Privacy Policy

1. Overview

This Privacy Policy describes how Antler Software LLC ("Antler," "we," "us," or "our") collects, uses, stores, and protects information when you use the Antler platform at app.antlerapp.com and antlerapp.com (collectively, the "Platform").

Antler is a business-to-business (B2B) software platform. Our customers are accounting firms and bookkeeping practices ("Subscribers"). When a Subscriber uploads their clients' financial data to Antler, that data belongs to the Subscriber and is handled according to the Subscriber's obligations to their own clients.

By using the Platform, you agree to this Privacy Policy. If you do not agree, do not use the Platform.

2. What We Collect

2.1 Account & Firm Information

2.2 Client Financial Data (Uploaded by Subscriber)

When you upload files to the Platform, we store:

• Bank transaction data (CSV, Excel, or PDF formats)
• Vendor names and transaction descriptions
• Chart of Accounts categorizations you apply or approve
• Generated financial reports (P&L, Balance Sheet, General Ledger, Trial Balance)
• Rules, Smart Rules, and categorization preferences you configure

This data is stored in Supabase (a PostgreSQL database hosted on AWS) with firm-level isolation. See Section 5 for details on how isolation is enforced.

2.3 Activity & Audit Log

Every action taken by every team member in your firm is recorded in an insert-only audit trail. This includes:

• File uploads and transaction edits
• Categorization approvals and overrides
• Rule creation and modification
• Report exports
• Team member additions and removals
• Login and session events

Audit records are retained for a minimum of 7 years and cannot be modified or deleted by any user, including firm administrators or Antler's super administrator.

2.4 Technical & Usage Data

• IP address (collected at login and terms acceptance)
• Browser type and version (user agent string)
• Session duration and page interactions
• Error logs for platform stability and debugging

3. How We Use Your Information

We do not sell your data. We do not use your data for advertising. We do not share your data with third parties except as described in Section 4.

4. Third-Party Services

Antler uses the following third-party services to operate. Each has its own privacy practices.

We do not use Google Analytics, Meta Pixel, or any advertising tracking on the Platform or the authenticated application.

5. Firm Data Isolation

Every data table in the Platform contains a firm_id column. Row Level Security (RLS) is enabled at the PostgreSQL database level, meaning that even a bug in our application code cannot return one firm's data to another firm's session.

The Global Vendor Library — our AI training dataset of anonymized vendor-to-category mappings — is stored in a completely separate table that is never directly queryable by any Subscriber. It is only accessible to the server-side AI categorization engine.

Cross-firm data access returns zero rows even with a valid authentication token. We run isolation tests before and after every schema change.

6. Data Retention & Deletion

Active subscriptions

Your data is retained for as long as your subscription is active.

After cancellation

Client Data remains available for export for 30 days following cancellation. After 30 days, we may permanently delete all Subscriber data. Audit trail records are retained for 7 years regardless of subscription status, as required for legal compliance.

After trial expiration

No data is guaranteed to be retained after trial expiration without a paid subscription. We recommend exporting your data before your trial ends.

Deletion requests

To request deletion of your firm's data before the standard 30-day window, contact hello@antlerapp.com. We will process deletion requests within 30 days. Note that audit trail records may be retained beyond the deletion date as required by law.

7. Your Rights

As a Subscriber, you have the following rights with respect to your data:

• Access: You can export all of your firm's transaction data, reports, and rules directly from the Platform at any time
• Correction: You can edit or correct any data within the Platform through the standard interface
• Deletion: You can request deletion of your firm's data by contacting us (see Section 6)
• Portability: All data exports are provided in standard formats (CSV, Excel, PDF)
• Audit log access: Firm administrators can view their firm's full activity log within the Platform

To exercise any of these rights, contact hello@antlerapp.com.

8. Security

We implement the following technical and organizational security measures:

• All data encrypted in transit (HTTPS/TLS) and at rest (AES-256 via Supabase)
• Row Level Security enforced at the PostgreSQL database level on all tenant tables
• Session timeout after 30 minutes of inactivity
• Account lockout after 5 consecutive failed login attempts
• Email verification required before first access
• Hardware two-factor authentication on the super admin account
• Insert-only audit trail — no record can be modified or deleted by any user
• File type validation by content (not extension) on all uploads
• Check PDFs processed server-side and immediately discarded after extraction

No security system is perfect. In the event of a data breach affecting your firm's data, we will notify you within 72 hours of becoming aware of the breach, as required by applicable law.

9. Cookies & Tracking

The Antler application (app.antlerapp.com) uses only essential session cookies required to maintain your login state. We do not use advertising cookies, third-party tracking pixels, or analytics cookies in the authenticated application.

The landing page (antlerapp.com) hosted on Netlify may set minimal performance cookies. We do not run advertising retargeting on the landing page.

10. Children

The Platform is intended solely for use by accounting and bookkeeping professionals. We do not knowingly collect personal information from anyone under the age of 18. If you believe a minor has submitted information to us, contact us at hello@antlerapp.com and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page and notify active Subscribers by email at least 14 days before material changes take effect. Your continued use of the Platform after that date constitutes acceptance of the updated policy.

Prior versions of this policy are available upon request at hello@antlerapp.com.

12. Contact

For questions, requests, or concerns about this Privacy Policy or how we handle your data: