Privacy Policy

1. Who this covers

This policy covers the people who use PracticeBooks — administrators, accountants, auditors and client users — and the personal information about other people that firms record in it, such as their clients’ directors and contacts.

Each accounting firm decides what it records about its own clients. For that information we act on the firm’s behalf, under our Terms of Service; questions about it are best sent to the firm first.

2. What we keep

• Your account: name, work email address, role and firm. Your firm or you may also add a backup email address, mobile and office numbers, date of birth, gender, address, emergency contact, employee ID, department, start date and a profile photo.
• Sign-in and security records: when and how you signed in, the IP address and browser or device used, failed sign-in attempts, the devices you are signed in on, and a log of significant actions (for example posting or changing journals, and changes to staff or settings).
• Second factors: for a passkey, only its public key; for an authenticator app, the shared secret needed to check its codes, stored encrypted.
• Your firm’s books: the client companies, their details (including tax identification numbers, addresses and directors’ names and contact details), accounts, journals, bank statement lines, fixed assets and checklists that the firm enters.
• Emails: a record of the alerts and sign-in codes we send.

Passwords are never stored as typed — only a one-way, salted hash.

3. Why we use it

• to provide PracticeBooks: sign-in, keeping the books, reports, alerts and support;
• to keep accounts and data secure: second factors, spotting unusual sign-ins, signing people out and keeping an audit trail;
• to bill firms for their plans; and
• to meet legal and record-keeping obligations.

We do not sell personal information, use it for advertising or build marketing profiles from it.

4. Cookies and browser storage

PracticeBooks sets one cookie, which keeps you signed in; the service cannot work without it. Your browser also stores a few preferences on your own device, such as light or dark mode and whether the menu is collapsed. We do not use advertising or analytics cookies.

The public pages load their fonts from Google Fonts, so Google receives your IP address and browser details when you visit them.

5. Who else handles it

• Hosting: PracticeBooks and its backups run on servers provided by DigitalOcean.
• Email: alerts and sign-in codes are sent through an email delivery provider.
• AI assistant (optional): when it is switched on and used, your question and the company figures needed to answer it are sent to the AI provider in use. Some providers’ free plans allow them to keep or use what they receive to improve their products. Ask us at [email protected] which provider is in use.
• Password check: when a password is chosen we check that it has not appeared in a known data breach, using the Have I Been Pwned service. Only the first five characters of a one-way hash of the password are sent — never the password itself.
• When the law requires it: we may disclose information to a court, regulator or other authority that is legally entitled to it.

6. Where it is stored

Data is stored on DigitalOcean’s servers, which may be outside Fiji. Each firm’s client companies are kept in their own separate databases, and information travels between your browser and PracticeBooks encrypted (HTTPS).

7. How long we keep it

• Accounts and profile details: while the account exists. A removed staff member’s name stays attached to the entries they made, so the books keep a true history.
• Sign-in and audit records: at least one year.
• A firm’s books: while the firm uses PracticeBooks. Books that are deleted are kept so they can be restored and to meet record-keeping requirements, and are not purged automatically within seven years.
• Backups: kept so the service can be recovered after a fault; deleted information may stay in backup copies until they are replaced.

8. How we protect it

Encrypted connections; salted password hashes; a required second factor for administrators and accountants; sign-out after 30 minutes without activity; the ability to sign out other devices; encrypted storage for second-factor secrets; separate databases per client company; and an audit trail of significant actions.

9. Your choices

• You can see and update most of your own details under My Profile, and see and sign out your devices under My Profile → Security.
• You can ask your firm’s administrator, or us at [email protected], for a copy of your personal information, to correct it, or to delete it. Some records — such as who posted an entry — must be kept for the books to stay accurate or for legal reasons.
• PracticeBooks is for professional use and is not intended for anyone under 18.

10. Changes and contact

We will update this policy when what we do changes; the date below shows the current version. Questions or requests: [email protected].