Privacy Policy

1. Introduction

Nupaid ("we", "us", or "our") operates the Nupaid platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

We collect information in the following ways:

• Account information — name, email address, and organization details you provide when you sign up via Clerk authentication.
• Financial data — invoices, bills, bank account connections (via Plaid), payment records, and other financial information you enter or connect to the platform.
• Usage data — pages visited, features used, timestamps, and device/browser information collected automatically via server logs.
• AI interactions — queries you submit to the AI Copilot feature, which are processed by OpenAI and not stored beyond the session.

3. How We Use Your Information

• Provide, maintain, and improve the Service
• Process financial transactions and generate reports
• Send transactional emails (invoice notifications, payment confirmations)
• Respond to support requests
• Enforce our terms of service and comply with legal obligations
• Detect and prevent fraud or unauthorized access

4. Data Sharing & Third Parties

We do not sell your personal information. We share data only with the following categories of service providers, solely to operate the platform:

• Supabase — database hosting and authentication infrastructure
• Clerk — user authentication and session management
• Stripe — payment processing and treasury services
• Plaid — bank account linking and transaction data
• OpenAI — AI-powered financial insights (queries are not stored by OpenAI beyond processing)
• QuickBooks / Xero — accounting integrations (only when explicitly connected by you)

5. Data Retention

• Financial records (invoices, bills, journal entries) are retained for 7 years per accounting regulations.
• Audit logs are retained indefinitely for compliance and security.
• Session data is managed by Clerk with short-lived JWTs (5–10 minute lifetime).
• Push notification subscriptions are automatically cleaned up when they expire.

6. Data Security

We implement industry-standard security measures including Row Level Security (RLS) on all database tables, encrypted connections (TLS), strict Content Security Policies, rate limiting, and comprehensive audit logging. Access to production systems is restricted and monitored.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Export your data in a portable format (available via Settings → Data Export)
• Withdraw consent for optional processing

Organization owners can export all org data at any time from the account settings page.

8. Cookies & Tracking

We use essential cookies for authentication and session management. We do not use third-party advertising trackers. Analytics, if enabled, use privacy-respecting methods without cross-site tracking.

9. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the effective date above.

11. Contact Us

If you have questions about this Privacy Policy or your data, please contact us at privacy@nupaid.com.