Lessware App Privacy Notice

• Sign-in and security: your email, optional name, password hash, time zone, sessions, verification/reset records, and authenticator/recovery information if you enable it. We use these to provide and protect your account. We also use short-lived sign-in attempt counters and security events.
• Connected banks: if you choose to connect through Plaid, we receive account names/types, masked account identifiers, balances and transactions, including descriptions, dates, amounts, pending status and provider categories. The connection requests up to 730 days of transaction history; what arrives depends on the bank and provider. Lessware does not receive your bank password through this connection. We store the provider access key encrypted and retain original provider responses as evidence of what was received.
• Information you add: manual account balances, imported CSV files, receipts and their images, categories, notes, review decisions, rules and budgets. We use these to provide the financial views and actions you choose.
• Feedback and activity: feedback messages, their app context and any screenshot you choose to attach; first-party app activity events describing screens, actions and success/failure outcomes. We use these to understand and fix problems and improve the app.

We do not sell your financial data or insights derived from it, including aggregated or de-identified insights. Optional receipt processing is a separate choice described below; this is not a claim that no feature ever uses an external processor.

Plaid provides the bank connection and receives the connection information you authorize and a Lessware account identifier. Its own privacy policy describes its processing. Connecting a bank is optional. A disconnected bank's saved records remain in Lessware until you delete them.

Microsoft Azure hosts the app's services and data. Azure Communication Services is the configured email service for account verification and recovery. Feedback can also be delivered through the configured email service to Lessware's designated feedback recipient. Do not include sensitive information in a feedback message that is unnecessary to explain the problem.

Automatic receipt reading, when available, requires a separate acknowledgement before automatic extraction. The current versioned disclosure names Mistral OCR 4 through Microsoft Foundry and GPT-5.6 Luna through Azure OpenAI, with processed page JPEGs rather than the sealed original file. Read the displayed receipt-processing disclosure for its recipients, region and handling limits before choosing it. Manual receipt entry remains a separate path and does not call those automatic extraction providers. The existence of this disclosure does not mean automatic reading is enabled in every deployment.

• Financial records, raw bank responses, committed CSV originals, receipts and financial annotations remain until you delete the relevant records or use financial-data deletion. Disconnecting a bank does not erase them.
• Unfinished CSV imports become eligible for cleanup after 24 hours. Cleanup runs as background maintenance; the expiry is not a promise of physical removal at that exact second.
• Prepared exports are available for 24 hours from their request and their snapshot records are removed through expiry handling. Lessware cannot remove a copy you have downloaded.
• Feedback context and screenshots normally become eligible for cleanup after 90 days. Evidence explicitly preserved for investigation can remain longer. Activity events expire after 90 days. Feedback message text has no automatic time-based expiry; financial-data deletion removes the app's feedback records.
• A copy of feedback delivered to a mailbox is separate from the in-app record and is not removed by the app's financial-data deletion process.
• Sign-in sessions last up to 30 days, subject to logout and security invalidation. Sign-in attempt counters use a 15-minute window. Financial-data deletion retains the sign-in identity and security/session records needed for that identity.
• The current database backup retention setting is seven days. Deleted records may remain in retained backups until those backups expire.

Security events are written to hosting-platform logs. A fixed retention period for the current platform logs has not been verified. The current deployment has no configured durable application-log destination; a proposed 30-day destination is not yet a deployed feature.

Use Accounts → Your data to prepare an export, disconnect a bank or request financial-data deletion. You can cancel a deletion confirmation before submitting it. Disconnecting stops further app updates while saved records remain; provider access removal may still be pending. Financial deletion removes bank connections, accounts, transactions, stored financial files, receipts, annotations and in-app feedback after the removal operation completes. Pending or failed status does not mean removal is finished.

Financial-data deletion retains your Lessware sign-in account and Company Open Ledger records. To close the remaining app sign-in, first wait for financial-data deletion to finish, then follow the closure instructions in Your data or Security and contact privacy@getlessware.com. For the pilot, the operator handles closure and requires an explicit reply to a confirmation sent to the sign-in email stored on your account. If you cannot access that email, a separate identity-recovery process must verify you before closure can proceed. Closure is confirmed only after the reviewed operation succeeds; no response deadline is promised.

Verified closure removes the old sign-in identity, sessions, recovery data and remaining records owned by that app account. It creates no new permanent closure record in the app database. The seven-day database backup setting still applies; security-log and delivered-email retention has not been verified. Separate public-site waitlist, funding/update-choice and idea records are handled through separate privacy or consent requests. A later signup with the same email follows the normal invitation and 18+ rules, with no old account data or consent restored.

The app uses password hashing and encryption for bank access keys and authenticator secrets. No service can promise absolute security. The published notice will identify its version and effective date. Processor changes that require a new receipt-processing acknowledgement must use a new disclosure version; an earlier acknowledgement does not authorize a different processor contract.