QUARTERLY

Privacy Policy

Effective November 1, 2026 · Contact: help@quarterlybooks.com

Quarterly provides scheduling, booking and bookkeeping software. This includes appointments, invoicing, payments and bookkeeping for businesses that schedule time with their clients. It is operated by Synact LLC (“we,” “us,” “Quarterly”). This policy explains what data is held in the software, who has access to it, and what you can do about it.

The short version. The data that you enter belongs to your business. We hold it so the software can work. Section 5 of the Terms sets out when our systems, and sometimes a person here, can reach it, what we may do with it, and the log we keep of that access. We do not sell it, we do not use it for advertising, and we never commingle business records. You should note that until you set up your own email sending address, your mail goes out through a mailbox we operate, with replies routed back to it. Some features send content to AI providers to read a receipt or classify a transaction; section 5 says exactly which, and you can leave those features alone.

1. Our relationship is with you, not your clients

Quarterly is sold to you, and you then use it to serve your customers. As a business (an owner, a member of staff, an administrator), we hold your account and your business’s records, and this policy describes what we do with them. You decide what to collect from your customers, and it is held on your instructions; section 5 of the Terms sets out the limited circumstances in which we reach it. You alone are responsible for compliance with any local, state or federal laws which address privacy, and you understand that Quarterly has no obligation to communicate with your customers as to these matters.

If you are a client of a business that uses Quarterly (you booked an appointment with them), the business decides what to collect about you, and asks us to hold it for as long as its account is open. The software has no setting that expires records on its own. We process it on their instructions. Ask them to correct or delete something and we will act on their instruction, though the records a business has to keep for tax and accounting, such as past appointments, invoices and payments, stay; if you contact us directly we will pass it to them, because it is not our record to change.

2. What we collect

Account information. Name, email address, and where you provide one a mobile number. For a member of staff we also hold a profile photo if one is uploaded, a short bio and job title, working hours and the dates marked as unavailable, and, where the mileage feature is used, that person’s home address, which is what a trip is measured from. Passwords are set and checked by our authentication provider, and we never store one. When a business signs itself up, the password it chooses passes through our server on its way to that provider and is not written down anywhere; everywhere else it goes straight from your browser to the provider.
Business records. What the business records in the software: clients, appointments, bookings, the address where off-site work takes place, availability, invoices, payments, expenses, receipts, mileage, an equipment register including serial numbers, staff pay arrangements, files and audio delivered to a client together with that client’s feedback on them, enquiries received through the booking page, and internal messages and notes.
Financial connections. If a business connects Stripe, it either connects its own Stripe account to Quarterly through Stripe, and we store that account’s identifier and the name Stripe shows for it, or gives us its own Stripe secret key, and we store the key and the signing secret for the webhook we register on that account. Either one is what lets the software raise an invoice, take a payment and issue a refund on that business’s own account. We also store the Stripe customer, invoice and payment identifiers the software creates. If a business connects its bank account, it does so through Plaid, and we store what Plaid returns about that account (the bank’s name, a display name and the last four digits), the transactions Plaid sends us, and the access token that lets us read them. A bank connection made earlier through Stripe keeps working, and for it we store Stripe’s own reference to that account and the transactions Stripe sends us. A bank connection is read-only: it lets the software read that account’s transactions, and it cannot move money, make a payment or start a transfer. We never see or store card numbers, bank sign-in details or full account numbers; those go straight to Stripe and Plaid. Where a business lets a client reserve without paying up front, Stripe stores that client’s card and we store Stripe’s reference to it, so the business can charge a no-show. We never see the card number.
Stripe activity. Once a day we read the connected Stripe account’s own record of every charge, refund, transfer, payout and fee, and keep it as a permanent ledger so the books can be checked against it. This includes payments taken on that account outside Quarterly.
Messages we send for you. For an announcement a business sends to its client list we keep the recipients, the subject, the message itself and any address that failed. For appointment reminders by text we keep only a short internal record that stops the same reminder going out twice, which names the staff member and the appointment rather than the person texted and is deleted after seven days. For a handful of automatic emails (an invoice reminder, an abandoned-checkout follow-up) we record on the invoice or booking that one was sent and when, so the same message is not sent twice; beyond that we keep no delivery log for email, and the providers in section 4 hold their own records.
Connected mailboxes. Only if a business chooses to connect one, for receipt scanning and for finding payments it has received. We read messages that look like receipts, invoices or payment notifications, which means we read the name of whoever paid. To do this we store the Gmail address and the app password you create at Google, encrypted, and check the mailbox once a day. Disconnecting deletes both, and you can revoke the password at Google anytime. We do not read the rest of the mailbox. From a message that matches, we keep the subject line, the details we extract from it, and a copy of any receipt or invoice attached to it, stored with the business’s own records; we do not keep the body of the message.
Connected calendars. Only if someone at the business chooses to connect their own Google, Apple or Outlook calendar by pasting its private link. We keep that link, encrypted, and read the calendar every 15 minutes: the start, end and title of each event from 90 days back to 90 days ahead. Only that person sees those events in the app. The booking page uses only their times, so clients cannot book that person when they are busy, and nobody else at the business sees them. Disconnecting deletes the link and the events. If that person leaves the business, both are deleted at our next check, which runs every 15 minutes while the business is subscribed and uses this feature.
Technical logs. Ordinary server logs from our hosting and database providers: request times, error traces, IP addresses. Used to keep the service running and to investigate problems.
How the app is used. A count, per member of a business’s staff and per day, of which screens of the app were opened. It records the name of the screen with every identifier stripped out and nothing from the records shown on it. We use it to decide what to build next, and it is never linked to a client record.
Feedback you send us. If you use Send feedback in the app, we keep what you wrote, your name and role, your business, which screen you were on with every identifier stripped out, the app version and whether you sent it from the web, the iPhone app or the desktop app, and we email all of that, with your plan, to our team. We use it to fix problems and decide what to build next. The copy we keep is deleted with your business’s account; the emailed copy stays in our team’s mailbox.

We do not collect precise device location, we do not use advertising trackers, and we do not run third-party analytics that profile you across other websites.

3. What we use it for

Running the software you asked for: showing a calendar, sending a reminder, raising an invoice, taking a payment, categorising an expense.
Billing you for your Quarterly subscription.
Supporting you when you ask for help, which sometimes means looking at a specific record you point us to.
Keeping the service secure, and investigating abuse or a suspected breach.
Meeting legal and tax obligations.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use one business’s records to build a product for anyone else.

That list is also a binding promise, not only a description. Section 5 of the Terms of Service holds us to those purposes and no others, says we will not approach a business’s clients, discloses that the people who run Quarterly also run recording studios that use it, and describes the log we keep of privileged access to the database. If you are a business using Quarterly, read it: it is the part of this you can hold us to.

4. Who else processes it

Quarterly runs on other companies’ infrastructure. Each one below receives only what the feature it powers requires, and several are used only if a business turns that feature on. All are US companies or process data in the US, except the two open mapping services: OpenStreetMap is run by a foundation in the United Kingdom and OSRM by FOSSGIS e.V. in Germany, and we cannot tell you where either of them handles what is sent.

Provider	What it does	What it receives
Supabase	Database, sign-in, file storage, server functions	Everything the software stores
Vercel	Web hosting	Requests to the site, server logs
Stripe	Subscription billing, a business’s own customer payments and payouts, and bank connections made earlier through Stripe Financial Connections	Payer name and email, amounts and the text of what is being billed (each line item’s description and the notes on the invoice), payment details entered on Stripe’s own forms, including the card a business enters when it signs up, and, from Stripe’s own scripts, the IP address and device characteristics of a payer’s browser at checkout, of a new business’s browser at sign-up, and of a staff member’s browser when they connect a bank account
Apple	Subscription billing for a plan bought in the iPhone app	A random identifier for the business, attached to the purchase. The Apple ID and its payment details stay with Apple; what comes back to us is the plan, its status and dates, and the purchase’s transaction number
Apple	Push notifications in the iPhone app, for someone at the business who turns them on	The token Apple issues for the app on that phone, and the text of each alert: a heading and one short line that can include a client’s or a teammate’s first name, a date and time, the subject of a team message, or the name of the books a monthly report covers. Email addresses are removed from that line first
GitHub	Storing the daily off-site backup of the database, and holding the archived first part of our privileged-access log	A complete copy of the database tables, and the receipt images and audio mixes a business and its clients upload, held for 60 days. Logos, profile photos and booking page photos are not included. The archive was written out on 21 August 2026, is kept with no expiry, and holds the full text of each privileged command up to that day
Plaid	Bank connections. Since 23 August 2026 this is the route a new bank connection takes	Bank credentials entered in Plaid’s own dialog, and the transactions returned
Twilio	Text messages, if a business enables them	Recipient number and message text
Resend	Outbound email for a business that has not connected its own mailbox. Once the business verifies its own sending domain, its mail leaves from that domain; until then it leaves from a Quarterly address under the business’s name, and replies are routed back to the business. Also checking that a business’s domain is set up correctly, if configured	The domain a business claims and the DNS records issued for it, whether or not verification finishes, and the recipient address and content of the mail it carries
Google	Email for a business that connects its own Google mailbox, which then sends as the business, and any business mailbox connected for receipt and payment scanning. Also the email we send ourselves from a Google Workspace mailbox on the Quarterly domain: sign-in, invitation and password emails, trial and billing notices, our own alerts when a delivery fails, and the feedback you send us from the app	Recipient address and full message content for the mail it carries, including the recipient and subject of a failed delivery in our alerts; messages that match a receipt, invoice or payment search in a connected mailbox
Anthropic	Reading receipts, classifying expenses and bank transactions, finding payments received, checking a payment is not a duplicate, spoken mileage entry	See section 5
OpenAI	Turning a spoken sentence into text, for mileage entry only	The audio you record for that entry
OpenStreetMap	Map tiles on a business’s booking page, where it offers in-home or off-site work, and turning an address into coordinates for mileage	The IP address and browser of anyone shown that map, the two addresses in a mileage trip, and a header naming the software that made the request
OSRM (FOSSGIS e.V.)	Measuring the driving distance of a mileage trip	Two pairs of coordinates, no names or addresses, and a header naming the software that made the request
Google, Apple or Microsoft	A calendar subscription, if someone at the business adds their Quarterly calendar link to their own calendar app; and, the other way round, reading a calendar someone at the business connects	Client names, appointment times, session notes and, for off-site work, a client’s address; for a connected calendar, only our request to read it, made with the private link its owner gave us
Meta (Instagram Graph API)	Showing a business’s own Instagram posts on its site, if connected	The connection token; posts come back to us
Cloudflare DNS	Checking that a business really controls a domain it claims, and whether the domain of an email address exists, for an address typed on a business’s booking page or saved in the app	A domain name only: the domain a business claims, or the part of an email address after the @. No other part of the address, and no name

We will keep this list current. If we add a provider that receives personal information, it appears here.

5. What is sent to AI providers

Several features work by sending content to Anthropic’s Claude, and one sends audio to OpenAI. We would rather be specific than reassuring, so here is each one.

Reading a receipt photo. The image is sent to Anthropic, together with the business’s list of bookkeeping categories, and Anthropic returns the vendor, date, total, line items and the category it fits.
Scanning a connected mailbox for receipts. The content of messages that match a receipt or invoice search, and any document attached to them, is sent to Anthropic, which says which are genuine business expenses and pulls out vendor, amount, date, category and the service or billing address printed on the bill.
Scanning a connected mailbox for payments received. The content of messages that look like payment notifications is sent to Anthropic, which pulls out the amount, the date and the name of whoever paid, so the payment can be offered for review. Where the payer is one of the business’s clients, that is a client’s name.
Checking a new payment is not a duplicate. This one runs on its own: whenever someone records an income entry dated earlier than today, the payer name, amount and date just entered, and a short list of that business’s own bookings, income rows and paid invoices from the three days either side, are sent to Anthropic without anyone pressing anything. Each item in that list carries a client name, the date, the amount and whether it had been paid.
Categorising bank transactions. Transaction descriptions and amounts are sent to Anthropic, which assigns a tax category. Account numbers are not included.
Spoken mileage entry. Your recording goes to OpenAI to become text; the text and your home address go to Anthropic to extract the trip; both addresses go to OpenStreetMap to become coordinates and to OSRM to be measured. Where a business travels to a client, the destination is the client’s address.

Both Anthropic and OpenAI state that content submitted through their APIs is not used to train their models. We never send bank credentials or card numbers to an AI provider, and we do not send a business’s calendar to an AI provider. Client names, appointment dates and invoice totals do reach Anthropic. They reach it in the duplicate check and in the payments half of the mailbox scan, as the bullets above describe. They can also reach it in the receipts half of that scan, because it searches the whole mailbox including sent messages, so an invoice a business emailed its own client can match the search; and in a spoken mileage note, because nothing stops the speaker from saying a client’s name. We would rather list all four than let a shorter sentence stand.

Not all of these wait for someone at the business to ask. The mailbox scan runs on a schedule once a day and reads every mailbox connected to the business, including a staff member’s own. A switch in the app stops the receipt half of it; the payment half stops only when the mailbox is disconnected. The duplicate check runs on its own whenever someone records a payment dated earlier than today. And we can run a wider catch-up scan of connected mailboxes ourselves, across every business at once, when we are repairing or backfilling books; it reads and files what the payments half of the daily scan does, into the same review queue, and writes nothing into a business’s books on its own. A business that would rather not use any of this can leave the mailbox disconnected and never press the other buttons. The one thing that still runs is the duplicate check, whenever a back-dated payment is recorded; everything else waits to be asked.

6. Text messages

Text messages go to people who opted in: a staff member turning on schedule reminders, or a client agreeing to appointment reminders when they book. Three exceptions. A business can switch on new-customer alerts for a member of staff, and those go to the number on that person’s profile. A staff member who keeps their own books under the business receives those alerts at their profile number without any switch. And a staff member who has turned texts on may also be texted when the business assigns them an urgent task. Reply STOP to stop them; opt-outs are handled by the messaging carrier on the business’s own account. A staff member can also switch their texts off in the app, and a client can switch reminders off in their portal, which is the route the business itself can see. Mobile numbers and consent to receive messages are never shared with third parties or affiliates for their own marketing. Message and data rates may apply.

7. How long we keep it

A business’s records are kept for as long as its account is open. When a business removes a member of staff, that person can no longer sign in: the login is disabled and any session it still held is ended. Their staff record stays with the business’s records, because the appointments and invoices they worked on refer to it, and so do their own records, including their receipts and receipt images. Nothing of theirs is deleted except a calendar of their own they had connected, as section 2 describes; keeping the rest is what lets a business restore somebody removed by mistake and keeps its own books complete. A staff member who has no records at all is removed outright, and their sign-in and their profile photo go with them.

If a subscription lapses, the account becomes view-only rather than being deleted: the data stays, and stays exportable, so nobody loses their books over a billing problem. The export is spreadsheets, so it carries every record but not the receipt images or the delivered audio those records point at. Download those from the app before an account is closed.

If a business asks us to delete its account, we require it to export its records first and check that the export still matches its data. The account then becomes read-only and the records are kept for 30 days, during which the business can still sign in and export again; at the end of that period they are deleted permanently. The 30 days are there so a deletion nobody meant can be reversed, not so the business can fetch its data, which it already holds. Our own billing record of what a business paid us is separate, and is kept for as long as tax law requires. A complete copy of the database is taken once a day and stored for us by GitHub, which deletes each copy after 60 days, so a record you delete falls out of the backups as they age. Copies made before 28 October 2026 were kept for 90 days, and the last of them is deleted on 25 January 2027. One record is kept longer, on purpose: the log of privileged access described in section 5 of the Terms keeps the full text of each privileged command, including any detail the command named, such as a client’s email address, for as long as the log exists, because it is the evidence of what was accessed. Deleting the record the command was about does not remove it.

8. Getting your data out

Every business can export its own records from inside the app, as spreadsheets, at any time, including while read-only. We do not hold a business’s books hostage.

9. Security

Each business’s data is separated at the database level. In the browser the database itself enforces that separation, so the app cannot read another business’s rows even if it asks. Our own server code runs with a key that can see everything, and its scoping to one business is enforced by code that is checked automatically on every pull request.
Traffic is encrypted in transit; data is encrypted at rest by our hosting provider. The daily backup described in section 7 is held by GitHub under GitHub’s own protections and is not separately encrypted by us.
Credentials a business gives us for its own providers are stored per business, and no other business can reach them; the credential values themselves cannot be read back by any signed-in account. Since August 20, 2026 each one is also encrypted separately by us, with a key that is kept outside the database, on top of the encryption our hosting provider applies to the whole database. They are left out of the daily backup described in section 7, which records that they were omitted rather than dropping them silently, so a restore knows to ask for them again.
Files are private by default. Receipts, delivered audio and anything a client uploads are readable only by the people the software allows. Profile photographs and business logos are deliberately public, because they appear on a public booking page.
Access to the live database is limited to the people who operate the service. A complete backup is taken once a day and held for 60 days by GitHub, our source-code host, where the people with access to that repository can download it.

No system is perfect. If a breach affects your information we will tell you, and we will tell you what we actually know rather than waiting until the story is tidy.

10. Your choices

See, correct or delete your own account details from inside the app.
Export your business’s records at any time.
Turn off text messages at any time from the app, or reply STOP, which the business’s messaging carrier honours. That includes the new-customer alerts a business sends its staff.
Disconnect Stripe, a bank connection, a mailbox, a calendar or Instagram at any time; disconnecting stops future access, and disconnecting a calendar also deletes the events read from it.
Ask us for a copy of what we hold about you, or ask us to delete it, at help@quarterlybooks.com. If you are a client of one of those businesses rather than the business itself, see section 1.

Depending on where you live you may have additional rights, including under the California Consumer Privacy Act. We will honour them regardless of where you live, and we will not treat you differently for exercising one.

11. Children

Quarterly is business software and is not directed at children. Some businesses teach or work with children, so a business may store a minor’s name, the lesson notes it writes for them and a guardian’s contact and billing details, and a business may give a client a sign-in of their own to read those notes and see their bookings, which a child may use. That is the business’s to collect, to justify and to supervise, and we process it on their instruction.

12. Changes

If we change this policy in a way that matters, we will tell subscribing businesses by email before it takes effect, and update the date at the top.

13. Contact

Synact LLC, operating Quarterly · help@quarterlybooks.com

14. Acknowledgement

If you are a business. When you create a Quarterly account you tick a box agreeing to this policy and our Terms of Service. If we change this policy in a way that matters we will email you first, as section 12 says; continuing to use Quarterly after a change takes effect means you accept it.

If you are a client of a business that uses Quarterly. You have not agreed to anything with us, and nothing here asks you to. Your agreement is with the business you booked. This policy is here so you can see what we do with your information while we hold it on their instructions, and section 1 explains which of us to ask for what.