Privacy Policy

This policy explains what MAAK Self-Employed Exp Tracker collects, why it collects it, who it is shared with, how long it is kept and how to get rid of it. It is written to be read, not to be skimmed past. If anything here is unclear, write to support@aiappdeveloper.net and ask.

1. Who we are

MAAK Self-Employed Exp Tracker (“MAAK”, “the app”) is published by AI APP Developer, LLC, a Minnesota limited liability company (“we”, “us”). We are the controller of the personal information described in this policy.

We operate entirely online and have no public premises. Every enquiry, privacy request and complaint reaches us at support@aiappdeveloper.net, which is monitored by a person. We do not publish a postal address; if a regulator or a court requires one, it is available on request through that address.

MAAK is bookkeeping software for people who are self-employed in the United States. It is not a bank, not a lender, not a money transmitter, not a tax preparer and not a financial adviser.

2. What we collect, and why

Everything below is collected because a specific feature needs it. Nothing is collected for advertising or for profiling you.

Account and identity

• Email address — your login identifier, and how we reach you about your account, a failed bank sync or a billing problem. Required.
• Password — stored only as a bcrypt hash. We cannot read it and cannot tell you what it is.
• Name — optional, used to address you and to fill the proprietor name on your Schedule C worksheet.
• Organization details — the workspace name, and optionally a logo, a phone number, a mailing address and a primary contact name.

Business profile

• Business entity records — business name, principal activity and activity code, accounting method, business address, and optionally an Employer Identification Number. These populate the header lines of Schedule C. The EIN is optional; if you do not enter one, we do not have one.
• Home-office details — square footage and months of use, if you claim the deduction.

Financial account and transaction data

• Connected account details — the institution name, account nickname, account type and subtype, the account name as the bank reports it, the last four digits, and current and available balances.
• Transactions — date, amount, merchant or description, the bank's own category, payment channel, currency and pending status, for every transaction on an account you connect or import.
• Your classification of them — business, personal, split or excluded; the Schedule C line; business and deductible percentages; the account they roll up to; whether you have reviewed the row; and any note you attach.
• Descriptions and substantiation you write — the plain-language description of an expense, its business purpose, attendees for a meal, and an optional project or client tag. These exist because the IRS asks for them.
• Imported statements — the CSV, OFX, QFX or QBO files you upload, and a record of what each import contained, so an import can be reviewed or reversed as a unit.
• A Plaid access token for each connection. This is a credential issued by Plaid that lets us read the account you authorized. It is not your bank password. See section 3.

Receipts

• Receipt images and PDFs you photograph or upload, along with the file name, size, type and a checksum used to block duplicate uploads.
• Data read out of them — merchant, date, subtotal, tax, tip, total, currency, line items and the last four digits printed on the receipt — extracted by an AI vision service so the receipt can be matched to a transaction. See section 4.

Mileage, vehicles and assets

• Mileage entries — date, miles, trip type, purpose, and the starting and ending locations as you type them, plus optional odometer readings. We do not read your device's location. The app has no GPS tracking of any kind; a “from” and “to” are text fields.
• Vehicle records — description, date placed in service, and the method you chose.
• Fixed assets — what you bought, when, what it cost, the business-use percentage, the depreciation method and recovery period, and the depreciation posted each period.

Income sources

• Clients, platforms and payers — name, type, and optionally a contact name, email, phone, whether a 1099 is expected, the amount a payer reported, and the last four digits of a payer's tax identification number if you enter it. We never ask for a full Social Security Number or a full taxpayer ID, and there is nowhere in the app to store one.

Reports you generate

• Schedule C worksheets, P&L statements and year-end snapshots, including a frozen copy of a tax year once you lock it, and a record of each export you generate (type, format, period, file name and size).

Security and account activity

• Sign-in records — timestamp, IP address, browser or app user agent, whether the attempt succeeded, and the reason if it did not. Used to show you your own access history, to lock an account after repeated failures, and to investigate suspected unauthorized access.
• Change records — a before-and-after diff of edits to your records, so a figure on a report can always be traced back to who changed what and when.

Usage metering

• Counts, not content — how many receipt pages were processed, how many syncs ran, how many exports were generated, how much storage is used, and how many bank connections were active in a billing month. This is how we enforce plan limits and understand what a subscription costs to run. It is tied to your organization, not used to profile you, and never sold.

Billing

• A Stripe customer reference, a subscription reference, your plan and its status. We never receive or store your card number. Card details are entered on Stripe's own hosted checkout. If you subscribe through the App Store or Google Play instead, Apple or Google handles the payment and we receive only the fact that the subscription is active.

What we do not collect

• Your bank username or password. Ever. See section 3.
• Your device's location, precise or approximate.
• Your contacts, calendar, microphone, health data or browsing history.
• An advertising identifier. The app does not use the IDFA or the Android Advertising ID.
• Full Social Security Numbers or full taxpayer identification numbers.
• Credit scores or credit reports.

3. How the bank connection works

Bank and credit-card connections are provided by Plaid Inc., a financial data aggregator used by many banking and finance applications.

When you connect an account, the app opens Plaid Link. You choose your institution and sign in to Plaid, or, at banks that use it, you are handed to your own bank's website to authorize the connection there. Your bank username, password and multi-factor codes are entered inside Plaid's interface. They are never seen, received, transmitted or stored by MAAK Self-Employed Exp Tracker. There is nowhere in this software they could be logged or leaked, because they never arrive.

What Plaid returns to us is an access token — a credential that authorizes read-only retrieval of the accounts you selected. We use it to fetch account details and transactions. It cannot be used to move money, and the app has no capability to initiate a payment, a transfer or any movement of funds.

Access tokens are encrypted at rest by the application using AES-256-GCM before being written to the database, with a key held outside the database. Tokens are never included in any response the app returns to a browser or mobile client.

Disconnecting an account revokes our access to it. When you remove a connection, we instruct Plaid to invalidate the token; no further data is retrieved from that institution. Transactions already imported stay in your books until you delete them or delete your account, because removing them would silently change a Profit & Loss statement you may have already relied on.

Plaid handles your information under Plaid's own privacy policy and end-user services agreement, which are presented to you inside Plaid Link and which you should read. Plaid's privacy policy is published at plaid.com/legal.

4. How receipt scanning works

When you photograph or upload a receipt, the image is stored in our private storage bucket and a copy is sent to a third-party AI vision provider that reads the text on it and returns the merchant, date and amounts, so the receipt can be matched to a transaction you already have.

We send the receipt image and nothing else — no name, no email, no account identifier travels with it. We use the provider under a business agreement that prohibits the provider from using your content to train its models and requires it to process the image only to return the extraction and then delete it. The extracted fields, and the image itself, are stored in your account.

If you would rather not use this, do not upload receipts. Every other part of the app works without them, and a receipt can always be attached to a transaction manually.

5. How your data is secured

• Encrypted in transit. All traffic uses HTTPS/TLS. The mobile app shell refuses plain HTTP outright.
• Encrypted at rest. The database and the storage bucket are encrypted at rest by the hosting provider. Plaid access tokens receive a second, application-level layer of AES-256-GCM encryption on top of that.
• Every query is scoped to your own organization. Transactions, rules, receipts, accounts, chart-of-accounts entries, income sources and reports are filtered by your organization identifier on every request. Each signup gets its own organization, so one customer's records cannot be reached from another customer's session.
• Receipts live in a private bucket. Public access is off. Images are served through short-lived signed links generated for a single request. There are no public object URLs to guess or share by accident.
• Passwords are hashed with bcrypt, never stored in a readable form. Repeated failed sign-ins lock the account.
• Access is logged. Sign-ins and record changes are recorded so unusual activity can be found and shown to you.

No system is perfectly secure, and we will not pretend otherwise. If we become aware of a breach affecting your personal information, we will notify you and any regulator who must be told, as required by applicable law and without unreasonable delay.

6. Who we share data with

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We disclose it only to the service providers below, only to the extent each one needs to do its job, and only under contracts that require them to protect it and to use it for no other purpose.

We may also disclose information when the law requires it — a valid subpoena, court order or lawful government demand — or where disclosure is necessary to protect our rights, investigate fraud, or protect the safety of any person. If we are permitted to tell you about such a demand, we will.

If the business is ever sold, merged or reorganized, your information may transfer to the acquirer as part of that transaction. It would remain subject to this policy until you are given notice of, and a chance to object to, any change.

7. How long we keep it

Our retention is a convenience, not a substitute for your own records. You remain responsible for keeping copies of anything you file. Export a copy of every return year you rely on.

8. Your rights and choices

These apply to everyone who uses MAAK, not only to residents of places whose laws require them.

• Access. See everything in your account from inside the app. Ask us and we will confirm what we hold and why.
• Export. Download your transactions, your P&L and your Schedule C worksheet as Excel, PDF or CSV at any time, on any plan, including after you cancel and before you delete.
• Correction. Edit any record in the app. Corrections you make by hand are permanent and are never overwritten by an automatic rule.
• Deletion. Delete your account from Settings → Delete account, or email support@aiappdeveloper.net. Deleting the account removes your transactions, receipts, reports, rules, mileage, assets and connected-account records from our live systems within 30 days, and revokes every Plaid connection. Encrypted backups are overwritten on a rolling cycle and any residual copy is gone within 90 days. We keep only what law requires us to keep, such as billing records.
• Disconnect an account without deleting anything, at any time. This revokes our access to that institution immediately.
• Withdraw consent to receipt scanning by not uploading receipts, and to email by using the unsubscribe link in any non-essential message. We will still send you messages that are necessary to operate your account — a failed sync, a payment problem, a security notice.

To exercise a right, email support@aiappdeveloper.net from the address on the account, or from another address with enough detail for us to verify you. We respond within 30 days, or within 45 days where a law allows an extension and we tell you why. We will not charge you, and we will not treat you differently, for asking.

9. Children

MAAK is not directed to children. The service is for self-employed adults, and you must be at least 18 to hold an account. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has given us information, write to support@aiappdeveloper.net and we will delete the account and its data.

10. California privacy rights

If you are a California resident, the California Consumer Privacy Act as amended by the CPRA gives you the rights below. We honour them for every user.

Categories we collect, in the statute's own terms: identifiers (email, name, user ID, IP address); commercial information (subscription and purchase history); financial information (bank and card transactions, balances, account details); professional or employment-related information (your business profile and income sources); internet or network activity (sign-in records and metered usage of app features); geolocation — none; sensory information (receipt images you upload); and inferences — none drawn for profiling. Some of this is sensitive personal information under the CCPA, specifically financial account information and, if you enter one, an EIN. We use sensitive information only to provide the service you asked for, which is a use the statute permits without a right to limit; we do not use or disclose it to infer characteristics about you.

The sources, purposes and recipients are set out in sections 2 and 6, which are incorporated here.

Your rights: to know and access; to delete; to correct; to portability; to opt out of sale or sharing; to limit the use of sensitive personal information; and to be free from retaliation for exercising any of them.

We have not sold personal information, and have not shared it for cross-context behavioural advertising, in the preceding twelve months, and we do not do so now. The free-plan banner is non-personalized and receives none of your data. There is therefore no “Do Not Sell or Share” mechanism to offer, because there is nothing to opt out of.

You may use an authorized agent, with written permission we can verify. Requests go to support@aiappdeveloper.net.

11. European and UK privacy rights

MAAK is built for United States sole proprietors and its features assume a US tax return. If you nevertheless use it from the European Economic Area, the United Kingdom or Switzerland, this section applies to you and AI APP Developer, LLC is the controller of your personal data.

Our legal bases:

• Performance of a contract — creating and running your account, importing and categorizing transactions, producing your reports, taking payment.
• Consent — connecting a bank account through Plaid, and sending a receipt image for AI extraction. You may withdraw either at any time by disconnecting the account or by not uploading receipts; withdrawal does not affect processing already carried out.
• Legitimate interests — securing the service, preventing fraud and abuse, enforcing plan limits, and understanding what the service costs to run. We have weighed these against your rights, and they involve no profiling and no advertising use.
• Legal obligation — keeping tax and accounting records of our own sales.

You have the rights of access, rectification, erasure, restriction, portability and objection, and the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. The app's automatic categorization is not such a decision: it proposes a classification, marks anything it is unsure of for your review, and any answer it gives can be overridden by you permanently.

You may complain to your local supervisory authority, or to the UK Information Commissioner's Office if you are in the United Kingdom. We would rather you told us first: support@aiappdeveloper.net.

12. International transfers

We operate in the United States and our infrastructure and service providers store and process data there. If you use MAAK from outside the United States, your information is transferred to and processed in the United States, whose data protection laws differ from those where you live.

Where a transfer of personal data out of the EEA, the United Kingdom or Switzerland takes place, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) together with the technical measures described in section 5. By using the service you understand your data will be processed in the United States.

13. Changes to this policy

We will update this policy when the product or the law changes. The “Last updated” date at the top always reflects the current version. If a change materially affects how we use your information, we will tell you by email, or with a notice inside the app, before it takes effect — and where the law requires your consent, we will ask for it rather than assume it. Continuing to use the service after a change takes effect means you accept the updated policy.

14. Contact

Questions, requests and complaints all go to the same place, and a person reads them.

AI APP Developer, LLC
Email: support@aiappdeveloper.net