Privacy Policy

1. Introduction

ERP Sync is operated by Silo Solutions, Inc. ("Silo Solutions," "we," "our," or "us"). ERP Sync is an accounting and financial reporting platform for businesses and the accountants who work with them, available at erpsync.silosinc.com (the "Application"). This Privacy Policy explains what information we collect, how we use and share it, how long we keep it, and the choices you have.

The Application is intended for business use. Our users are people who access the Application on behalf of a company, such as owners, controllers, bookkeepers, and outside accountants.

2. Information We Collect

2.1 Account information

When you are invited to or create an account, we collect your name, email address, and password (stored only in hashed form), the companies you can access, and the role and permissions you hold for each.

2.2 Data from connected business systems

When you or your organization connect a business system, such as QuickBooks Online, NetSuite, Microsoft 365, or Google, we receive and store the access tokens needed to connect and the data you authorize us to access. For an accounting system, that is a copy of the company's books, which we keep in sync in our own database, hosted by our service provider Supabase, so the Application can report on it and work with it. This can include company details, the chart of accounts, customers, vendors, invoices, bills, journal entries, transactions, reports, and documents.

2.3 QuickBooks Desktop

If your organization uses QuickBooks Desktop, the company file itself stays on your own computer or network. To connect it, someone in your organization installs our bridge app on a computer where QuickBooks Desktop runs. The bridge connects to us over an encrypted connection and works with a company file only while that file is open in QuickBooks on that computer.

Your organization chooses one of two setups. With full sync, we keep a copy of the company's books in our database, as we do for QuickBooks Online and NetSuite. With lists only, we keep only the company's lists, such as accounts, customers, vendors, and items, and read transactions from the company file when you ask for them, without keeping a copy of its ledger; bank transactions retrieved through Plaid are held only until they are reviewed, as described in Section 7. When you direct us to, for example by accepting a categorized bank transaction, we record it in the company file through the bridge, where it becomes part of your books under your control.

2.4 Bank and card account data (through Plaid)

If you choose to connect a bank or credit card account, we use Plaid Inc. ("Plaid") to do so. Through Plaid we receive:

• The financial institution name, and the name, type, and subtype of each account you select
• The last four digits of the account number (not the full account number)
• Current and available balances
• Transaction history, including dates, amounts, descriptions, merchant names, and categories

We never receive or store your online banking username or password. You enter those only in Plaid's interface. We do not use Plaid to move money or initiate payments.

2.5 Files you upload

Documents you upload, such as statements, invoices, and receipts, and the text we extract from them so they can be searched and matched to your records.

2.6 Usage and security data

We automatically collect information about how the Application is used, such as sign-in times, IP addresses, browser type, and the features you use. We also keep records of security events, such as sign-ins and verification codes issued, to protect your account.

3. How We Use Information

We use the information we collect only to:

• Provide the Application, including syncing, categorizing, and reporting on your financial data
• Import bank and card transactions, match them to your general ledger, reconcile accounts, and produce cash reports
• At your direction, record categorized transactions in your accounting system, including a QuickBooks Desktop company file on your own computer
• Authenticate you, including asking for a code from your authenticator app before sensitive actions such as connecting a bank account
• Secure the Application, prevent fraud and abuse, and investigate security incidents
• Provide support and send service-related messages
• Comply with legal obligations

We do not use your financial data for advertising, and we do not use it to build profiles of individuals.

4. How We Share Information

We do not sell your personal information or financial data, and we do not share it for advertising. We share information only as follows:

• Within your organization: with other users your organization has authorized to access the same company in the Application, according to the permissions they hold.
• With systems you direct us to: for example, when you post a categorized transaction to QuickBooks Online or NetSuite, or into your QuickBooks Desktop company file through the bridge app on your computer.
• With Plaid: to establish and maintain your bank connections, as described in Section 5.
• With service providers that process data on our behalf under contract and only to operate the Application: Supabase (database and hosting), Vercel (application hosting), Resend (email delivery), Cloudflare (bot protection at sign-in), Google Cloud (text extraction from uploaded documents), and OpenAI (indexing document text for search). Our AI service providers process data through their business APIs and do not use it to train their models.
• With AI assistants you connect: if you connect an AI assistant, such as Claude, to the Application, it can access data within your permissions when you ask it to. That provider's own privacy policy governs its handling of that data.
• For legal reasons: when required by law, subpoena, or court order, or to protect the rights, property, or safety of our users or others.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Privacy Policy, with notice to you.

5. Plaid

We use Plaid to gather your data from financial institutions. By connecting an account through Plaid, you acknowledge and agree that information about you will be treated in accordance with Plaid's End User Privacy Policy, available at https://plaid.com/legal/#end-user-privacy-policy.

You can disconnect a bank account in the Application at any time. You can also review and remove the connections Plaid holds for you at my.plaid.com.

6. Data Security

We protect your information with safeguards that include:

• Encryption of all data in transit using TLS 1.2 or higher
• Encryption of all stored data at rest using AES-256, including backups
• Bank connection tokens that are additionally encrypted within the Application, kept on our servers, and never sent to your browser
• A code from an authenticator app on your phone, which you must enter before connecting, reconnecting, or disconnecting a bank account
• Role-based permissions and database-level separation between companies
• Restricted, multi-factor-protected administrative access, reviewed quarterly
• Ongoing vulnerability monitoring and patching of the software we use

No system is completely secure. If we learn of a security incident affecting your information, we will notify you as required by law.

7. Data Retention and Deletion

We keep information only as long as needed to provide the Application or as required by law.

• Bank connections: when you disconnect a bank account, we revoke the connection at Plaid and delete its access token, and within 30 days we delete the account and transaction data we retrieved through it. If you stop sharing a single account through Plaid, we delete that account's data within 30 days as well. For a QuickBooks Desktop company that syncs lists only, we hold each bank transaction only while it waits for review; once it is matched to a transaction in your company file or recorded there, we keep only Plaid's identifier for it, so it is not imported again, and delete its details. Transactions you have already recorded in your books at your direction, such as entries posted to QuickBooks or NetSuite, are part of your books: they stay in your accounting system (for QuickBooks Desktop, your own company file) and, where we keep a synced copy of your books, in that copy, which we keep as described in the next item.
• Synced copies of your books and other connected systems: we keep the copy of a company's records synced from QuickBooks Online, NetSuite, QuickBooks Desktop (full sync), or another connected system for as long as the company remains in the Application. When a company is deleted, from the Application or at your request, we delete its synced records and access tokens within 30 days.
• Your account: when your account is closed, or when you ask us to delete it, we delete your account information within 30 days.
• Backups and legal holds: residual copies in backups are overwritten on their normal schedule. We may retain information longer where the law requires it.

8. Your Rights and Requests

You can ask us to:

• Access the personal information we hold about you
• Correct inaccurate information
• Delete your information, including the data retrieved from your bank accounts
• Export your information in a portable format
• Disconnect any bank account or connected system at any time

To make a request, email support@silosinc.com from the address on your account. We will verify your identity and respond within 30 days. If your access to the Application is provided by an organization, such as your employer, we may refer your request to that organization and assist it in responding. We will not discriminate against you for exercising these rights.

9. Other Services

The Application connects to services operated by others, including Intuit QuickBooks Online and QuickBooks Desktop, Oracle NetSuite, Microsoft 365, Google, and Plaid. Your use of those services is governed by their own terms and privacy policies, for example Intuit's at https://www.intuit.com/privacy/.

10. Children's Privacy

The Application is not intended for anyone under 18 years of age. We do not knowingly collect personal information from children.

11. Where Data Is Processed

We store and process data in the United States. If you access the Application from elsewhere, your information will be transferred to and processed in the United States.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and change the "Last updated" date. If we make material changes, we will notify you by email or in the Application before they take effect.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us:

Silo Solutions, Inc.
Privacy requests and questions: support@silosinc.com
Security concerns: security@silosinc.com