Privacy Policy

Effective November 13, 2026

CloudCPA Bookkeeper (the "Service") is operated by Cloud Accounting Group, Inc., doing business as CloudCPA ("CloudCPA", "we", "us"). This policy explains what information the Service collects, how we use it, and the choices you have. It applies to the web app at app.cloudcpa.ai, its API, and the CloudCPA Bookkeeper Chrome extension.

Who uses the Service

The Service is used by CloudCPA staff to provide bookkeeping, reconciliation and month-end close services, and by our clients to submit bills and invoices and to view the status of their books. It is not offered to the general public.

Information we collect

• Account information: name, email address, role, a hashed password, and two-step sign-in settings.
• Accounting data from Xero: when an authorised user connects a Xero organisation, we access that organisation's data through the Xero API, within the permissions granted. This can include the chart of accounts, contacts, invoices, bills, payments, bank transactions, manual journals and reports.
• Files you upload: bank statements (CSV or OFX), bills, invoices and supporting documents.
• Activity and audit records: sign-ins, approvals, rejections, edits, notes, and every change proposed to or posted in Xero, with the user and time.
• Technical information: IP address, browser type and server logs used for security and troubleshooting.

How we use information

• To provide the bookkeeping services you engaged us for: categorising and matching transactions, preparing entries for approval, running month-end close procedures, analysis and reporting.
• To secure the Service, prevent misuse, and keep an audit trail.
• To learn your organisation's own coding preferences (for example, bank rules created from reviewer corrections). These are kept per client organisation.

We do not sell personal information, and we do not use your data for advertising.

Artificial intelligence

The Service uses AI models from Anthropic (Claude) to suggest categorisations, review proposed entries, draft explanations and propose journal entries. Relevant data is sent to Anthropic's API only to generate those responses. We do not use your Xero data or other client data to train AI models, and under Anthropic's commercial terms, data sent through its API is not used to train its models. AI output is a suggestion: nothing is posted to Xero without approval under the permissions your firm has set, and every AI action is logged.

Who we share information with

We share information only with service providers that help us run the Service, under contracts that limit their use of it:

• Xero, to read and, with approval, write your accounting data;
• Google Cloud, for hosting, database and secret storage in the United States;
• Anthropic, for the AI features described above.

We may also disclose information if required by law, or to protect the rights and safety of our clients, our users or CloudCPA. As a CPA firm we also follow our professional confidentiality obligations.

Security

Data is encrypted in transit (TLS) and at rest. Xero access tokens are encrypted with AES-256-GCM, and keys are held in Google Secret Manager. All users must use two-step sign-in. Access is role-based, clients can only see their own organisation, and every change is recorded in an audit log.

Retention and deletion

We keep client data for as long as we provide services to you, and afterwards for as long as professional and legal record-keeping rules require. When a Xero organisation is disconnected, we stop accessing it and revoke our access tokens. You can ask us to delete your data at any time, subject to those record-keeping obligations.

Your choices and rights

You can ask to access, correct, export or delete your personal information, and you can disconnect the Service from Xero at any time from Xero's connected apps settings. To make a request, contact us at the address below.

Changes

We may update this policy. We will post the new version here with a new effective date, and tell clients of material changes.

Contact

Cloud Accounting Group, Inc. (CloudCPA)
Stuart, Florida
Email: info@thecloudcpa.net