Privacy Policy.

Scope

This policy applies to Pezzi websites, applications, and services that link to it. It does not govern the independent practices of third parties, including Plaid, Stripe, financial institutions, or websites that Pezzi may link to.

Information we collect

Depending on how you use Pezzi, we may collect:

• —Account and identity information, including your name, email address, authentication information, and communication preferences.
• —Business and team information, including business details, tax-related profile information, invited users, roles, permissions, customers, vendors, and contacts.
• —Financial and bookkeeping information, including linked account details, balances, transactions, categories, chart-of-account records, journal entries, receipts, invoices, bills, reports, and uploaded documents.
• —Subscription information, including your plan, billing status, and limited payment-related details received from Stripe. Pezzi does not store complete payment-card numbers.
• —Support and communications information, including messages, feedback, and records of assistance we provide.
• —Device, log, and usage information, including IP address, browser and device type, operating system, pages viewed, actions taken, timestamps, and diagnostic events.

Sources of information

We collect information:

• —Directly from you and other authorized users of your business account.
• —From financial institutions and data providers when you authorize a connection through Plaid.
• —From payment and subscription providers such as Stripe.
• —Automatically through cookies, browser storage, server logs, and similar technologies.
• —From integration partners when you direct them to provide information to Pezzi.

How we use information

• —Provide, operate, maintain, and improve Pezzi.
• —Connect financial accounts, synchronize transactions, organize records, generate reports, and provide requested accounting and tax-related features.
• —Create and administer accounts, businesses, team access, permissions, and subscriptions.
• —Authenticate users, detect fraud or abuse, protect the service, and maintain audit logs.
• —Respond to support requests and send service, security, billing, and policy communications.
• —Analyze performance and usage, develop new features, and troubleshoot errors.
• —Comply with law, enforce our agreements, and protect the rights, safety, and property of Pezzi, our users, and others.

Financial account connections

When you connect a financial account, Plaid and your financial institution handle the credentials used to establish that connection. Pezzi receives data and an access token authorized for the connection; Pezzi does not receive your online-banking password. Plaid access tokens held by Pezzi are encrypted at rest. You may disconnect a linked account, although Pezzi may retain previously imported records as described below.

How we disclose information

We do not sell personal information for money. We may disclose information only as reasonably necessary to operate Pezzi or as permitted by law, including:

• —To service providers that support hosting, data storage, banking connections, payments, communications, analytics, security, and customer support, subject to appropriate contractual restrictions.
• —To users you authorize to access your business, according to the roles and permissions assigned to them.
• —To professional advisers, auditors, insurers, authorities, or other parties when required by law or reasonably necessary to establish, exercise, or defend legal claims.
• —In connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of our business, subject to applicable law.
• —With your direction or consent.

Cookies and similar technologies

Pezzi uses essential cookies and browser storage for authentication, security, preferences, and core service operation. We may also use limited analytics technologies to understand performance and improve the service. You can control cookies through your browser, but disabling essential technologies may prevent parts of Pezzi from working.

Data retention

We retain information while your account is active and for as long as reasonably necessary to provide the service, maintain transaction and audit records, resolve disputes, enforce agreements, prevent fraud, and comply with legal, tax, and accounting obligations. Retention periods vary by the type of information and the reason it is held. When information is no longer needed, we delete or de-identify it where reasonably practicable.

Our standard retention periods are:

• —Bookkeeping records, including linked-account data, transactions, journal entries, reports, and uploaded documents, are kept while your business account is active. Disconnecting a bank account does not delete transactions already imported into your books.
• —When a business is closed, access to it ends immediately. Owners can download an export of its records for 30 days, and we delete the business’s records and stored files 90 days after closure.
• —If you delete your user account, your access to every business ends and your login details are anonymized. Businesses you solely own are closed as described above.
• —When you disconnect your last account at a financial institution, revoke consent, or close your business or account, we ask Plaid to remove the connection and delete the stored access token once Plaid confirms the removal.
• —Report and export download links expire after 7 days, and uploads that are never processed are deleted within 24 hours.
• —Application logs are kept for 30 days, and security logs and access records for 12 months.
• —Encrypted backups are kept for 35 days, so deleted information can remain in a backup until it expires. If we restore a backup, we reapply completed deletions.
• —We may keep specific information longer when the law requires it, to resolve a dispute, or under a legal hold, and only while that need continues.

Security

We use administrative, technical, and organizational safeguards designed to protect information, including encryption in transit, access controls, role-based business isolation, encrypted storage for Plaid access tokens, and audit logging. No system can be guaranteed completely secure, and you are responsible for protecting your credentials and promptly reporting suspected unauthorized access.

Your privacy choices and rights

Depending on where you live and subject to legal exceptions, you may have the right to request access to, correction of, deletion of, or a portable copy of personal information about you; object to or restrict certain processing; withdraw consent where processing relies on consent; or appeal our response to a request.

You may update certain information in Pezzi, disconnect linked accounts, manage team access, and opt out of non-essential marketing communications. To make a privacy request, email support@pezzi.io. We may need to verify your identity and authority before completing a request. Authorized agents may submit requests where permitted by law.

State and international privacy notices

Residents of certain U.S. states may have additional rights concerning access, correction, deletion, portability, and the sale, sharing, or use of personal information for targeted advertising. Pezzi does not sell personal information for money. If our practices change in a way that creates an additional opt-out right, we will provide an appropriate method to exercise it.

If you access Pezzi from outside the United States, your information may be processed in the United States and other countries where Pezzi or its service providers operate. Those countries may have different data-protection laws. Where required, we use recognized safeguards for international transfers.

Information about other people

You may provide information about employees, customers, vendors, contractors, or other people when using Pezzi. You represent that you have the authority and any required notices or consents to provide that information and allow Pezzi to process it as described in this policy.

Children

Pezzi is a business service and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us so we can take appropriate action.

Changes to this policy

We may update this policy to reflect changes to Pezzi, our practices, or applicable law. We will post the revised version with a new effective date and provide additional notice when a material change requires it.

Contact us

For privacy questions or requests, contact support@pezzi.io.