Privacy Policy

1. Who we are

C Books (the “Service”, at cbooks.dev) is a product of, and is operated by, Goldi Apple LLC, a Wyoming limited liability company at 30 N Gould St #42214, Sheridan, WY 82801, USA. Goldi Apple LLC is the controller of the personal data described in this policy, which explains how we collect, use, protect and share it. Information about other people that you record in your books (for example your customers, vendors and employees) is yours to manage: we process it on your behalf to provide the Service. By using the Service, you agree to this policy.

2. Information we collect

• Account information: your e-mail address, name, optional company name, language and time zone, and your password, stored only as a one-way hash.
• Google sign-in: if you sign in with Google, your name, e-mail address and profile picture. We never receive your Google password.
• Your financial data: books, accounts, entries, customers, vendors, invoices, bills, bank records, inventory, files you upload and other content you enter.
• Connected services: when you connect a bank, a broker or QuickBooks Online, or import a file, the accounts, transactions or ledger data you allow. Credentials you give for a connection are stored encrypted.
• AI conversations: the messages, documents and files you send to the AI, and what the AI produces while it works on your books.
• Payment information: your plan orders and their status. Stripe processes payments; we receive the payment status, amount and a reference, never your full card number.
• Usage records: activity and error logs, IP addresses, and browser and device information.

3. Why we use information, and our legal bases

Where the law requires a legal basis (for example Article 6 of the EU or UK GDPR), we rely on the following:

• Contract: to create and run your account; keep your books, make reports and sync the services you connect; provide the AI features you use; take payments; send service e-mails such as verification codes and plan reminders; and answer support requests.
• Legitimate interests: to keep the Service secure, prevent abuse and fraud, investigate errors and improve the Service. You can object to this processing (section 10).
• Legal obligation: to keep accounting and tax records and to respond to lawful requests from authorities.
• Consent: where the law requires it for a particular processing; you can withdraw it at any time, which does not affect processing that took place before.

4. How AI processes your content

• When you use AI bookkeeping (what you type, receipt photos, voice notes and files), what you send is passed through V-API (api.gpt.ge), an AI gateway whose servers are in the United States, to OpenAI and Google (Gemini), which read it and draft the entry. When you use the finance AI, your messages, the parts of your books it needs to answer and the documents you give it are sent to AI providers in the United States (Anthropic and OpenAI) to produce the answer; the finance AI works in an isolated environment (sandbox) run by E2B in the United States, which keeps its working files only while it works on your request.
• Goldi Apple LLC does not train or fine-tune any AI model on your data. Our AI providers process it under their own terms.
• Please do not send the AI sensitive personal data, or other people’s personal data, unless the task needs it.

5. Service providers and disclosure

We do not sell your personal information or use your financial data for advertising. We share information only with the service providers below, which process it for us to the extent necessary; with the C Books team when you allow platform access to a book; with the services you choose to connect; where the law requires it or it is needed to protect the safety of users and the public; and in a merger or acquisition, under this policy.

• Google Cloud (Taiwan): hosts our servers, database, uploaded files and encrypted backups.
• Cloudflare (worldwide network): delivers and protects cbooks.dev.
• Anthropic and OpenAI (United States): AI models for the finance AI; OpenAI’s models also for AI bookkeeping, through V-API.
• V-API (api.gpt.ge, servers in the United States): an AI gateway that passes AI bookkeeping requests on to OpenAI and Google.
• E2B (United States): runs the AI’s isolated working environment.
• EngageLab (Singapore): sends our e-mails, such as verification codes and plan reminders.
• Stripe (United States): processes card payments and prevents fraud. Your card number goes directly to Stripe.
• Google (United States): Sign in with Google, if you choose it; the Gemini AI model, which reads receipt photos for AI bookkeeping, through V-API; and our company e-mail (Google Workspace), where messages to [email protected] arrive.
• Services you connect: banks, brokers and Intuit (QuickBooks Online) receive what is needed to read the data you asked us to bring in.

6. International transfers

Goldi Apple LLC is a US company and our providers are in several countries, so your data is processed outside the country where you live: mainly in Taiwan (our servers and database), the United States (AI providers and the AI gateway, the AI’s working environment, payments and sign-in) and Singapore (e-mail delivery), and on Cloudflare’s worldwide network. Where your law requires a safeguard for these transfers, we rely on the EU–US Data Privacy Framework for US providers certified under it, on the Standard Contractual Clauses in our providers’ data processing terms where they offer them, and otherwise on the necessity of the transfer to provide the Service you asked for. You can ask for more information at [email protected].

7. How long we keep data

We keep personal data only as long as we need it, then delete it:

• Account and books: while your account is open. When a paid plan ends, your data stays.
• When you delete your account: after you ask, your account stays open for 30 days so you can change your mind. Then we delete your personal details (such as your name, e-mail address and sign-in) and stop your plan. You can download a copy of your data before you delete your account.
• Books and billing records after deletion: the books you own, with everything in them (including the customers and vendors you recorded), and your orders are frozen, no longer linked to your personal details, and kept until 7 years after the deletion for accounting and tax record-keeping; then they are deleted.
• AI conversations: conversations with the finance AI are kept until you delete them; any still there when your account is deleted are deleted when you ask at [email protected]. Requests to AI bookkeeping and the drafts they made belong to the book and are kept with it.
• Logs: kept for a limited period for security and troubleshooting, normally no longer than 180 days.
• Database backups: encrypted, and kept for 30 days.
• We may keep data longer where the law requires it or to establish or defend legal claims.

8. Data security

We take reasonable technical and organisational measures, including HTTPS encryption in transit, passwords stored only as salted one-way hashes, encryption of connection credentials, keeping each book apart so only the people it allows can reach it, access for staff only where it is needed to run the Service, and daily encrypted database backups. No system is completely secure; if a security incident affects your personal data, we will notify you and the authorities as the law requires.

9. Cookies and local storage

cbooks.dev uses only what is strictly necessary to run it, such as keeping you signed in and remembering your language, and no analytics or advertising cookies. The cookie policy lists them.

10. Your rights

Depending on where you live, you have the right to access your personal data and get a copy of it, to correct it, to delete it, to receive it in a portable format, to restrict or object to its processing (including processing based on our legitimate interests), and to withdraw your consent at any time.

• Ask us: e-mail [email protected] from your account’s e-mail address. We may ask you to confirm your identity. We do not charge a fee, and we reply within the time your law sets, or within 30 days where it sets none. You can correct your profile yourself on the Account page.
• Complain: you also have the right to complain to the data protection authority of the country where you live or work.

11. Children’s privacy

The Service is intended for businesses and is not directed at children under the age of 16. If we discover that we have collected information from a child, we will delete it as soon as possible.

12. Changes to this policy

We may update this policy and will publish the new version on this page with a new date. For important changes we will also tell you by e-mail or in the Service.

13. Contact us