ONE CLICK P&L

Privacy Policy

Last updated: August 22, 2026

Who handles your data

ONE CLICK P&L is operated by SW Accounting & Consulting Corp (doing business as SWCPALAB), 3785 Wilshire Blvd, Los Angeles, CA 90010, United States. We are the controller of the personal information described below, and you can reach us at support@swcpalab.com.

What we collect

  • Uploaded statements — the files you upload (PDF, CSV, Excel, or photos/scans of statements) and the transactions extracted from them, stored in our database and private file storage (Supabase) to generate and re-open your reports.
  • Account data — email address and login credentials if you create an account (managed by Supabase Auth; Google sign-in shares your Google account email with us).
  • Billing data — payments are processed by Stripe; we never see or store full card numbers, only Stripe customer and transaction references.
  • Operational data — IP-based rate-limit counters and request logs to keep the Service reliable and abuse-free, and usage analytics (page views, referrer, country, device and browser type) collected by Vercel Analytics, which sets no cookies and does not follow you to other sites.

How we use it

To run the Service: extracting and categorizing your transactions (statement content is sent to Anthropic's Claude API for processing), generating reports, operating your account, and responding when you ask us to contact you.

We also use it to make the Service more accurate. When you correct how a transaction was categorized, we may use that correction — the merchant name, whether it was money in or out, and the category you chose — to improve categorization for every customer, and we measure our models against a sample of past, human-corrected transactions. What travels between customers is that pairing and nothing else: no amounts, no balances, no account numbers, and nothing identifying you or your business.

We do not sell your data or use it for advertising, and the commercial terms our AI processor operates under forbid it from training its models on anything we send it.

How we protect it

Your files are held in private storage: it is not published, an anonymous request for its contents returns nothing, and each file is reachable only through the account it belongs to. Every table in our database enforces row-level security, so one account's rows are not readable by another. Traffic to the Service is encrypted in transit and browsers are instructed to use HTTPS only. Our database and file storage provider encrypts all stored data at rest with AES-256. Access to production data is limited to the people who operate the Service. If a breach affects your personal information, we will notify you, and any regulator that must be told, as the law requires.

Retention and deletion

Uploads and reports are kept so you can re-open them. Deleting your account (Settings → Delete account) permanently removes your uploaded files, extracted data, reports, and login. Uploads belonging to a report that was never started are deleted after 30 days. Anonymous reports can be removed on request.

After you delete your account we keep two things and nothing else: the record that you accepted these terms and when, and the ledger of credits you bought and spent. We keep the first to be able to show what was agreed if it is ever disputed, and the second because tax and accounting records have to be retained. Neither contains your statements, your transactions or your login.

Processors we rely on

Supabase (database, file storage, authentication), Vercel (hosting and site analytics), Anthropic (transaction extraction and categorization — statement content, including check images, is processed by the Claude API), Stripe (payments), Ntropy and Google Places (vendor identification — transaction descriptions, never balances or full statements, may be looked up to name the merchant), and Resend (the emails we send you). Each processes data only to provide their service to us.

California residents

We are almost certainly below the thresholds that make a company a "business" under the CCPA, so these rights may not be owed to you by law. We give them to you anyway, and we will not treat you differently for using them.

  • Know — what personal information we hold, where it came from, why we have it, and who we shared it with.
  • Delete — have it erased, yourself in Settings → Delete account or by asking us.
  • Correct — have inaccurate personal information fixed.
  • Portability — get a copy in a usable format. Your reports already export to Excel and PDF at any time.
  • Opt out of sale or sharing — there is nothing to opt out of. We do not sell or share personal information as the CCPA defines those words, and we do not use it for cross-context behavioral advertising.
  • Limit use of sensitive information — the financial account information in your statements is only ever used to produce your reports. We do not use it to infer anything about you.

Where it comes from and how long we keep it.Almost everything we hold comes directly from you — the statements you upload, and the email address you sign up with. The rest is generated as the Service runs (extracted transactions, reports) or is received from our payment processor. We keep uploads and reports until you delete them or your account; uploads for a report that was never started are deleted after 30 days; the two records described under "Retention and deletion" are kept after that.

How to ask. Email support@swcpalab.com from the address on your account, which is how we confirm it is you — if you cannot, we may ask for something else that matches what we already hold, and we will not collect anything new just to check. An authorized agent may act for you with your written permission. We will acknowledge within 10 business days and answer within 45 days, and tell you if we need up to 45 more.

Do Not Track

Some browsers send a "Do Not Track" signal. There is no agreed standard for how a site should answer it, so we do not act on it. We do not follow you across other websites in any case.

Changes to this policy

We may update this policy. The date at the top is always the version in force, and material changes are posted on this page. If a change materially widens how we use information we already hold, we will email account holders before it takes effect.

Contact

Privacy questions, access requests and deletion requests go to support@swcpalab.com, or by mail to SW Accounting & Consulting Corp (doing business as SWCPALAB), 3785 Wilshire Blvd, Los Angeles, CA 90010, United States.