HayberBooks Privacy Policy

Effective August 27, 2026 · Version 2026-08-27

This Policy explains how HayberTech & Trade LLC ("HayberTech," "we," or "us") handles information for HayberBooks at books.haybertech.com. HayberBooks is an invitation-only cash-flow and bookkeeping-assistance product for businesses.

Information we collect

• Access-request information: business and contact names, email, optional phone and message, consent records, review status, and a one-way IP hash used for abuse prevention.
• Account information: business profile, email, authentication and agreement records, preferences, and account status. Supabase Auth handles password hashes; HayberTech does not store readable passwords.
• Financial information: transaction dates, amounts, descriptions, merchants, categories, account type/name, masked identifiers, and available balance information needed for the product.
• Uploaded and user-created information: statement files during processing, parsed rows, corrections, rules, notes, goals, support messages, and exports you request.
• Billing information: Stripe customer/subscription identifiers, plan, and payment status. HayberTech does not store full payment-card numbers.
• Security and usage information: sessions, device/browser information, timestamps, feature activity, webhook and sync status, and security/audit events.

How we use information

• Review access requests and create approved private accounts.
• Connect authorized institutions, import statements, and maintain transaction history.
• Categorize transactions, detect recurring activity, calculate cash-flow metrics, and answer questions.
• Operate trials and subscriptions, send service messages, and respond to support.
• Prevent abuse, secure accounts, investigate incidents, debug failures, and improve reliability.
• Comply with law and enforce our agreements.

We do not sell personal or financial information and do not use it for third-party behavioral advertising.

Bank connections and Plaid

Plaid provides the institution-linking interface. Bank credentials are entered into Plaid's interface, not HayberBooks. HayberBooks receives a Plaid access token plus the authorized account and transaction data. The token is encrypted before storage. The current product uses read-only transaction access and cannot initiate transfers or withdrawals.

AI processing and OpenAI

Certain categorization, summary, and question-answering features send the minimum relevant transaction information and user text to OpenAI's API. HayberBooks sets response storage to disabled. OpenAI states that API data is not used to train its models unless the customer explicitly opts in.

OpenAI may retain prompts, responses, and related metadata in abuse-monitoring logs for up to 30 days by default, unless a different approved retention control applies. HayberTech has not promised Zero Data Retention. Contact us to request manual-only processing where available.

Service providers

• Supabase: database and authentication.
• Vercel: application hosting and request processing.
• Plaid: institution connection and financial-data retrieval.
• Stripe: subscription checkout, billing, and customer portal.
• OpenAI: selected AI-assisted product functions.
• Resend: invitations, password resets, support, and service email.
• Cloudflare Turnstile: bot and abuse prevention where enabled.

Providers process information under their own terms and privacy practices. We may also disclose information when required by valid legal process, to protect users or the service, or during a business transaction subject to appropriate safeguards.

Security

Measures include HTTPS/TLS, Supabase authentication and row-level controls, restricted administrative access, encrypted Plaid tokens using AES-256-GCM, environment-managed secrets, signed-webhook validation, monitoring, and audit records. No system is perfectly secure, and these measures do not guarantee that an incident cannot occur.

Retention and deletion

• Pending access requests: retained while under review and normally deleted or anonymized within 12 months if no account is created. Obvious spam may be retained briefly to prevent repeated abuse.
• Active clients: account and financial information is retained while needed to provide the service.
• Disconnected banks: the stored Plaid token is deleted after revocation; imported transaction history remains until account deletion unless you request otherwise.
• Closed accounts: we target deletion or de-identification of transaction data within 30 days after a verified request, subject to security, dispute, backup, and legal obligations.
• Billing and agreement records: limited records may be kept for tax, accounting, fraud-prevention, and contract evidence for the period required by applicable law.
• Logs and backups: retained according to provider and internal schedules, then overwritten or deleted through normal retention cycles.

Your choices and rights

You may contact books@haybertech.com to:

• Request access to or correction of your information.
• Export available transaction information.
• Disconnect a bank or request account deletion.
• Change eligible email preferences.
• Object to or limit AI processing where manual-only operation is available.
• Exercise privacy rights provided by applicable law.

We may verify your identity and authority over the business before completing a request.

Cookies and analytics

HayberBooks uses essential cookies for authentication, security, and preferences. We do not currently use third-party advertising pixels. If analytics practices change, this Policy and any required consent controls will be updated first.

Children and geographic processing

HayberBooks is not intended for anyone under 18. Information may be processed in the United States and other locations where our providers operate, subject to applicable safeguards.

Changes and contact

We will identify the current version above and provide reasonable notice of material changes when appropriate. Privacy questions and requests may be sent to books@haybertech.com, HayberTech & Trade LLC.