Privacy

Privacy policy

PaidUp is a self-serve tool that helps a business collect its own invoices and review its own vendor bills. This page describes what the service stores. It is the policy to link from an Intuit app listing.

What we collect

Account data: your name, email, password hash, whether two-factor sign-in is on, company name, and settings such as tone, signature, timezone, from-address, and reminder switches. A sign-in code is stored only as a hash, with the number of attempts, until it expires in 10 minutes or is used. A phone number is stored only when you opt a customer into text reminders, along with the consent time, the timezone used for quiet hours, and whether they replied STOP.

QuickBooks Online data, only after you connect: customers, invoices (including balances, dates, document numbers, bill-to email, and the invoice link when QuickBooks provides one), and vendor bills with their lines. The OAuth scope is com.intuit.quickbooks.accounting. Intuit does not offer a narrower read-only scope. PaidUp uses that scope only for read requests. It does not create, edit, void, or delete anything in QuickBooks.

Connection tokens and the live QuickBooks company id are encrypted at rest with AES-256-GCM. The key is a server environment variable, not a database column. Disconnecting deletes the stored tokens and asks Intuit to revoke the refresh token. That revoke call is not a write to your accounting file. Job state, completion, and retainage are stored only when you type them onto an invoice. Filing-window notes stay with the workspace owner. If you redeem an AppSumo license, the license key and tier are stored on the account. A listing code is stored with the account that redeemed it, and that code cannot be used again.

How it is used

Invoice facts are used to decide reminder timing and to draft reminder emails. Bill lines are checked for duplicates, price changes, and math. Reply text you forward, or that arrives on the inbound webhook, is classified so reminders can pause. A Monday summary is sent to the workspace owner only after you turn it on.

If an Anthropic API key is configured, the invoice or bill facts needed for a draft are sent to Anthropic so the model can write the email. Drafts are rejected if they contain an amount that was not in those facts, and a fixed template is used instead. Without an API key, only the templates run. Email is sent through the provider you configure (or kept in the in-app outbox in mock mode). Subscription status is handled by Stripe when billing is turned on.

Who else processes it

Intuit (QuickBooks Online), the email provider you select, Resend for sign-in codes when a Resend key is configured (even if reminder mail uses another provider), Twilio when texting is configured, Anthropic when a key is set, Stripe when you subscribe, AppSumo when you redeem a license, and the host that runs the app (intended to be Render, with Postgres). We do not sell customer data.

Retention and deletion

Synced books stay until you delete them in Settings or delete the workspace. Deleting the workspace removes the company, the tokens, the invoices, the bills, and the login. You can also disconnect QuickBooks without closing the account. To ask for a copy or a deletion by email, write to support@paidupai.com.

Security

Workspaces are isolated: a login can read only its own company. Passwords are hashed. When two-factor sign-in is on, the session cookie is issued only after the email code is verified. That code is hashed, expires in 10 minutes, and locks after five wrong attempts. Trusting a device stores an httpOnly signed cookie for 30 days. Sessions are httpOnly cookies. QuickBooks tokens are encrypted with a server key that is not stored in the database.

Questions: support@paidupai.com.