necessary account, billing, security, and service notifications.
9. Security and production access
Aqqrue's security program is independently audited under SOC 2 Type II and is compliant with GDPR and HIPAA; an ISO/IEC 27001 certification audit is in progress. We maintain access controls, encryption in transit and at rest, logging, vulnerability management, and other administrative and technical safeguards described on our Security & Data Protection page. Access to live production data by Aqqrue personnel, whether based in the United States or internationally, is limited to authorized need-to-know circumstances such as troubleshooting a customer issue, and is subject to confidentiality and security controls. No method of data storage or transmission can be guaranteed completely secure.
10. Where information is stored
Primary Customer Data hosting and storage are in US-based AWS environments. Authorized Aqqrue personnel or subprocessors in other countries may remotely access data for limited operational support or process it as necessary to deliver the Services. Such access is governed by contractual, security, and access-control safeguards. If a particular transfer is subject to a law requiring additional transfer mechanisms, Aqqrue and the relevant customer will implement an appropriate mechanism as required by applicable law.
11. Retention and deletion
For Customer Data governed by the DPA, Aqqrue removes data from active production systems within 15 days after subscription termination, subject to legally required retention. Point-in-time recovery copies may remain for up to 35 days, and weekly geo-redundant disaster-recovery backup sets for up to 12 months; these copies remain protected, are not used for ordinary processing, and expire through scheduled backup rotation. Restored data remains subject to applicable deletion obligations.
Aqqrue retains its independent business-contact, account, billing, website, security, and correspondence records only as long as reasonably necessary for their collection purposes, legitimate business needs, applicable retention duties, dispute resolution, and security. The duration varies by record type, legal requirement, and relationship. We may retain de-identified or aggregated information where permitted by law and not reasonably capable of identifying an individual.
12. Privacy rights
Depending on your state of residence and applicable law, you may have rights to know or access personal information, obtain a portable copy, correct inaccuracies, request deletion, opt out of certain sales, sharing, or targeted advertising, and appeal a denial. Rights are subject to statutory exceptions and verification requirements. We will not unlawfully discriminate against you for exercising your rights. Authorized agents may submit requests where permitted with appropriate verification.
For personal information Aqqrue maintains in its independent business capacity, send requests to contact@aqqrue.ai. We may request information needed to verify identity and will respond in accordance with applicable law. For information in a firm's accounting workspace, contact that firm as the primary decision-maker; we assist the firm under the DPA. Where a consent-based processing activity applies, you may withdraw consent prospectively as applicable.
13. Children and sensitive categories
Aqqrue is a business service, not directed to children under 16, and we do not knowingly solicit personal information from children. If you believe a minor provided information to us outside a firm-managed accounting workflow, contact us. Customers should not intentionally upload tax returns, Social Security Numbers, medical records, or complete payment-card credentials unless Aqqrue expressly authorizes a supported workflow in writing.
14. Changes to this Policy
We may update this Policy as our practices or laws change. We will post the revised version with its effective date and provide additional notice for material changes where required. Updates to the separate DPA follow the mechanisms in the contract with the relevant customer.
15. Contact information
Aqqrue Inc.
8 The Green, #13842, Dover, DE 19901, United States
Privacy questions and rights requests: contact@aqqrue.ai
Security inquiries: security@aqqrue.com