Privacy Policy

01Who this covers

This policy describes how [legal entity] ("Scotty", "we") handles personal and business information when you visit scottyai.com or use the Scotty application. It applies to visitors to the website, people who start a trial, and the businesses and their staff who use Scotty to keep their books.

If your accounting firm gave you access to Scotty under their own brand through our partner program, this policy still describes how the underlying software handles your data, but your contract is with the firm and their own privacy notice applies alongside this one.

02What we collect

Information you give us

• Account details: name, business name, email address, and password.
• Billing details, collected and stored by our payment processor ([payment processor]). We do not store full card numbers.
• Anything you type into Scotty, including transaction descriptions, notes, categories, contacts, invoices and the corrections you make to the agent's suggestions.
• What you send us in a form on this website, a support message, or a demo request.

Information we collect automatically

• Log and device data: IP address, browser and operating system, pages viewed, and timestamps.
• Product usage: which features are used, and whether an agent suggestion was approved, edited or rejected. This is how Scotty learns your preferences.

Information from connected accounts

• Bank and card transaction data, retrieved through Plaid when you connect an account.
• Accounting history you choose to import, including from QuickBooks: chart of accounts, transactions, contacts, invoices and open balances.

03Bank and accounting data

Bank connections run through Plaid. When you connect an account, you authenticate with your bank through Plaid rather than giving Scotty your banking username and password. Scotty does not see or store your bank login credentials.

Your books are yours. We do not sell financial data, we do not broker it, and we do not share it with advertisers or data aggregators.

04How we use it

• To run the service: categorize transactions, reconcile accounts, draft invoices, follow up on receivables, and produce your reports.
• To remember your corrections, so the same transaction is not miscategorized twice.
• To authenticate you, bill you, and provide support.
• To keep the service secure, detect abuse, and meet our legal and tax obligations.
• To improve the product in aggregate, using data that does not identify you or your business.

We do not use your books to train third-party AI models, and we do not make your financial data available to a model provider for training purposes.

05Automated processing

Scotty is an agent. It reads your transactions and proposes what to do with them, which means your data is processed automatically as a matter of course. Three limits apply, and they are enforced in the software rather than promised in a policy:

• Drafting and sending are separate operations, and the agent only has the first one. Nothing leaves your business without a person approving it.
• The agent cannot move money.
• The agent cannot change your login credentials without named human confirmation.

No decision with a legal or similarly significant effect on you is made solely by automated means. Every consequential action is presented for approval first, and you can edit or reject it. If you are in a jurisdiction that gives you a right to human review of automated decisions, that right is satisfied by the approval step and you can also contact us at [privacy@ email].

06Who we share it with

We share data with service providers who help us run Scotty, under contracts that limit them to that purpose. The current categories are:

• Bank connectivity: Plaid.
• Hosting and database: [hosting provider and region].
• Payments: [payment processor].
• Email and customer messaging: [email and CRM providers].
• Model providers that power the agent, on a no-training basis: [model provider list].

We also share data when you tell us to, such as inviting your accountant to a seat, and when we are legally required to. If we are ever compelled to disclose your data, we will tell you unless we are prohibited from doing so.

If Scotty is acquired or merged, your data may transfer as part of that transaction. You will be told before it does, and this policy continues to apply until you are given notice of a new one.

07How it is protected

• Data is encrypted in transit and at rest.
• Each organisation's data is isolated, and that isolation fails closed. If the software cannot positively resolve which organisation a request belongs to, it denies the request rather than guessing.
• Access to production data by our staff is limited to what support and operations require, and is logged.

No system is perfect. If we become aware of a breach affecting your data, we will notify you and any regulator we are required to notify, within the timeframe the law requires. Report a suspected vulnerability to [security@ email].

08How long we keep it

We keep your account and financial records for as long as your account is active. After you close it, we retain your books for [retention period] so you can export them or reopen the account, and then delete or anonymise them.

Some records are kept longer where the law requires it, such as billing and tax records. Backups are cycled out on their own schedule, so deleted data can persist in backup for a short period after removal from the live system.

09Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, get a portable copy, object to or restrict certain processing, and withdraw consent. You can export your books from inside Scotty at any time without asking us.

To make any other request, contact [privacy@ email]. We will verify your identity before acting, and we will not treat you worse for making a request.

If you are in the EU or UK

Our lawful bases are performance of a contract (running the service you signed up for), legitimate interests (security, product improvement, and direct marketing to businesses), consent (optional cookies and marketing email where required), and legal obligation. You can complain to your local supervisory authority. Our representative is [EU or UK representative].

If you are in California

We do not sell personal information and we do not share it for cross-context behavioural advertising. You have the rights described above, and you may use an authorised agent.

10Cookies and analytics

We use cookies that are strictly necessary to sign you in and keep your session secure. Those cannot be turned off without breaking the product.

We also use [analytics provider] to understand how the website and product are used. Where consent is required for non-essential cookies, we ask for it before setting them, and you can change your mind at any time.

11Marketing

If you give us your details on this website, we may email you about Scotty. Every message has an unsubscribe link and unsubscribing does not affect your account or your books.

Form submissions from this website are stored in our customer relationship system so we can follow up. We do not sell your contact details.

12Children

Scotty is business software and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact [privacy@ email] and we will delete it.

13International transfers

Scotty is operated from [country] and your data may be processed there and in any region where our providers operate. Where data leaves the EU or UK, we rely on [transfer mechanism, e.g. Standard Contractual Clauses].

14Changes

We will update this policy as the product changes. The date at the top always reflects the current version. If a change materially affects how we handle your data, we will tell you by email or in the product before it takes effect.

15Contact

Privacy questions and requests: [privacy@ email]
Security reports: [security@ email]
Postal: [legal entity and registered address]

See also the Terms of Service and the Security page, which describes the architecture behind the limits referenced here.