Cima BooksDRAFT — needs legal review. This policy is a working draft. It is not in effect and is not a binding statement until it has been reviewed by counsel and published as final. Bracketed items are placeholders.
Privacy policy
Privacy policy (draft)
Last updated: [date] · Operated by [Company legal name] ("we", "us")
What Cima Books is
Cima Books is bookkeeping and financial-analysis software for businesses. You (the business) decide what data goes into your books. For the financial records you put in Cima Books, we act on your behalf as a service provider.
What we collect
- Account information: your name, sign-in email or username, password (stored only as a scrypt hash), role, and organization name.
- Books data: companies, chart of accounts, transactions, journal entries, vendors, categories, goals and settings that you enter, import or connect.
- Bank data: if you connect a bank, account names, masked account numbers, balances and transactions from the institutions you choose.
- Imports: files you import, such as QuickBooks exports. Personal client names are scrubbed from the books on import.
- Audit and security logs: sign-ins and changes to the books, with time and user, kept to protect the integrity of your records.
We do not use third-party advertising, analytics or tracking scripts on the app or on this website.
How we use it
- To keep your books, produce reports, and run the Insights features you use.
- To secure the service, prevent abuse and keep an audit trail.
- To support you when you ask for help.
We do not sell your data and do not use it to advertise to you. [Confirm with counsel: any aggregated, de-identified benchmark use is opt-in only.]
Service providers (processors)
We use these providers to run features you choose. Each receives only what the feature needs.
| Provider | Purpose | What they receive |
|---|---|---|
| SimpleFIN Bridge | Bank connections (bank feeds) | Your bank connection, which you authorize with them directly; they return account and transaction data to us. |
| Plaid Inc. | Bank connections (bank feeds) | Your bank connection through Plaid Link, which you authorize with them directly; a random per-organization identifier, never your name or email. Plaid's own privacy policy applies to the information you give Plaid. |
| Anthropic, PBC | AI CFO answers and AI analysis (Claude) | Financial figures only: accounts, amounts, vendors, categories, periods and goals. Never protected health information, client or patient names, or bank credentials. Under Anthropic's commercial terms, inputs are not used for training. |
| [Hosting provider] | Running the service and storing data | Encrypted and unencrypted data at rest as needed to operate the service. [To be completed when hosting is chosen.] |
Health information
Cima Books is designed to keep protected health information out of your books and away from AI. If you are a HIPAA covered entity or a 42 CFR Part 2 program, do not put patient-identifying information into Cima Books unless we have signed a Business Associate Agreement with you. [Counsel: confirm BAA availability and wording.]
Security
See Security for how we protect data, including encrypted bank credentials, hashed passwords and a hash-chained audit log.
Retention and deletion
Your books are kept while your account is active. Financial records may need to be kept for several years for tax purposes; archived imports are kept for seven years by default. You can export your books at any time. [Counsel: define deletion on account closure and backup retention.]
Your choices and rights
- Export your books at any time.
- Disconnect a bank connection at any time.
- Ask us to access, correct or delete your personal information. [Counsel: add state-specific rights, such as California, as applicable.]
Changes
We will post changes here and update the date above. [Counsel: notice period for material changes.]
Contact
[Privacy contact address]