Privacy policy

We provide a software-as-a-service platform that processes financial, transactional, and business data on behalf of our customers.  Our data handling practices comply with the standards of applicable laws, including where applicable, the California Consumer Privacy Act (“CCPA”), the California Privacy Rights Act (“CPRA”), and the General Data Protection Regulation (“GDPR”). Because we primarily offer software services to business customers, in most cases, we process personal information on behalf of our customers and according to their instructions and our contractual obligations with them. When customers provide data to our Services, we generally act as a service provider under CCPA/CPRA and as a data processor under GDPR. When we process personal information solely in accordance with the customer's instructions and applicable agreements, we do not use customer data for our own independent purposes. In these cases, individuals should direct privacy requests to the relevant customer (business/data controller). When we collect and use the information you submit to us directly and process that data for its own purposes, we act as a company and data controller under CCPA/CPRA and GDPR, respectively. This role allows us to decide what to do with your personal data, such as account registration, communications with you, and related informational activities. In these cases, you should submit your privacy requests to us directly by contacting us at privacy@connectbooks.com. 

What Information We Collect and How We Collect It

When you sign-up for or use the Site or Service, we may collect or store personal information (“PI”) from you such as your first name, last name, e-mail address, and phone number. You may also interact with us through our customer support or chat communications, e.g., chatbot. If you choose to interact through chatbot or live support features, we will collect the information you share to improve our Services. You should refrain from voluntarily disclosing sensitive personal information, financial data, or your confidential information. We may also collect technical and usage data automatically when you use our site, i.e., your IP address, browser type, or pages viewed. The kinds of business and transactional  data we collect include: (a) your data that is imported from other platforms; (b) transaction data (your purchase history, billing); and (c) other customer-provided data that you previously uploaded to other platforms for the use of our Services. Other categories of data we collect include analytics and behavioral data such as your website interaction, navigation patterns, heatmaps, automatically collected data through cookies or analytical tools, advertising tools, or information from our third parties where permitted. Where required by law, we provide notices regarding data collection and processing. For this data, we are responsible for responding to your privacy rights requests. You may withdraw your consent at any time, where applicable, by following the instructions in this Privacy Policy or by contacting us at privacy@connectbooks.com.  If needed, we may disclose your PI, for example, to process your transactions, comply with legal requests, or report to credit-reporting agencies. Additionally, we at times collect publicly available data and link such data to data from you for the purpose of marketing or managing your account.  We do not use customer data for targeted or cross-context behavioral advertising. Your payment card data is processed and stored only by third-party payment processors under a tokenized and secure data infrastructure that we cannot access. 

Legal Basis for Processing Your Data

Where applicable under the GDPR, we may rely on the following legal bases: (i) to perform under a contract, e.g. with third-party platforms that you already conducted purchases, sales, and related financial transactions, such as data controllers with whom we are under contact or Services delivery; (ii) to meet our legitimate business interests, including to improve our Services, enhance our security safeguards, and analytical measures; (iii) to ensure consent for cookies or marketing purposes, where required; and (iv) to fulfill our obligations under applicable laws and regulations.  We also rely on our customer’s legal basis and consents.

Cross-Device Tracking, Data Sharing, Cookies, and Consent

We may use data received from one browser or device and link that data to another platform or device or at times send such data to our third parties. We also use cookies, pixels, and similar technologies to operate, secure, and improve our Site and Services. We will only engage in cross-device tracking for analytics or advertising once you have provided consent for us to do so through our cookie settings. We use strictly necessary cookies for core functionality and data security. Analytics and performance cookies, such as Google Analytics, measure usage and improve our Servies. Session/behavioral analytics are used to understand interactions with our Site, and Marketing Cookies may be used on our Site only. 

When providing our Services, we act as service provider/contractor (CCPA/CPRA) or data processor (GDPR) so that we can process the personal data only according to documented customer instructions. We do not use, disclose, retain, or combine personal information for any purpose other than as specified under contract. We do not sell or share personal information. We do not use personal information for cross-content behavior advertising. Our tracking is limited to service delivery, data security, and Service improvement. Under CCPA/CPRA, our use of your personal data is limited to allowable service provider purposes. Where applicable, under GDPR, non-essential cookies are used only with your prior and explicit consent.

Use and Disclosure of Personal Information

To provide a seamless experience, we use your personal information for business operation and managing your preferences. We only collect data necessary for the purposes described in our Privacy Policy, and any data sharing with our trusted third-party partners is subject to your prior consent and data protection. We use information for related and additional purposes as allowed by law such as: 

• servicing your account; 
• processing transactions;
• communicating with you; 
• improving our Site, products, or Services; 
• legal compliance; 
• responding to court orders and investigations;
• responding to credit bureaus;
• risk management; 
• information security and anti-fraud; 
• marketing or personalizing the presentation of our products and Services to you; 
• tracking website usage, such as number of hits, pages visited, and the length of user sessions in order to evaluate the usefulness of our sites; and 
• using read-receipt notifications in our email communications. 

We may disclose your personal information with other service providers for analytics, cloud hosting, marketing, payment processors, our business partners, such as the third parties that you already engaged in purchase and sales or other financial transactions with and/or connected to your account with us for our Services  We may also disclose your personal information to meet our legal and compliance duties to law enforcement or a regulatory authority or other otherwise enforce valid agreements or to protect rights.  We do not sell your personal information. 

We may engage in subprocessors to assist us in providing Services to you. Subprocessors may provide hosting, security, customer support, analytics, communications, or other operational functions. We require our subprocessors to protect personal data through contractual duties consistent with applicable data protection and privacy laws. A current list of subprocessors may be made available upon request or through our website or by contacting us at privacy@connectbooks.com.

Data Retention

We retain personal data only for as long as reasonably necessary to provide our Services and to fulfill the purposes we describe in the Privacy Policy, including accounting, legal, and compliance reporting requirements. We are required to retain customer data according to customer instructions under contract, and we delete upon termination stipulated unless legally required otherwise. To assess the proper retention period for data we control, we consider the categories of data, industry standards and regulatory retention criteria, and applicable legal timelines. We may delete certain customer data after account termination within a defined time period, subject to legal obligations. 

We do not target our marketing to the EU or conduct business in or to the EU in any meaningful way. All Customers are required to have a valid US address. 

If you are a resident of the European Economic Area (“EEA”), or are accessing this site from within the EEA, you are not to use the Site or the Services. Our Privacy Policy applies to all users. For EEA residents, additional GDPR rights and information may apply as detailed herein. 

Text Messaging

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Disclosure of Information

We may share your information with relevant parties, as examples:

• Third-party service providers (i.e. analytics, marketing, web production); and
• Other third parties to comply with legal requirements such as: 
  
  • to enforce our Terms or verify information to that end; 
  • enforce our other rights; 
  • resolve security or operational concerns; 
  • emergency responses; or 
  • otherwise to protect our customers or other parties.

Security and Breach Notification

We implement reasonable physical, technical, and administrative safeguards to protect PI.  Despite our technical and organizational measures and industry standards to protect your data, however, no data transmission or storage system can be guaranteed to be completely secure. If you believe you have a security concern relating to this Site or our Services, please immediately contact us at privacy@connectbooks.com.  When acting as service provider or data processor, we will notify the relevant customer without undue delay after becoming aware of a confirmed personal data breach affecting customer data and according to contractual duties. When acting as a data controller, we will comply with applicable breach notification requirements under relevant laws. Where applicable, and if GDPR applies, we will notify the relevant authorities within 72 hours of becoming aware of such breach or as required under applicable laws. 

Jurisdiction

Our Site is intended for North American visitors. If you browse this Site or use our Service your information will be processed within the United States. If personal information is transferred to us from outside the United States, we use appropriate safeguards to protect your data. We rely on the following mechanisms, if applicable: (i) standard Contractual Clauses (SCCs) under the European Commission as a safeguard for transfers regarding service providers and other recipients; (ii) the EU-U.S. Data Privacy Framework (DPF) concerning the transfer of data to recipients certified under the DPF; or (iii) other mechanisms as permitted under the GDPR, where applicable. You can request more information or a copy of the safeguards we use for data transfers, where applicable, by contacting us at privacy@connectbooks.com.

We do not intentionally offer our Services to individuals located outside the United States or within the European Economic Area or the United Kingdom. If you believe we have inadvertently collected your personal data, please contact us.

CCPA/CPRA Notice (California Residents)

Last Revised: June 3, 2026

This Privacy Notice for California Residents supplements the information contained in ConnectBook’s Privacy Policy and applies solely to all visitors, users, and others who reside in the State of California (“consumers” or “you”) and certain other U.S. jurisdictions. We adopt this notice to comply with the California Consumer Privacy Act of 2018 (CCPA), as amended, and any terms defined in the CCPA have the same meaning when used in this Notice. 

• Your Rights:  As a California resident, you may have the right to: know what personal information we collect; access personal information; correct inaccurate personal information; delete personal information; receive personal information in a portable format; opt out of the sale or sharing of personal information; limit certain uses of Sensitive Personal Information where applicable; and be free from discrimination for exercising privacy rights.
• Sensitive Personal Information (SPI):  We may process limited categories of Sensitive Personal Information, including account credentials; financial account information; payment-related information; or information contained within Customer Data submitted by customers. We use SPI only as necessary to provide the Services and do not use SPI for profiling or marketing purposes. 

1. Information We Collect

Our Site collects information that identifies, relates to, describes, references is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household, or device (“personal information”). Personal information does not include:

• publicly available information from government records;
• deidentified or aggregated consumer information; and
• information excluded from the CCPA’s scope, like:
  
  • health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data; and
  • personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.

In particular, our Site has collected the following categories of personal information from its consumers within the last twelve (12) months: 

‍

‍

Our Site obtains the categories of personal information listed above from the following categories of sources:

• directly from you--for example, from forms you complete or products and services you purchase; and
• indirectly from you--for example, from observing your actions on our Site.

2. Use of Personal Information

We may use or disclose the personal information we collect for one or more of the purposes enumerated in the bullet points immediately following this sentence. 

• To fulfill or meet the reason for which you provided the information. For example, if you share your name and contact information to request a price quote or ask a question about our products or services, we will use that personal information to respond to your inquiry. If you provide your personal information to purchase a product or service, we will use that information to process your payment and facilitate delivery. We may also save your information to facilitate new product orders or process returns. 
• To provide, support, personalize, and develop our Site, products, and services.
• To create, maintain, customize, and secure your account with us.
• To process your requests, purchases, transactions, and payments and prevent transactional fraud.
• To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.
• To personalize your Site experience and to deliver content and product and service offerings relevant to your interests, including targeted offers and ads through our Site, third-party sites, and via email or text message (with your consent, where required by law).
• To help maintain the safety, security, and integrity of our Site, products and services, databases and other technology assets, and business.
• For testing, research, analysis, and product development, including to develop and improve our Site, products, and services.
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• As described to you when collecting your personal information or as otherwise set forth in the CCPA.
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our Site users is among the assets transferred.

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

3. Sharing Personal Information

We may disclose your personal information to a third party for a business purpose. When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract. The CCPA prohibits third parties who purchase the personal information we hold from reselling it unless you have received explicit notice and an opportunity to opt-out of further sales.

We share your personal information with the following categories of third parties:

• service providers;
• marketing agencies; and 
• data aggregators.

4. Disclosures of Personal Information for a Business Purpose

In the preceding twelve (12) months, Company has not disclosed personal information for a business purpose.

5. Sales of Personal Information 

In the preceding twelve (12) months, Company had not sold personal information.

6. Your Rights and Choices 

The CCPA/CPRA provide consumers (California residents) with specific rights regarding their personal information. This section describes your CCPA/CPRA rights and explains how to exercise those rights.

          6.1. Access to Specific Information and Data Portability Rights

You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you the information specified in the bullet points immediately following this sentence.

• The categories of personal information we collected about you.
• The categories of sources for the personal information we collected about you.
• Our business or commercial purpose for collecting or selling that personal information.
• The categories of third parties with whom we share that personal information.
• The specific pieces of personal information we collected about you (also called a data portability request).
• If we sold or disclosed your personal information for a business purpose, we will provide two separate lists disclosing:
  
  • sales, identifying the personal information categories that each category of recipient purchased; and 
  • disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained. 

We do not provide these access and data portability rights for B2B personal information.

         6.2. Deletion Request Rights 

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies. 

We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to do any of the things enumerated in the bullet points immediately following this sentence. 

1. Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, or otherwise perform our contract with you.
2. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
3. Debug products to identify and repair errors that impair existing intended functionality.
4. Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
5. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.), as amended.
6. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
7. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
8. Comply with a legal obligation.
9. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

‍

We do not provide these deletion rights for B2B personal information.

         6.3. Exercising Access, Data Portability, and Deletion Rights

To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request to us by either: 

• Emailing us at privacy@connectbooks.com.
• Calling us at: 845-751-1600

Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. 

You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

• provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative, which may include:
  
  • name, contact information, and information related to your transaction or relationship with the Company, but the specific information requested may differ depending on the circumstances of your request for your security and to protect privacy rights; and  
  • describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. 

Making a verifiable consumer request does not require you to create an account with us. However, we do consider requests made through your password-protected account sufficiently verified when the request relates to personal information associated with that specific account.

We will only use the personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request. 

         6.4. Response Timing and Format

We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to 45 days), we will inform you of the reason and extension period in writing.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. 

Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. 

          6.5. Personal Information Sales Opt-out and Opt-In Rights

If you are 16 years of age or older, you have the right to direct us to not sell your personal information at any time (the “right to opt-out”). We do not sell the personal information of consumers whom we actually know are less than 16 years of age, unless we receive affirmative authorization (the “right to opt-in”) from either the consumer who is at least 13 but not yet 16 years of age, or the parent or guardian of a consumer less than 13 years of age. Consumers who opt-in to personal information sales may opt-out of future sales at any time.

7. Non-Discrimination

We will not discriminate against you for exercising any of your CCPA/CPRA rights. Unless permitted by the CCPA/CPRA, we will not:

• deny you goods or services;
• charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
• provide you a different level or quality of goods or services; or
• suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Any CCPA-permitted financial incentive we offer will reasonably relate to your personal information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time. 

8. Other California Privacy Rights

California’s “Shine the Light” law (Civil Code Section § 1798.83) permits users of our Site that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. We may request information necessary to verify identity before responding to such requests. To make such a request, please send an email to privacy@connectbooks.com or write us at ConnectBooks, 21 Grove Street, Suite 210, Spring Valley, New York 10977, United States of America.

9. Changes to Our Privacy Notice

We reserve the right to amend this CCPA/CPRA Privacy Notice at our discretion and at any time. When we make changes to this CCPA/CPRA Privacy Notice, we will post the updated notice on the Site and update the notice’s effective date. Your continued use of our Site following the posting of changes constitutes your acceptance of such changes.

10. Contact Information

If you have any questions or comments about this notice, the ways in which Company collects and uses your information described here and in the Privacy Policy (see above), your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at

Site: https://Connectbooks.com 

Email: privacy@connectbooks.com 

Postal Address: ConnectBooks, 21 Grove Street, Suite 210, Spring Valley, New York 10977

GDPR Privacy Notice 

Last Revised: June 9, 2026

This Privacy Notice supplements the information contained in ConnectBook’s Privacy Policy and applies solely to all visitors, users, and others who are residents of or located in the EU or EEA.  We do not target our marketing to the EU/EEA or conduct business in or to the EU/EEA in any meaningful way; however, the GDPR may apply where EU/EEA personal data is processed or submitted to us.  

Your Rights Under the GDPR

If you are a resident of or located in the EU/EEA, you have the following rights regarding your personal data. ConnectBooks may act as a data processor when processing data on your behalf and may act as a data controller for activities such as website operations, analytics, and communications. 

• Right of Access: You have the right to request a copy of the personal data we hold about you.
• Right to Rectification: You have the right to request correction of any incomplete or inaccurate data we hold about you.
• Right to Erasure (“Right to be Forgotten”): You can ask us to delete your personal data when there is no good reason for us to continue processing it.
• Right to Restrict Processing: You have the right to block or suppress further use of your personal data in certain circumstances.
• Right to Data Portability: You can request the transfer of your personal data to you or a third party in a structured, commonly used, machine-readable format.
• Right to Object: You can object to our processing of your personal data where we rely on a legitimate interest or use it for direct marketing.
• Right to Withdraw Consent: If processing is based on consent, you can withdraw your consent at any time.  

To exercise any of these rights, please contact us at privacy@connectbooks.com. You also have the right to lodge a complaint with a European Union supervisory authority in the Member State of your habitual residence, place of work, or place of the alleged infringement. In our role as a data processor, we rely on our customers and partners to do obtain mandatory consents. When we act as a data processor, your data requests should be directed to the relevant customer who is acting as a data controller. If we receive a request from you that relates to customer data, we will timely forward that request to the appropriate customer for a response 

If you have any questions or comments about this notice, the ways in which Company collects and uses your information described here and in the Privacy Policy (see above), your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at

Site: https://Connectbooks.com 

Email: privacy@connectbooks.com 

Postal Address: Connectbooks, 21 Grove Street, Suite 210, Spring Valley, New York 10977

UK Residents – Additional Privacy Information

This section applies to individuals in the United Kingdom and supplements our main privacy policy. It covers our compliance with UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025.

Our Role

We are the data controller for any personal data we process from UK individuals. Our contact details are the same as in the main policy: privacy@connectbooks.com

Data We Process

As a B2B bookkeeping SaaS, we only process limited personal data for our very limited UK business customer base (e.g., contact name, email, phone, and basic billing information of finance contacts). We do not target UK consumers.

Legal Basis

We process personal data mainly to perform our contract with your business and for our legitimate business interests (e.g., service delivery, billing, and support). We may also rely on Recognised Legitimate Interests under UK law where applicable.

Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request erasure or restriction
• Object to processing

To exercise these rights, contact us at privacy@connectbooks.com. We will respond within one month.

International Transfers

We are a US-based company. When we transfer data from the UK to the US, we use appropriate safeguards such as Standard Contractual Clauses or other UK-approved mechanisms.

Children’s Data

Our service is for businesses only. We do not knowingly process data of children under 13.

Cookies and Tracking

We use essential cookies for service functionality. You can manage preferences through your account or browser settings.

Complaints

Please contact us first if you have any concerns. You can also complain to the UK regulator: Information Commissioner’s Office (ICO) Website: www.ico.org.uk

‍