Privacy Policy

NetOpBooks · Last updated: May 31, 2026

This Privacy Policy explains how NetOpBooks ("NetOpBooks", "we", "us") collects, uses, discloses, secures, retains, and deletes information when you use our cloud accounting platform at netopbooks.com and related services (the "Service"). By creating an account or using the Service, you agree to this Policy and our Terms of Service.

1. Who we are

NetOpBooks provides multi-tenant accounting, bookkeeping, payroll, tax-preparation, and bank-data aggregation software for businesses and accounting practices. For privacy questions, contact us at privacy@netopbooks.com.

2. Information we collect

Category	Examples
Account & profile	Name, email, phone, business name, role, password (stored hashed)
Business financial data	Invoices, bills, expenses, journal entries, chart of accounts, reports
Bank & transaction data	Connected account metadata and transactions obtained via Plaid (see §5)
Payroll & tax identifiers (sensitive)	Employee/contractor names, addresses, bank account & routing numbers, Social Security Numbers (SSN) and Taxpayer Identification Numbers (TIN) where required for payroll and 1099/W-2 preparation
Payment data	Subscription and invoice payments are processed by Stripe; we do not store full card numbers
Location (Field Workforce only)	Where a worker’s device is when they clock in, clock out, take a break, or return — latitude, longitude and reported accuracy. Collected only from workers whose employer uses the Field Workforce module, only while they are on a shift, and only to verify that a visit happened where and when it was recorded. It is never collected from other users, and never used for advertising.
Care records (NetOpBooks Hearth only)	For home care agencies: the tasks a worker recorded as done, declined or not needed on a visit, any note explaining a decline, and the Medicaid member identifier of the person receiving care. Held encrypted and used to document and bill the visit.
Technical & usage	IP address, device/browser information, audit logs of actions taken in the Service

3. How we use information

To provide, operate, secure, and improve the Service (bookkeeping, payroll, tax prep, reporting).
To import and categorize bank and app transactions you authorize.
To prepare and (where supported) file tax and information forms you request.
To authenticate users, enforce access controls, and detect or prevent fraud and abuse.
To verify visits for Electronic Visit Verification (EVV) and timekeeping: confirming a worker was at the agreed place at the agreed time, calculating paid hours, and where required transmitting the visit to a state Medicaid aggregator so the visit can be billed.
To communicate with you about your account, security, and service updates.

We do not sell your personal information, and we do not use the financial data we process to build advertising profiles.

4. Location data (Field Workforce)

If your employer uses the Field Workforce module, NetOpBooks records where your device is at the moment you clock in, clock out, start or end a break, and periodically while a shift is open. This is how a visit is verified as having taken place, which is what Electronic Visit Verification requires and what your hours are paid from.

Only while you are on a shift. Collection starts when you clock in and stops when you clock out. It does not run between shifts, on days you do not work, or after you leave the job.
Only your employer sees it. Location is visible to the agency or company you work for, and, where a state Medicaid programme requires it, to that programme’s visit-verification system. It is not sold, shared with advertisers, or used to build a profile of you.
You can refuse. Location permission is yours to grant or deny. Denying it means clocking in through the app will not work, and your employer will need to record your time another way — it does not otherwise affect your use of NetOpBooks.
In the mobile app, background location may be used so that a shift keeps being verified while your phone is in your pocket or the screen is off. You are asked for this separately, it is explained before the permission is requested, and it can be withdrawn in your device settings at any time.

5. Bank data via Plaid

When you connect a financial account, we use Plaid Inc. ("Plaid") to access account and transaction information on your behalf. By connecting an account, you also agree to Plaid's End User Privacy Policy. Plaid accesses the data using credentials you provide to Plaid; we receive account metadata and transactions and use them solely to deliver the Service to you. We encrypt Plaid access tokens at rest and you may disconnect a financial account at any time, which stops further data collection.

6. How we share information

Within your organization / your accountant: data is shared with users in your company and, where you authorize a connection, with your accounting practice.
Service providers (sub-processors): Plaid (bank data), Stripe (payments), our cloud hosting provider (Amazon Web Services), and email delivery (SendGrid). These providers are bound to use the data only to provide their services to us.
Legal & safety: when required by law, subpoena, or to protect rights, safety, and the integrity of the Service.
Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Policy.

7. Data security

All data in transit is encrypted using TLS 1.2 or higher.
Sensitive identifiers (SSN/TIN, bank account/routing numbers) and Plaid access tokens are encrypted at rest using AES-256-GCM.
Passwords are stored using bcrypt hashing; we never store them in plain text.
Access is governed by role-based access controls and least-privilege principles; multi-factor authentication is available and is required before connecting a financial institution.
We maintain audit logs, automated security patching, and tenant data isolation.

See our Information Security Policy for further detail. No method of transmission or storage is 100% secure, but we work to protect your information using commercially reasonable safeguards.

8. Data retention & deletion

We retain personal and financial data for as long as your account is active and as needed to provide the Service and meet legal, tax, and accounting recordkeeping obligations. You may request deletion of your account and associated data, and you may disconnect financial accounts at any time. Upon a verified deletion request, we delete or de-identify your data within 30 days, except where retention is required by law (e.g., tax records). See our Data Retention & Deletion Policy for specifics.

9. Your rights & choices

Access, correct, or export your data.
Disconnect any connected financial account.
Request deletion of your account and personal data.
Depending on your location, you may have additional rights under laws such as the GDPR or CCPA/CPRA. To exercise any right, contact privacy@netopbooks.com.

10. Consent

By registering for and using the Service, and by connecting financial or payment accounts, you consent to the collection, processing, and storage of your information as described in this Policy. You may withdraw consent by disconnecting accounts and/or requesting account deletion.

11. Children's privacy

The Service is intended for business use and is not directed to children under 16. We do not knowingly collect personal information from children.

12. Changes to this Policy

We may update this Policy from time to time. Material changes will be posted here with an updated "Last updated" date and, where appropriate, notified to you.

13. Contact

NetOpBooks — Attn: Privacy
Email: privacy@netopbooks.com