Privacy Policy

1. Information We Collect

• Account information: your name, email address, and password (stored as a secure one-way hash — we never see or store your plaintext password).
• Organization information: your company name, currency, and timezone preferences.
• Business records you enter: expenses, revenue, savings, and settlements; employee records (name, position, monthly salary, join date); attendance check-in/check-out timestamps; uploaded receipt files.
• Billing information: handled directly by Stripe, our payment processor — we receive your subscription status and plan, never your full card number.
• Technical information: session cookies needed to keep you signed in, and standard server logs (IP address, request timestamps) generated by our hosting infrastructure.

2. How We Use Information

• To provide, operate, and maintain the Service — including the calculations, reports, and attendance tracking you use it for;
• To process subscription payments and communicate about your billing;
• To send transactional emails you request or need, such as password resets and employee/co-owner invitations;
• To maintain the security and integrity of the Service, including preventing unauthorized cross-organization access;
• To comply with legal obligations.

We do not use your business data to train any third-party AI model, and we do not sell personal information.

3. Legal Basis for Processing (EEA/UK Users)

If you are located in the European Economic Area or the United Kingdom, we process your personal information under the following legal bases: performance of a contract (to provide the Service you signed up for), legitimate interests (to secure and improve the Service), and, where applicable, your consent.

4. How We Share Information

We do not sell your personal information. We share information only with the third-party service providers that help us operate the Service, each acting as our data processor:

• Stripe — payment processing and subscription billing;
• Cloudinary — storage for uploaded receipt files;
• Resend — delivery of transactional emails;
• Cloud infrastructure providers (database and application hosting) — to run the Service.

We may also disclose information if required by law, or to protect the rights, property, or safety of City Business LLC, our users, or others.

5. International Data Transfers

Our hosting infrastructure is located in the United States. If you access the Service from the EEA, the UK, or elsewhere outside the US, your information will be transferred to and processed in the US. Where required, we rely on our providers' standard contractual clauses or equivalent safeguards for these transfers.

6. Data Retention

We retain your information for as long as your account is active, and for a reasonable period afterward to allow for account recovery and to meet legal, tax, and accounting obligations. You can request deletion of your account and associated data at any time by contacting us (see Section 10).

7. Data Security

We use industry-standard measures to protect your information, including encryption in transit (HTTPS), secure password hashing, and tenant-scoped access controls so that one organization's data is never visible to another. No system is completely secure, and we cannot guarantee absolute security.

8. Cookies

We use a single essential session cookie to keep you signed in. We do not use advertising or third-party analytics/tracking cookies.

9. Your Rights (EEA/UK Users — GDPR)

You have the right to:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Request deletion of your information ("right to be forgotten");
• Restrict or object to certain processing;
• Receive your data in a portable format;
• Lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, contact us at the address in Section 11.

10. Your Rights (US Users — CCPA and similar state laws)

If you are a California resident, or a resident of another state with similar rights, you have the right to:

• Know what personal information we have collected about you and how it is used;
• Request deletion of your personal information;
• Request correction of inaccurate information;
• Not be discriminated against for exercising these rights.

We do not sell or share personal information for cross-context behavioral advertising, so there is no opt-out required for that. You may exercise your rights, or designate an authorized agent to do so on your behalf, by contacting us at the address in Section 11.

11. Contact Us

For any privacy questions, data requests, or to exercise the rights described above, contact us at legal@recordsplit.com.

12. Children's Privacy

The Service is intended for business use by adults and is not directed at children. We do not knowingly collect personal information from anyone under 16.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice, such as by email or an in-app notice, before the changes take effect.