Privacy policy

Forty Two Six is wholly owned by Timothy LeGendre CPA LLC, based in Florida. This policy explains how information is handled when someone visits the Forty Two Six website, creates an account, joins a workspace, or uses the accounting service.

Questions about privacy, legal matters, or support may be sent to [email protected].

The information we handle depends on how you use the service. It may include the following categories:

• Account and profile information, including your email address, user identifier, account dates, display name, and profile details returned when you choose Google sign-in, such as a name or avatar.
• Company and workspace information, including entity names, business type, tax classification, fiscal-year settings, member names and email addresses, roles, and invitation records.
• Financial and bookkeeping information, including charts of accounts, transaction dates, amounts, descriptions, merchant names, journal entries and lines, memos, categorization and clearing status, reconciliations, balances, and period locks.
• Documents and file information that you choose to upload, including the file itself, filename, type, size, digest, uploader, workspace or entity association, and any link to a journal entry or transaction. Uploaded records may contain information about customers, vendors, employees, owners, or other people.
• Connection and service information, including provider and external-account labels, account masks, synchronization status, API-key names and prefixes, creation and last-use dates, request identifiers, and security or migration records.
• Technical information used to deliver and protect the service, such as source-address or IP information, request timing, browser or device metadata made available to hosting systems, and application activity used for authentication, rate limiting, troubleshooting, and security.
• Subscription and payment status. Where a payment provider is used, it receives payment details directly. Forty Two Six may receive customer, checkout, subscription, price, invoice, and event identifiers and related status, but the application is not designed to receive a full card number from the checkout form.

We receive information when you create or update an account, configure a company, invite a workspace member, enter or upload records, use an export or integration, contact us, or otherwise use the service. A workspace member may also provide information about you or give you access to records in that workspace.

We also receive limited information from services used to operate Forty Two Six. For example, Supabase supports authentication, database, file storage, and server functions. Google provides sign-in information when you choose Google sign-in and serves the website fonts. Hosting and security systems may produce ordinary request metadata.

We use information for the following purposes:

• Provide, maintain, and secure accounts, workspaces, accounting records, document storage, exports, and customer-requested services.
• Authenticate users, apply workspace permissions, support optional multi-factor authentication, prevent abuse, rate-limit requests, and investigate security or service issues.
• Process bookkeeping instructions, organize financial inputs, produce reports and exports, support reconciliation and audit history, and provide an Operated service when separately agreed.
• Administer subscriptions, confirm access, respond to questions and requests, communicate service or policy changes, and keep operational, tax, accounting, dispute, and legal records.
• Debug and improve the reliability, usability, and performance of the service using information reasonably needed for those purposes.

Workspace access is controlled by users. An owner can invite members and manage their roles. Members with access can view and work with the books according to the permissions available to that role. You should invite only people who are authorized to see the workspace data.

If you separately engage Timothy LeGendre CPA LLC for an Operated or other professional service, authorized personnel may access the relevant workspace and records to provide the services agreed with you. Using the software alone does not create that professional engagement.

We may provide information to vendors that help authenticate users, host the application, store data and files, run service functions, process payments, or support the service. Those providers handle information for their own service roles and under their own terms. We may also disclose information when required by law, to protect rights or security, or as part of a business transaction subject to appropriate protections.

Forty Two Six may suggest categories for bank and card transactions using an automated classification service provided by TypeSafe. To make a suggestion, the service receives the transaction description as your bank provides it, which can include the names of people or businesses paid, with email addresses, phone numbers, street addresses, reference numbers and full account or card numbers removed. It also receives the amount, whether money came in or went out, general business information such as industry, entity type and the description of what the business does, and the names and descriptions of the accounts in your chart of accounts. Where your bank connection provides them, it may also receive the spending category assigned by the bank, the merchant name and website, the merchant category code, the payment channel, the names and types of the other parties to the transaction, and how earlier transactions with the same merchant were categorized. It does not receive full account or card numbers, the location of a transaction, user identifiers or sign-in information. The TypeSafe privacy policy states that it does not train or fine-tune any models on the information it receives. Suggestions are shown for your review and are not recorded in your books until you finalize them.

Self-service billing uses Stripe Checkout when that feature is enabled. All existing bookkeeping clients continue to be billed externally through Anchor, and all new $500 Operated clients are billed externally through Anchor under separate agreements. Self-service billing is separate from Anchor billing. Anchor is not integrated into the Forty Two Six application, and app access does not replace, amend, or reprice an existing agreement.

If you choose Google sign-in, Google authenticates you and returns the account information needed for that sign-in, including your email address and potentially your name and avatar. Forty Two Six uses that information to create or identify your account and display your profile. Google sign-in does not itself give Forty Two Six access to your Gmail, Google Drive files, or financial records.

Your use of Google services is also governed by Google’s terms and privacy practices.

The service can create CSV exports for selected accounting records. You can also create a key and connect a compatible outside client that can read the workspace information you authorize, such as entities, accounts, journal data, bank transactions, or trial balances.

Forty Two Six does not select the outside client or control what it does with information after you direct the transfer. Review the recipient’s privacy and security practices before connecting it, protect your key, and revoke the key if access should end. The platform sends authorized data to the client you choose; it does not invoke AI or another model to process that data.

The application uses browser storage to keep an authenticated session, remember a theme choice, and remember the last-selected entity. Authentication, hosting, and other infrastructure providers may use cookies or similar technologies when needed to provide their services. Hosting and security systems may also log ordinary metadata such as an IP address, browser details, timestamps, and requested pages or endpoints.

Do not use a shared or public device for sensitive records unless you can sign out and clear the browser data safely.

We expect to retain information while an account or service relationship is active and afterward when reasonably needed to operate the service, preserve accounting and audit history, maintain security records, resolve disputes, comply with tax, accounting, or other legal obligations, and protect legal rights. Different records may require different retention based on their purpose and sensitivity.

Deletion from an active system may not immediately remove information from backups or records that must be retained. When information is no longer reasonably needed, it should be deleted, de-identified, or otherwise disposed of in a manner appropriate to the information and the systems that hold it.

You can update certain profile and workspace information in the service, remove individual documents and settings where controls are available, revoke API keys, export selected records as CSV files, and export each book’s chart of accounts, journal entries and lines, bank transactions and trial balance as an Excel workbook. Uploaded documents, rules and settings are not part of that export, and the application does not currently provide complete self-service account deletion.

To ask for access, correction, export, or deletion of other information, email [email protected]. We may need to verify your identity and authority over the account or workspace. A request may be limited where retention is reasonably required, where records concern another person or workspace member, or where applicable law permits or requires continued handling. Applicable law may provide additional rights.

Forty Two Six uses safeguards intended to reduce the risk of unauthorized access, alteration, disclosure, or loss. Current application controls include passwordless authentication, optional multi-factor authentication, workspace-based access checks, hashed API keys, file validation, time-limited download links, and audit-oriented records. Service providers also protect the systems they operate under their own security programs.

No service or transmission method can be guaranteed completely secure. You are responsible for protecting access to your email, authentication methods, devices, exported files, and API keys, and for notifying us promptly at [email protected] if you believe an account or workspace has been compromised.

Forty Two Six accounts are intended for people who have the legal capacity and authority to use the service for themselves or an organization. Do not create an account for someone who cannot legally agree to these terms or intentionally provide information collected directly from a child through the service.

Accounting records often contain information about other people. Before entering, uploading, sharing, or exporting that information, you are responsible for having the rights and authority needed to do so and for giving any notices or obtaining any permissions required by applicable law or your agreements.

We may update this policy as the service or our practices change. We will post the revised policy with a new date and provide any additional notice required by applicable law.

Contact [email protected] with privacy questions, legal requests, or support needs.