SmallbooksPrivacy policy
Effective October 24, 2026
Smallbooks is a bookkeeping service operated by Matthew Evans Consulting (“we”). This policy explains what we collect when you use Smallbooks at app.smallbooks.biz, why, and what you can do about it.
What we collect
- Your account: your email address and, if you give it, your name.
- Bookkeeping data: what a business enters or imports, such as accounts, journal entries, contacts, products, invoices, payments and attached files.
- Bank data: if a business connects a bank feed, the account names, balances and transactions its bank shares through SimpleFIN Bridge. We never see or store bank passwords.
- Security records: a session cookie that keeps you signed in, and an audit log of changes with the time, the person, their IP address and browser.
- Email delivery: whether email we sent was delivered, bounced or marked as spam, and when a client first opened an invoice link.
We use no advertising, analytics or tracking cookies, and we don’t sell or rent personal information.
Why we use it
Only to run Smallbooks: to sign you in, keep each business’s books, send the email described below, keep the service secure, and fix problems. Each business’s data is kept separate and is visible only to the people that business has invited.
Email we send
Smallbooks sends only transactional email, never marketing:
- Sign-in codes, when you ask for one. Codes expire after 10 minutes.
- Invitations, when a business owner invites you to their books or client portal.
- Invoices and reminders, sent by a business to its own clients. Reminders for overdue invoices follow the schedule that business sets. To stop them, contact the business that sent them, or us.
Email is sent through Amazon Simple Email Service. Addresses that bounce or report a message as spam are suppressed automatically, and we don’t send to them again.
Who we share it with
Only the providers that run the service, and only for that purpose:
- Amazon Web Services hosts Smallbooks and its database in the United States (Oregon), and delivers its email.
- SimpleFIN Bridge delivers bank transactions, for businesses that connect it.
- AI assistants you connect. If you connect an assistant such as Claude to your books, it can read and change the data your permission allows. Its own privacy terms then apply.
We disclose information if the law requires it.
How long we keep it
Bookkeeping data is kept while the business uses Smallbooks, because books are records that must last. Sessions expire after 30 days without use. Server logs are kept for up to three months, and database backups for 35 days.
Your choices
- Business owners can export all of their books at any time from Settings.
- You can ask us for a copy of your personal information, or ask us to correct or delete it. Some bookkeeping records may need to be kept for the business’s legal obligations.
Security
Data is encrypted in transit and at rest. Sign-in uses one-time codes instead of passwords, and every change to a business’s books is recorded in its audit log.
Children
Smallbooks is for businesses and is not meant for anyone under 18.
Changes and contact
If this policy changes, we’ll update the date above and, for significant changes, tell account holders by email. Questions or requests: matt@matthewevansconsulting.com.