Legal
How we collect, use, and protect your information.
Last updated: October 26, 2026
This Privacy Policy explains how Zie Pie LLC ("ZiePieBooks", "we", "us", "our") collects, uses, shares and protects personal data when you visit our website, create an account, or use the ZiePieBooks platform (together, the "service"). It forms part of our Terms & Conditions. By using the service you acknowledge the practices described here.
1.1 Zie Pie LLC, 21507 NE 8th St, Sammamish, WA 98074, United States, is the controller (or "business") of the personal data described in sections 2.1 to 2.3: data about website visitors, people who contact us, and the staff of firms that hold an account with us. Contact us at support@ziepie.com.
1.2 Client Data. Accounting and bookkeeping firms use the platform to keep records for their own clients. Those records ("Client Data") may include personal data about the firm's clients, their customers, suppliers, employees and other people. For Client Data the firm is the controller (or "business") and we are a processor (or "service provider") acting only on the firm's instructions, as set out in our Terms. The firm, not ZiePieBooks, is responsible for having a lawful basis to collect Client Data, for giving notices to and obtaining consents from the people it concerns, and for answering their requests. If you are a client of a firm that uses ZiePieBooks, direct any question or request about your data to that firm. Section 2.4 describes how we handle Client Data.
1.3 This policy does not cover the practices of any firm that uses our platform, of any third-party service you connect to it, or of any website we link to.
2.1 Information you give us.
2.2 Information generated by your use of the service.
2.3 Information collected automatically. IP address, device and browser type, operating system, language, referring page, pages visited, timestamps, and the identifiers in the strictly necessary cookies described in our Cookie Policy. Our edge network (Azure Front Door) uses your IP address to determine your approximate country, because the service is offered only in the United States, Canada and the European Union.
2.4 Client Data entered by firms. Firms enter, upload or connect Client Data, including names, addresses, contact details, transaction descriptions, amounts, bank and card account identifiers, invoices, receipts, payroll-related entries and other financial records. We process Client Data only to provide the service to the firm, and as described in sections 3, 5 and 6. Where a firm connects a bank account through Plaid, Plaid provides us with account and transaction data under the firm's authorization and Plaid's own privacy policy.
2.5 Information from third parties. Delivery and bounce status from our email provider, payment status and dispute notifications from our payment processor, and category suggestions returned by our AI provider (section 5).
2.6 Special categories. The service is not designed to hold health, biometric, genetic, religious, political, sexual-orientation or criminal-record data, or government identifiers beyond what tax compliance requires. Do not enter such data unless the firm has a lawful basis to do so; we treat anything entered as ordinary Client Data.
We use personal data to:
We do not sell personal data, and we do not share it for cross-context behavioural advertising. We do not use Client Data to train models that are shared with or used for any other firm, and our AI provider is contractually prohibited from using data we send it to train its models.
Where the EU General Data Protection Regulation or the UK GDPR applies, we rely on: performance of a contract (providing the service, billing, support); legitimate interests (security, fraud prevention, the audit trail, service improvement, marketing to business contacts, corporate transactions), balanced against your rights; legal obligation (tax, accounting, sanctions and lawful requests); and consent where we ask for it, which you may withdraw at any time without affecting earlier processing. For Client Data, the firm determines the legal basis and we act under the firm's instructions.
5.1 To suggest a category for a transaction the platform has not seen before, we send our AI provider, Microsoft Azure AI Foundry, only the cleaned transaction description, the amount, whether it is a debit or a credit, and whether it is a bank or card line. We never send client names, account numbers, bank credentials, balances, addresses or contact details for this purpose.
5.2 Suggestions are presented to the firm for review. We do not make decisions that produce legal or similarly significant effects on any individual by automated means, and the firm is responsible for reviewing every suggestion before relying on it, as our Terms require.
6.1 Sub-processors and service providers, acting under written contracts that restrict them to our instructions and require appropriate security:
We will provide the current list of sub-processors on request and will update this policy, or notify account administrators, when we add one that processes Client Data.
6.2 Within a firm's account. Firm administrators control which of their staff and clients can see which data. Anything you enter may be visible to the people the firm has authorized. We are not responsible for access the firm grants.
6.3 Professional advisers such as lawyers, accountants, auditors and insurers, under confidentiality obligations.
6.4 Legal and safety. Courts, regulators, law-enforcement and other authorities where we believe disclosure is required by law, or is reasonably necessary to enforce our Terms, protect our rights or property, protect the safety of any person, or investigate fraud or security incidents. Where lawful and practicable we will notify the affected firm before disclosing Client Data.
6.5 Corporate transactions. A buyer, investor, successor or merger partner, and their advisers, in connection with any actual or proposed financing, merger, acquisition, reorganization, bankruptcy or sale of all or part of our business, subject to this policy.
6.6 With your direction. Any third party you ask us to share data with, or any third-party service a firm connects to the platform. Once data reaches a third party at your direction, that party's own policy applies.
7.1 The service is hosted on Microsoft Azure infrastructure in the United States, and our team is located in the United States. If you are in Canada or the European Union, your personal data and any Client Data are transferred to and processed in the United States, where privacy laws may differ from those in your country.
7.2 For transfers of personal data from the European Economic Area, Switzerland or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), supplemented by the security measures described in section 9. A data processing agreement incorporating these clauses is available to firms on request at support@ziepie.com. Our sub-processors in section 6.1 rely on equivalent mechanisms for any onward transfer.
7.3 Canadian firms acknowledge that data stored in the United States may be accessible to United States authorities under United States law.
8.1 Account and firm data is kept for as long as the account is open. After an account is closed or terminated, we may delete it at any time, and we are under no obligation to retain it (see our Terms, section 11). We may keep limited records of the account, such as the firm name, billing history and the fact of closure, for up to seven years to meet tax, accounting and legal obligations and to resolve disputes.
8.2 Client Data is kept for as long as the firm keeps it in the platform. Firms are responsible for exporting Client Data before closing their account and for their own record-retention obligations. We may delete Client Data at any time after an account ends.
8.3 Audit trail entries are retained in sealed windows for up to 365 days and then purged window by window; the cryptographic seal of each window is kept permanently so that past integrity can still be proven, but a seal contains no personal data.
8.4 Diagnostics and error reports are retained for 90 days.
8.5 Contact enquiries are kept for up to 24 months after our last exchange, unless they lead to an account.
8.6 Backups. Deleted data may persist in encrypted backups until those backups age out on their own schedule, and we may keep data longer where required by law, a legal hold, or an ongoing investigation or dispute.
8.7 How erasure works. Personal data in the audit trail is stored under a per-person key. Erasing a person destroys that key, which makes their entries permanently unreadable while leaving the integrity chain intact. Erasure is effective when the key is destroyed and complete when the last backup holding a copy of it ages out.
We use technical and organisational measures appropriate to the risk, including encryption in transit and at rest, database-level isolation between firms, role-based access checks on every action, hash-chained and regularly re-verified audit logs, hardware-backed key management, logging of every read of personal data, and restricted staff access. Our Security page describes our current practices. No system is completely secure, and you are responsible for keeping your credentials confidential and for the security of your own devices and networks. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as applicable law requires.
10.1 All users. You can review and update your account details in the service. You can ask us to access, correct, delete or restrict your personal data, to object to processing based on our legitimate interests, to receive a copy of data you provided in a portable format, and to withdraw consent where we rely on it. Email support@ziepie.com. We will verify your identity before acting, may ask for further information, and will respond within the time applicable law requires. We may refuse or limit a request where the law allows, for example where the data must be kept for legal, security, audit-trail integrity or dispute reasons, or where fulfilling it would reveal another person's data.
10.2 If your data is Client Data held by a firm using our platform, we will refer your request to that firm and act on its instructions, because the firm is the controller. You can also contact the firm directly.
10.3 California and other US states. To the extent a state privacy law applies to us, residents of that state have the rights it provides, including to know, delete, correct and port their data and to not be discriminated against for exercising those rights. We do not sell or share personal data as those terms are defined in the California Consumer Privacy Act, and we have not done so in the preceding 12 months. You may use an authorized agent by providing written authorization; we may still verify your identity directly.
10.4 European Economic Area, Switzerland and United Kingdom. You have the rights in section 10.1 under the GDPR, and the right to lodge a complaint with your local supervisory authority. For the UK that is the Information Commissioner's Office.
10.5 Canada. You have the rights in section 10.1 under the Personal Information Protection and Electronic Documents Act and applicable provincial law, and the right to complain to the Office of the Privacy Commissioner of Canada.
10.6 Exercising rights does not delete the audit trail. Because the audit trail is a tamper-evident record kept for security and compliance, we satisfy erasure requests against it by the key-destruction method in section 8.7 rather than by deleting entries.
Our website sets only a strictly necessary anti-forgery cookie on the contact page. The platform sets the cookies needed to keep you signed in and secure. Neither uses analytics or advertising cookies. See our Cookie Policy.
We may send product updates, feature announcements and offers to the work email addresses of firm staff and of people who contact us. Every marketing email contains an unsubscribe link, and you can opt out at any time by using it or emailing support@ziepie.com. Opting out does not stop service, security or billing messages, which are necessary to operate your account.
The service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
The service links to and integrates with third-party websites and services, including Plaid and the sites of firms using our platform. We are not responsible for their content, security or privacy practices. Review their policies before providing them with personal data.
We may update this policy at any time. The revised version applies from the date shown at the top of the page. We will notify account administrators by email or through the service of changes that materially reduce your rights or materially expand how we use Client Data; other changes take effect on posting. Your continued use of the service after a change takes effect is your acceptance of it.
Privacy questions, requests and complaints: support@ziepie.com, or by post to Zie Pie LLC, 21507 NE 8th St, Sammamish, WA 98074, USA. You can also use our contact page.