LedgerFit

English · Español

Privacy Policy

JR Management Assistant LLC ("LedgerFit", "we", "us") · Last updated: October 20, 2026

1. Who we are

LedgerFit is an accounting and business management platform for small businesses, operated by JR Management Assistant LLC, a Texas limited liability company. This policy explains what data we collect through the LedgerFit application (app.ledgerfit.pro) and the ledgerfit.pro website, how we use it, and the choices you have.

2. Information we collect

  • Account information. Name, email address, and authentication identifiers, processed through our sign-in provider (Clerk), including Google sign-in if you choose it. If you enable two-step verification, the secret that generates your codes is stored encrypted.
  • Business and accounting data you enter. Company details, journal entries, vendors, checks, budgets, and related records. If you use the modules that need them, it also includes records about other people that your business keeps in LedgerFit: employees (payroll, time punches, and tips), job applicants who answer your job postings (their contact details and the resume they upload), and customers and their appointments (CRM and agenda).
  • Tax identification numbers. Where a feature requires them (for example, W-9 collection, 1099 e-filing, and payroll), we collect EINs, SSNs, or ITINs, handled as described in Section 3.
  • Banking details for checks. The bank routing and account numbers of the checkbooks you set up for check printing, handled as described in Section 4.
  • Bank account data via Plaid. If you connect a bank account, we receive transaction history and balances through Plaid Inc. We do not receive or store your online banking credentials. Plaid's collection and use of your data is described in the Plaid End User Privacy Policy.
  • Signature records. When a document is signed through our signature provider (DocuSeal), we receive and keep the signed document and its completion certificate, which includes the signer's name, email address, and technical metadata of the signature.
  • Support conversations. If you use the in-app support chat, your name, email address, the page you wrote from, and the messages you send are processed by tawk.to, our live-chat provider, and are visible to JR Management support staff.
  • Assistant conversations. Questions you ask Arva and its answers are stored so your history is there when you return. They are visible only to you within your organization and are deleted automatically after 90 days.
  • Files you upload. Receipt images (processed for text extraction by AWS Textract and stored in AWS S3), attachments, spreadsheets you import into your journal, and documents you upload to import features (see Section 6).
  • CRM files. If you use the CRM, the files that your business and its clients upload (job photos, PDFs, and documents) attached to quotes, invoices, and the client portal. They are stored in AWS S3, encrypted in transit and at rest by the provider. They are visible to your business and, according to the visibility switches you set in the client portal, to the client they belong to; never to other clients or other businesses. They are kept until your business or the client who uploaded them deletes them, or until your organization's data is deleted as described in Section 10.
  • Prelaunch and marketing forms. If you join a waitlist on ledgerfit.pro, we collect the email address you submit and the language of the page you used. The form is protected against bots by Cloudflare Turnstile.
  • Subscription data from JR Management. If your access was purchased through the JR Management client portal, we receive your name, email address, preferred language, and plan level from that portal in order to provision and maintain your account.
  • Payment data. If you subscribe directly, your card details are collected and stored by Stripe, our payment processor; we receive only the subscription status and a reference, never your full card number. Payments that your customers make to your business through the CRM or the point of sale are also processed by Stripe, in the connected Stripe account of your own business (Stripe Connect); we receive the result of each payment, never the full card number.
  • Usage and error data. Aggregate technical diagnostics (Sentry) to fix defects. Our error reporting is configured to redact tax identification numbers, account numbers, and credentials before any event leaves our systems.

3. Tax identification numbers

Social Security numbers, ITINs, and EINs are collected only where a feature requires them, such as W-9 collection, 1099 e-filing, and payroll. They are encrypted at the application layer with AES-256-GCM before being stored, are displayed masked after entry, and are excluded from error reporting; they appear in full only in the documents and files that require them, such as official tax forms and the state wage report file. They are never sent to our AI provider. They leave LedgerFit only when you start an action that requires them: to our e-file provider (TaxBandits) when you initiate a filing, a W-9 request, or a TIN verification with the IRS, and to our signature provider (DocuSeal) when you send an employee's Form W-4 or Form I-9 for signature, because those official forms carry the number. Access to them inside LedgerFit is limited by role and recorded in the audit log.

4. Check and banking data

The account numbers of your checkbooks are stored encrypted at the application layer (AES-256-GCM), and only their last four digits are shown on screen; the routing number, which identifies the bank, is stored without that additional encryption. Both are rendered in full only into the check documents you generate. The Plaid tokens that keep a bank connection alive are stored encrypted as well. We never see or store your online banking credentials. Check custody events (printing, reprinting, delivery, voiding, reissuing) are recorded in the audit log of your organization.

5. How we use information

We use your data solely to provide the service: bookkeeping and reports, reconciliation of bank activity, check printing, tax worksheets and filings you initiate, AI-generated financial summaries (see Section 6), security, and support. We do not sell personal information, and we do not use your financial data for advertising.

6. AI features

LedgerFit includes an assistant ("Arva") and other AI features powered by Anthropic. What is sent to the AI provider depends on the feature:

  • Arva and its reports. Receives your questions and the earlier messages of the conversation, your business's name, financial figures, account names, and a summary of your active alerts. To answer, it can look up records of your organization and send them to the provider: transactions with their descriptions and the names of the vendors and employees on them, the last four digits of your bank accounts, your customers with their invoices, quotes, sales and balances, your appointments with the name of the employee who handles each one, your inventory with your purchases by vendor, payroll totals and payroll tax totals, the hours and tips of each employee by name, who is clocked in today, point of sale sales, checks, adjustments and tips with the name of the server or employee on each one, top-selling items, and recent changes in your organization with the email of the team member who made each one. Custom reports and the analytics reading send the same kind of figures and names.
  • Import help. When you import accounting data from a spreadsheet, receives the account names in your file with their totals, to suggest how to classify them.
  • Writing help. When you ask for a draft, receives your request and the details needed to write it: suggested terms and notes for a quote (the customer's name and the quote's line descriptions), a contract clause, or a job posting (your business's name and the job details).
  • Documents you upload. Three features send the complete file you choose to upload, including any image of it, to Anthropic as our processor. The Document Vault smart read uses it to classify the document and suggest its name, category, tags, and expiration. The statement verification step of imports uses the financial statements you attach to check their totals against your file. The express migration reads the figures of the income statement and balance sheet you attach to start your books. In all three cases the document travels as a whole and is used only for that classification, verification, or reading. Upload only documents you are comfortable processing this way, and redact identifiers you do not want to share (such as Social Security or account numbers) before uploading; the Document Vault and the statement verification step remind you of this before you choose the file. The structured sensitive fields stored in our database are never included in these requests.

The system never sends the AI provider the tax identification numbers, full bank account numbers, or verification secrets it stores as sensitive fields (Sections 3 and 4), nor biometric data. Text you type in a question or a request, and the description your bank sends with each transaction, reach the provider as written, so do not type identifiers there. Anthropic processes these requests to generate responses and does not use them to train its models. Your Arva conversations are stored so your history is available when you return, are visible only to you, and are deleted automatically after 90 days. AI output is informational and is not professional advice.

7. Security

Data in transit is protected with TLS 1.2+. Data at rest is encrypted, with application-layer AES-256-GCM encryption on the most sensitive fields (tax identification numbers, bank account numbers, connection tokens, and two-step verification secrets). Access is limited by role-based permissions, protected by optional two-step verification that fails closed, and sensitive operations, including check signing and custody, are recorded in an immutable audit log. We maintain a written Information Security Policy and review access periodically.

8. Service providers (subprocessors)

We rely on U.S.-based infrastructure providers under their own security commitments: Clerk (authentication), Neon (database, encrypted at rest), Vercel (hosting), Cloudflare (network, bot protection, and the Turnstile check on public forms), Plaid (bank connectivity), Anthropic (AI features, Section 6), Sentry (error monitoring), TaxBandits (tax e-filing, W-9 requests, and TIN verification that you initiate), DocuSeal (signature ceremonies), Google Maps Platform (address autocomplete and drive times between appointments in the agenda), Stripe (subscription payments and, through Stripe Connect, the payments your customers make to your business), Resend (transactional email), AWS (document storage and receipt text extraction), Amazon Rekognition, an AWS service (face comparison for the optional time clock), Twilio (text messages), and tawk.to (support chat). Data remains in United States regions. We will update this list on this page as providers change.

Twilio receives only the phone number of the business's customer and the text of the message (Section 11). Today the only messages are payment links, with the business's name, the invoice or receipt number, the amount, the link, and, for a receipt, the date the link expires; they are sent only once that feature is enabled for the service. Amazon Rekognition receives, for an employee enrolled in the time clock as described in Section 13, the reference photo and the photo taken at clock-in, only to compare the two.

9. How we share information

We do not sell personal information. We share data only with the service providers listed above so they can perform their function; with the people you invite to your organization, according to the role you give each of them (for example, a read-only role for your CPA); with JR Management for accounts provisioned through its portal; when the law requires it; and, if the business is ever sold or reorganized, with the successor under this same policy, with notice to you.

10. Retention and deletion

We retain records according to our Data Retention and Disposal Policy: accounting records at least 7 years and tax records at least 4 years (IRS requirements). Bank data received through a connection is kept while that connection is active; when you disconnect a bank, its movements still pending review are deleted, and those already recorded in your books stay with your accounting records. Assistant conversations are deleted after 90 days.

What happens to your data after a cancellation depends on how you bought your plan. If you cancel a plan or module bought in the application, it stays active until the end of the billing period already paid. After that, the features of that plan or module turn off, and if it was your accounting plan your organization moves to the free Core plan; the cancellation does not delete your data. If your organization then exceeds a limit of the plan it keeps (for example, the number of businesses, bank connections, or users), you choose which ones stay active, and the rest become read-only, with their data intact and still visible in reports and exports, until you buy a plan again.

If your access was purchased through the JR Management client portal and that portal reports a cancellation, access to your organization is blocked from that moment and your data is kept intact for 60 days from the cancellation. When those 60 days end, we email the owner of the organization a link to download a complete export of its data, valid for 7 days. No sooner than 7 days after that email is sent, your organization's data may be permanently deleted from the service. If the portal reactivates your account before then, nothing is deleted.

You may request export or deletion of your data at any time; we honor requests within 30 days except for records we are legally required to keep, which are deleted when the legal period ends.

11. Notifications

We send operational email to the people in your organization whose role includes access to reports: an immediate notice for critical alerts (for example, a disconnected bank connection or a rejected tax filing), a daily summary of open items, and a monthly summary of the closed month. These are service messages tied to your account, not marketing. Each recipient receives them in the language set on their own profile.

SMS/Text messages. On behalf of the businesses that use LedgerFit, we send transactional text messages to their customers: invoice payment links, payment confirmations, appointment reminders, and restaurant reservation and waitlist notices (confirmation, reminder, cancellation, table ready). Consent is collected by each business directly from its customer, or by the customer checking an unchecked box on the business's online reservation or waitlist page, as described in our SMS Consent Policy at https://app.ledgerfit.pro/legal/sms-consent. Message frequency varies with the customer's activity with the business; message and data rates may apply. Recipients can reply STOP at any time to opt out and HELP for assistance, or contact info@jr-managementasst.com. Text messaging originator opt-in data and consent will not be shared with, or sold to, any third parties or affiliates for marketing or promotional purposes.

Promotions from a restaurant. A restaurant that uses LedgerFit can send you promotions by email or by text message only if you agree separately for each channel, through a checkbox that is unchecked by default and never required (on the online reservation page, the online ordering page, the page that opens when you scan the QR code to pay your check, or in person with the restaurant staff, who record it on your loyalty record). We store the date, where you agreed and the version of the text you agreed to. You can turn each channel off or ask "do not contact me" from your points page, reply STOP to a text message, or ask the restaurant; turning promotions off does not affect notices about your reservations or orders, which have their own consent. Your points do not change.

12. Your rights

You may access, correct, export, or request deletion of your personal information by contacting us at the address below. We honor for all users the rights of the Texas Data Privacy and Security Act: to know what personal data we process, to correct it, to delete it, to obtain a portable copy, and to appeal a decision on a request, and we respond within the timeframes that law sets. California residents may exercise rights under the CCPA; we do not sell or share personal information as defined by that law, and we do not discriminate for exercising rights.

13. Biometric data

LedgerFit's optional payroll time clock can verify an employee's identity at clock-in with a facial scan (processed through Amazon Rekognition). What is collected: one reference photo of the employee's face and, at each clock-in, a live image that is compared with the reference and not retained. It is used only to identify the employee when clocking in or out. A facial biometric is captured only after consent is recorded, in one of two ways: the employee gives it in the app, or a manager records it in the app after confirming that the employee signed a written consent, which the business keeps. We never sell, lease, or otherwise disclose biometric identifiers, except as reasonably necessary to provide the service or as required by law, and biometric data is not included in any data export. Reference photos are stored encrypted at rest (AES-256 server-side encryption, requested on every upload) and are never displayed in a browser: the only signed link involved is a short-lived upload link (5 minutes) used once to store the photo, and Amazon Rekognition reads the photo directly from storage to compare it.

We destroy an employee's biometric within a reasonable time after its purpose ends, and no later than the first anniversary of that date, consistent with the Texas Capture or Use of Biometric Identifier Act (CUBI): (a) when the retention period the business sets after the employee's termination ends (30 days unless the business chooses another period, never more than one year; if a termination has no date on record, the period counts from when the employee was marked as terminated or, if that was not recorded, from when our system first detects it); (b) when the business turns facial recognition off at the time clock: the clock stops comparing faces immediately and every reference photo of that business is destroyed, and turning it back on restores nothing (each employee consents and enrolls again); and (c) when the employee withdraws consent in writing. A withdrawal requested in the app takes effect immediately (the clock stops comparing the face) and the photo is destroyed when the business executes it, or automatically after 14 days; a withdrawal sent to the business in writing is executed by the business. A former employee's access to the app ends at termination, so they cannot withdraw in the app: their biometric is destroyed automatically when the retention period ends, and they can ask the business, or LedgerFit at the contact in Section 16, in writing to destroy it sooner. A business that enables the time clock is responsible for obtaining and retaining its employees' written consent; LedgerFit processes the data on the business's behalf.

14. Cookies

We use only cookies necessary to operate the service: authentication session cookies (Clerk); a signed device cookie for two-step verification ("remember this device"); a cookie storing your language preference; the session and security cookies of the client portal, for the customers of a business who sign in to it; and the cookies of the devices a business uses as its time clock, point of sale, or kitchen display, which identify an enrolled tablet or keep a browser in kiosk mode on the clock screen. The time clock also stores a random identifier of the device in the browser, so the business can see when a punch comes from a new device. Providers whose tools you open from LedgerFit, such as the support chat (tawk.to), the bank connection (Plaid), signatures (DocuSeal), and the bot check (Cloudflare Turnstile), may set their own cookies under their own policies. We do not use advertising or cross-site tracking cookies.

15. Children

LedgerFit is a business tool and is not directed to individuals under 18. We do not knowingly collect data from children.

16. Changes and contact

We will post any changes to this policy on this page with an updated date. This document is published in English and Spanish; if the versions differ, the English version controls. Contact: JR Management Assistant LLC, Kingwood, Texas. info@jr-managementasst.com