Privacy Policy

Last updated October 22, 2026

This policy explains what information Dulybook ("Dulybook," "we," "us") collects, how we use it, who helps us process it, and the choices and rights you have. Dulybook is a website that helps small business owners track their tax, filing, license, and renewal deadlines, keep simple books, and send invoices.

The short version

• We use your information to run Dulybook for you. We don't sell it for money.
• On our public pages only (sign-up and sign-in, Terms, and Privacy), we use the Meta Pixel to measure our ads. California law may treat that as "sharing," and you can opt out. It never runs inside your account.
• Sensitive business numbers (like your EIN), assistant chats, and details read from your documents are encrypted before they're stored.
• Card and bank account numbers are handled by Stripe, for your plan and for invoice payments. We never see or store them.
• Your data isn't used to train AI models.
• You can download your data or delete your account at any time, right inside Dulybook.

Information we collect

Information you give us

• Account details: your email address and password (stored only as a scrambled hash), or your basic Google profile (name and email) if you sign in with Google.
• Business details: your answers during setup (business name, type, formation date, location, how you operate, licenses) and ID numbers such as your EIN, Secretary of State entity number, seller's permit, and city tax certificate number.
• Your records: deadlines you mark as filed and their confirmation numbers, deadlines you add, transactions, bank balances you enter, recurring bills, vehicles, insurance and lease dates, and invoices.
• Your clients' details: names, emails, phone numbers, and addresses of the people and companies you bill. You're responsible for having the right to share this information with us.
• Files you upload: documents, receipts, tax and government letters, and your logo.
• Assistant conversations: questions you ask and files you share with the AI assistant.
• People you share with: if you invite your accountant or bookkeeper, their name and email, what you let them see, and when they last viewed your records. If you were invited, the business owner can see your name, email, and when you last viewed their records.
• Your accountant's name and email, if you add them to send your year-end packet.
• Messages to us, such as support emails.

Information collected automatically

• Sign-in cookies that keep you signed in. Inside your account, we don't use advertising or tracking cookies.
• Meta Pixel (public pages only: sign-up and sign-in, Terms, and Privacy): which of these pages you visited, whether you created an account, and the technical details Meta's code collects, such as your IP address, browser, device, and Meta cookies. It doesn't run inside your account, so Meta never receives your deadlines, books, invoices, documents, or business numbers. It's off if you opt out or your browser sends the Global Privacy Control signal.
• Visitor statistics (Vercel Web Analytics): pages viewed, referring site, country, and device type, collected without cookies and without building a profile of you. Admin pages and anything after the "?" in a web address are removed before sending.
• Error reports (Sentry): technical details when something breaks. We remove names, emails, IP addresses, cookies, and form contents before they're sent, and we don't record your screen.
• Server and email delivery logs kept by our providers for security and troubleshooting.
• AI usage counts (for example, how many questions you asked this month), to apply plan allowances.

Information from others

• Stripe tells us your subscription status, plan, and payment history (not your card number).
• Stripe, if you turn on online invoice payments: whether your Stripe account can accept payments, and for each invoice payment, its amount, date, status, and Stripe's fee (not card or bank numbers).
• Google provides your name and email if you choose Google sign-in.

Cookies and similar technology

We use only a few cookies. You can block or delete cookies in your browser, but you'll need the sign-in cookies to use your account.

Visitor statistics (Vercel Web Analytics) and error reports (Sentry) don't use cookies. We don't show a cookie banner because, apart from the Meta Pixel, these cookies are needed to run Dulybook or remember your own settings. For the Meta Pixel, you can opt out at any time on Do Not Sell or Share My Personal Information.

How we use information

• To provide Dulybook: build your deadline calendar, send reminders, show filing guides, keep your books, create and send invoices, and run the AI features.
• To bill you and manage your plan through Stripe.
• To keep Dulybook secure and prevent abuse, including limiting free trials to one per business (see below) and limiting email sending.
• To provide support and send service messages (for example, reminders, receipts, and important account notices).
• To fix problems and improve Dulybook, using error reports and statistics that don't identify you.
• To measure and improve our ads on Facebook and Instagram, using the Meta Pixel on our public pages.
• To comply with the law and enforce our Terms of Service.

We don't sell personal information for money. The Meta Pixel on our public pages may count as "sharing" for cross-context behavioral advertising under California law, and you can opt out at any time. Nothing from inside your account is shared for advertising. We use sensitive information (like business ID numbers) only to provide Dulybook to you.

One free trial per business

To stop the same business from signing up again for repeated free trials, we store a one-way fingerprint (a keyed hash) of your email address and of your EIN and Secretary of State entity number when you enter them. A fingerprint can be compared with another, but it can't be turned back into the original number or email. If a fingerprint matches one from another account, that account doesn't get a new free trial and may be reviewed. We keep fingerprints after an account is deleted, without any link to the deleted account, for this purpose only.

AI features

When you use the assistant, the notice decoder, receipt scanning, or document auto-fill, the relevant text, file, and the business information needed to answer are sent to our AI provider, Anthropic, to produce a response. Under Anthropic's commercial terms, this information isn't used to train its models and is kept only for a limited time for safety and abuse monitoring. We filter Social Security numbers and bank account numbers out of AI results. AI responses can be wrong; check anything important yourself. Plans include monthly AI allowances (for example, 100 assistant questions a month on Plus).

Online invoice payments

If you turn on online payments, Stripe opens a Stripe account for your business. We send Stripe your business name and email to start it; Stripe then collects your identity, business, and bank details directly, under its own privacy policy. We keep only your Stripe account ID and whether it's ready to accept payments.

For your clients: each invoice's Pay online link opens a page that shows only your business name, the invoice number, the amount, the due date, and a copy of the invoice. When a client pays, we send Stripe the invoice number, the amount, and the client's email from the invoice, so Stripe can email them a receipt. The client enters their card or bank details on Stripe's page, never on Dulybook. Stripe processes that payment under its own privacy policy, and tells us only the result.

Who helps us run Dulybook

We use these service providers. They may process your information only to provide their service to us.

We also share information when you ask us to (for example, emailing an invoice to your client, sending your year-end packet to your accountant, giving your accountant read-only access to the records you choose, or setting up online payments with Stripe), to comply with the law or protect rights and safety, or as part of a merger or sale of the business, in which case this policy would continue to apply to your information.

Reminder texts and notifications

If you turn on reminder texts, we keep your mobile number, when and how you agreed, and whether you've stopped. We use your number only to send the reminders you asked for, through our text provider (Twilio). We don't sell or share your mobile number or your text consent with anyone for their marketing, and we don't send marketing texts. If you turn on phone or computer notifications, we keep the address your browser gives us to deliver them (not your phone number), and remove it when you turn them off.

How we protect information

• All connections use HTTPS. Stored data is encrypted by our providers, and we add our own encryption for business ID numbers, assistant chats, and details read from documents.
• Each account can only reach its own data. Uploaded files are private and opened only through short-lived links.
• Our admin tools require two-step sign-in and show account and billing information only, not your books, files, invoices, or chats. We look at your records only if you ask us to for support, or if the law requires it.

No system is perfectly secure, but we work to protect your information and will notify you as required by law if a breach affects it.

How long we keep information

• We keep your information while your account exists, including after a plan ends, so you can come back or download it.
• When you delete your account, we delete your account and records right away. Copies in our encrypted backups are removed as backups age out, within about 12 weeks.
• Stripe keeps payment records as required for tax and accounting. Email providers keep delivery logs for a limited time.
• We may keep limited information longer when the law requires it or to resolve disputes.

Your choices and rights

• Download your data: Plan and billing → Download my data (spreadsheets, tax packets, calendar, and your files).
• Correct your information: edit it in Dulybook at any time.
• Delete your account: Profile → Delete my account, or email us.
• Erase only some records: Profile → Start fresh.
• Emails: change or turn off reminder emails in Profile. We'll still send essential account and billing messages.

California residents

California law gives you the right to know what personal information we collect and how we use and disclose it; to access, correct, and delete it; to opt out of its sale or sharing (we don't sell it; to opt out of the sharing described above, use Do Not Sell or Share My Personal Information, and we also honor the Global Privacy Control signal); to limit the use of sensitive personal information (we use it only to provide Dulybook); and not to be treated differently for using these rights. To make a request, use the tools above or email privacy@dulybook.com. We'll verify your request by confirming it comes from your account's email address. You may use an authorized agent, who will need your written permission.

Children

Dulybook is for businesses and isn't meant for anyone under 18. We don't knowingly collect information from children.

Changes to this policy

We'll post any changes on this page and update the date above. If a change is significant, we'll let you know by email or in Dulybook before it takes effect.

Questions? Email support@dulybook.com. Privacy requests: privacy@dulybook.com. Do Not Sell or Share My Personal Information