Privacy Policy

Effective date: July 3, 2026
Last updated: November 2, 2026
Who we are: Fidurant LLC, a Kentucky limited liability company (“Fidurant”, “we”, “us”), providing the Fidurant back-office service (the “Service”).
Contact: support@fidurant.com

What the Service does

Fidurant helps small businesses run their back office. The Service:

• processes business documents (invoices, receipts, purchase orders, contracts, statements and similar records) that your organization uploads or emails in, extracts key information from them, and routes them to your team for human review;
• optionally connects to your accounting system (QuickBooks Online) to read your business records and keep them in sync;
• optionally connects to your bank accounts (through Plaid) to read transactions for reconciliation;
• prepares drafts your team can approve — such as payment reminder emails, purchase orders, and accounting entries — and keeps organized, auditable records your business can search and export.
• provides inventory conversations, BOM imports, procurement sourcing cases, personalized onboarding, document revision history, and transactional email delivery/suppression tools.

Our website and the pilot application form

This section covers the public website at fidurant.com and its pilot application form.

• When you apply for the pilot, the form collects your name, work email, company, your role, whether you use QuickBooks Online, and anything you write in the optional message. We use them only to reply to you about the pilot. The application is sent as an email to our inbox (support@fidurant.com); the website itself does not keep a copy. We keep your application for as long as we are discussing the pilot with you, and delete it within 12 months after that, or sooner if you ask.
• To keep the form from being flooded, the form keeps a one-way code (a SHA-256 hash) made from your network address, with the times you sent the form, and forgets them after 24 hours.
• Like every website, our hosting provider (Hostinger) keeps standard server logs of each request (including the network address, the time, the page requested and the browser’s description of itself) for security and operations, for a limited period under its own retention policy.
• If you use the site’s Motion switch, your choice (on or off) is saved in your own browser’s local storage so the site remembers it. It never leaves your device.
• The website uses no cookies, no analytics and no advertising or tracking pixels, and loads no third-party scripts, fonts or embeds: every file it loads comes from fidurant.com.

Information we collect

• Documents you provide. The files your organization uploads or emails to the Service, and the information extracted from them (vendor and customer names, amounts, dates, invoice numbers, contact details, line items, contract terms). For documents identified as contracts, we also retain the full text of the document so the Service can extract, and let your team confirm, the contract’s terms; the full text of other document types is not retained after processing (we keep only the extracted fields above). The original file you uploaded is retained for every document type.
• Emails sent to your organization’s intake address. If you enable email-in, we receive the emails sent to your organization’s private intake address, including the sender’s address, subject, message text, and attachments. We check the sender against your organization’s vendor and customer records and standard email-authenticity signals before accepting documents.
• Accounting data you connect. If you connect QuickBooks Online, we sync your vendors, customers, invoices, payments, bills, items, and chart of accounts. We store the connection tokens encrypted.
• Bank data you connect. If you connect a bank account through Plaid, we receive account balances and transaction records (read-only). We never receive or store your bank credentials — those go directly to Plaid.
• Account information. Your name, email address, and sign-in identity, provided through our authentication provider (Clerk), and per-user preferences you set in the Service (for example, an email signature used on messages you approve).
• Usage and audit records. Actions taken in the Service (uploads, reviews, approvals, corrections, sends, exports, settings changes), with who did them and when. These records exist to give your business a trustworthy audit trail.
• Inventory, sourcing, and setup data. Questions and answers saved in inventory conversations; BOM rows and human column mappings; sourcing queries, constraints, goals, candidate evidence and selections; and onboarding role, goal, step, and sample-mode preferences.
• Revision and email operations. Immutable document-revision snapshots and downstream impact records; approved email recipients, subjects, categories, provider message IDs, delivery events, bounce/complaint/unsubscribe suppressions, and organization sender and reply-to preferences. We do not expose the platform’s provider API credential to customers.
• We do not collect payment card details through the Service today. If billing is added, card processing will be handled by a dedicated payment processor and this policy updated.

How we use information

• To provide the Service: extract, organize, match, and route your business data for your team’s review and approval.
• AI processing. We use artificial-intelligence models to read document text and to draft content (for example, suggested ledger categories, contract term summaries, payment reminder wording). AI output in the Service is a draft or suggestion: it is presented to your team for human review. Sensitive external or consequential actions require human approval by default. An owner may enable only allowlisted, deterministic, bounded low-risk automation; generative AI cannot auto-submit those actions.
• To send communications you approve: when your team approves a payment reminder, the Service sends that email to your customer on your organization’s behalf.
• To secure and operate the Service: authentication, access control, abuse prevention, screening of inbound email, malware scanning, troubleshooting with sanitized logs.
• To support you and improve reliability.
• We do not sell your information. We do not use your documents or extracted data to train AI models, and our AI providers do not train on it either (see below).

Who processes data on our behalf (sub-processors)

We use a small set of service providers to run the Service. Each processes data only to provide their function to us:

Provider	Function	Location
Amazon Web Services (AWS)	Hosting, storage, infrastructure	United States
Microsoft Azure — Document Intelligence	Reading text and fields from your documents (OCR)	United States
OpenAI	Interpreting document text and drafting content (AI)	United States
Clerk	Sign-in and account authentication	United States
Intuit (QuickBooks Online)	Your accounting system, if you connect it — we exchange data with it at your direction	United States
Plaid	Bank account connections (read-only transactions), if you connect one	United States
SendGrid (Twilio)	Sending approved emails; receiving email sent to your intake address	United States
AWS Simple Email Service	Sending Service emails (used as we scale email volume)	United States
Sentry	Error reporting (scrubbed of document contents)	United States

Plainly: the content of documents you submit is sent to Microsoft Azure and OpenAI to be read and interpreted. OpenAI is also used to draft content — payment reminders, bill codings, and financial summaries — so the relevant connected accounting data (such as customer and vendor names and invoice amounts) is sent to OpenAI for those features too. All of these providers process your data under agreements that prohibit using it to train their models. All transfers are encrypted. We will update this table if the list changes.

Your QuickBooks and bank connections are also governed by Intuit’s and Plaid’s own terms and privacy policies, which you accept when you connect those accounts.

How we protect information

• Encryption in transit (TLS/HTTPS everywhere) and at rest (databases and file storage). Accounting and bank connection tokens are additionally encrypted at the application layer.
• Organization isolation: your organization’s data is only accessible to your organization’s authorized users; every data access is scoped to your organization.
• Human-in-the-loop by default: extracted data is reviewed by your own team, and outbound actions (emails, purchase orders, accounting postings) require your team’s explicit approval.
• Role-based access, audit logging of data-affecting actions, malware scanning of uploads and email attachments, sender screening on inbound email, and error reporting that is scrubbed of document contents.

Retention and deletion

• Documents and extracted data are retained while your organization’s account is active. The full contract text we retain for contract documents (see “Information we collect”) is stored with that document and deleted together with it, on the same schedule.
• When your account closes, your organization’s data enters a wind-down period of 90 days (so an accidental closure can be recovered and open questions can be settled), after which it is irreversibly purged. What survives the purge: sanitized audit records — the record that actions happened (who, what, when, status, counts, and content hashes), without any document contents, extracted business data, or message text — and billing records if any, retained for integrity and legal purposes.
• When you request deletion (a verified request from an organization owner), we complete the deletion within 30 days of the request.
• Deleted data may persist in encrypted backups and prior file versions for up to 35 days after deletion, until those residual copies expire on their fixed schedule. Backups are never used to restore data you asked us to delete, except during a disaster recovery — in which case we re-apply the deletion.
• Legal hold. If your organization’s data is subject to an active legal dispute, a subpoena or other legal process, or a suspected-fraud investigation, we may preserve the affected data past the schedules above until the matter is resolved, as the law requires. Deletion resumes when the hold is released.
• What deletion covers. You can delete individual documents at any time, and you can close the whole account (everything). Because your synced accounting records mirror your accounting system, we do not offer field-by-field erasure inside synced accounting data — delete or correct the record in your accounting system and the change syncs here.
• Disconnecting QuickBooks or a bank account stops future syncing; data already synced remains in your organization’s records until deleted as above.

Your rights and choices

• Export: organization administrators can export the organization’s documents data, line items, and vendor/customer records from the Service at any time (CSV).
• Correction: your reviewers can correct extracted data directly in the Service. Corrections to routed documents create revision and impact records; confirmed downstream ledgers and external records are preserved and may require a compensating workflow.
• Email choices: organization administrators can manage supported transactional email categories and active suppression records. Some service and security communications may still be necessary to operate the account.
• Deletion: administrators can delete individual documents in the Service; full account deletion is available on request to support@fidurant.com or through account closure in the Service, and is completed on the schedule described in “Retention and deletion” above.
• Disconnection: administrators can disconnect QuickBooks or bank connections at any time in Settings.
• Depending on where you are located, you may have additional legal rights (access, portability, objection). Contact us and we will honor applicable law.

Other disclosures

• We disclose information if required by law or to protect the Service and its users, and in connection with a business transfer (sale/merger), in which case this policy continues to apply to previously collected data.
• The Service is for businesses and is not directed to children.
• We will post updates to this policy at this page and update the effective date; material changes will be communicated to account administrators.

Governing law

This policy and any privacy dispute are governed by the laws of the Commonwealth of Kentucky.