Privacy Policy

1. Introduction

Welcome to Quaestor Ledger ("we," "our," or "us"), a service operated by SilkTech, LLC d/b/a Quaestor Ledger. We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, and share your information when you use our website (quaestorledger.com) and our AI-powered financial tracking services.

2. Information We Collect

We collect information that you voluntarily provide to us when you use the App:

• Account Information: Email address and authentication details.
• Financial & Receipt Data: Images of receipts, invoices, and the data extracted from them (e.g., merchant names, dates, transaction totals).
• Connected Bank Data (Read-Only): If you link your bank accounts, we receive read-only transaction data to categorize your ledger. We do not collect, process, or store your bank login credentials. This is handled through a secure financial-data connection partner.
• AI Chat Prompts & Interactions: When you interact with the Quaestor Intelligence chat agent, we collect the text of your queries and the contextual financial data required to answer your questions. Do not input Sensitive Personally Identifiable Information (PII) such as Social Security Numbers, full unmasked bank account numbers, or passwords into the AI chat interface.
• Payment Information: If you subscribe to a paid plan, your payment details are processed by a third-party payment processor. Unless expressly stated otherwise at checkout, SilkTech, LLC d/b/a Quaestor Ledger is the seller and merchant of record for subscriptions. We do not store your full credit card number or raw payment card data on our servers.
• Operational Usage and Diagnostic Data: Information needed to operate, secure, and troubleshoot the Service, including sanitized page or screen categories, feature usage, device/browser information, request and error logs, approximate location derived from IP address, and interactions with application features. Microsoft Application Insights provides this operational monitoring even when you decline marketing measurement.
• Acquisition and Marketing Measurement Data: While marketing measurement is enabled under the choices described below, we may record first- and last-touch campaign information such as a sanitized public landing-page category, a validated referring website host (never its path or query), validated UTM values, and advertising click identifiers (for example, gclid, fbclid, or msclkid). Referring hosts that look like account, receipt, credential, UUID, or private identifiers are rejected. We may also send sanitized public-page categories and a small set of public funnel actions, such as a landing view or trial-button click, to the enabled marketing providers described below.
• How You Found Us: If you answer the optional setup question about how you found Quaestor, we store your one choice from a fixed list, such as a newsletter, a podcast, or a search engine, with your account record. You give it to us directly, so we keep it whatever your marketing measurement choice, until account deletion. We do not share it with advertising providers.
• Assisted Migration Records: If you ask us to move your records from another application, then once you have agreed to our Terms of Service you give us a copy of those records through a private channel we agree with you, or, where your previous application offers it and its terms allow it, access to them there through a key you create for the move, which you can revoke at any time and which we ask you to revoke as soon as any event occurs after which we delete the key; where we ask to see your records to judge what can be moved, this may be before we have accepted your request and before your free trial starts. We use the copy, or that access, only to judge your request and to prepare and perform the move, we change nothing in your previous application, we may use AI tools to read and map the records for the move, as Sections 4 and 7 describe, a person reviews the result, and we delete the copy, the key and any of your records, or the facts in them or drawn from them, held in our tools or review materials within 30 days after your request is declined, withdrawn or lapsed (a lapse undone within those 30 days by a later date we agree in writing no longer counts), or the move is completed or ends, or after your trial or subscription ends, unless you ask us in writing to keep the copy longer, which never keeps the key, and except what we must keep, secured and for that purpose only, for a legal obligation or a claim between us, as Section 5 provides. Our general knowledge of how your previous application stores, exports or gives access to its data, learned while judging your request or preparing and performing your move, is ours to keep and use, including for later moves, and is not deleted: it never includes your records or any part or sample of them, even with names removed. This Policy applies to the copy, and to what we read through that access, from the moment we receive it. Your request email and our replies, including what you tell us about your records, your accounts, your currencies and how you found us, are read by a person and kept with your support correspondence for as long as needed to answer you and to run the offer. Your confirmation of a move and the summary you confirmed (the accounts, balances, totals, category mappings, the period the moved history covers, what stays behind, any agreed cutoff date and any difference we noted with its next step, never a copy of your records) are part of that correspondence, not of the copy or of our tools or review materials, and are kept with it as the record of what was accepted; your records in that correspondence, whoever sent or quoted them, are part of the copy, and a review page or plan attached to it, other than the summary, is part of our tools or review materials. If your free trial ends without a cleared first payment, your account is deleted as Section 5 and the Terms provide, and our copy and any key are deleted with it.

3. Age Restrictions

The Service is not intended for children under 13, and we do not knowingly collect personal information from children under 13. The Service is intended for users who are at least 18 years old or the age of majority in their jurisdiction. If we learn that we have collected information from a child under 13, we will take reasonable steps to delete it.

4. How We Use Your Information

We use your data to:

• Provide and manage your account.
• AI Processing and Data Controls: We use AI and cloud services to process receipt images, extracted transaction data, transaction descriptions, user prompts, and records you provide for an Assisted Migration solely to provide the Service. We do not use your personal financial data, receipt images, or prompts to train AI or intelligence systems. Where available and applicable, we configure those services to restrict training use of customer content. Retention may vary depending on the service, feature, abuse-monitoring requirement, legal obligation, and security configuration.
• Improve our application and user experience.
• Monitor reliability, diagnose failures, protect the Service, and prevent abuse.
• Subject to your marketing choices, understand which campaigns and public pages lead to trial interest and account creation.
• Learn where people hear about the Service from the optional answer you give during setup.
• Comply with legal obligations.

5. Data Retention

We retain account, ledger, receipt, linked-account, chat, usage, security, and billing-related records for as long as your account is active or as reasonably necessary to provide the Service, comply with legal obligations, resolve disputes, prevent fraud or abuse, enforce our agreements, maintain backups, and support tax/accounting records. An account whose free trial ended without a cleared first payment, because the payment failed or the trial was cancelled, is deleted 7 days after the trial ends, and one whose renewal payment has failed is read-only until the payment clears and, if it has not cleared within 30 days after it was due, may be deleted, after written notice at least 7 days before, as the Terms provide, a payment later reversed or disputed counting as not cleared from the reversal, for a free trial that started and a renewal that fell due on or after October 14, 2026; none of the retention this Policy describes keeps a deleted account, or anything in it, available in the Service. If you delete your account, we will delete or de-identify personal data within a commercially reasonable period, except where continued retention is required or permitted for the reasons above.

Our first-party acquisition record in your browser expires after 90 days. The cookie that records your marketing choice and the companion cookie that records when that choice was made each expire after one year. Operational Application Insights workspace data is currently configured for a 30-day retention period. Account-level acquisition fields that were validly collected may remain with the account record until account deletion; changing Cookie choices stops future marketing collection but does not selectively erase existing account or telemetry rows. Provider-controlled records follow the provider terms and retention controls described below.

6. Account Deletion

You may request deletion of your account by contacting support@quaestorledger.com or using any account-deletion feature made available in the Service. Deleting your account may permanently remove access to your ledger, receipts, transaction history, chat history, and account configuration, subject to limited retention for legal, security, billing, backup, and dispute-resolution purposes.

7. Sharing Information with Third Parties

We do not sell your personal data for money. We share personal data only with service providers and integration partners reasonably necessary to operate the Service, process payments, provide AI extraction and chat features, connect financial accounts, host infrastructure, provide security, analyze usage, comply with law, and protect our rights. These providers may process data only as permitted by our agreements and applicable law.

• AI and Intelligence Services: We may transmit receipt images, extracted receipt data, transaction data, user prompts, relevant account context, and records you provide for an Assisted Migration to AI services solely to provide receipt extraction, categorization, analytics, conversational features, and the reading and mapping of records for an Assisted Migration. We do not authorize these services to use customer content to train AI or intelligence systems, except where a user has separately consented or where applicable law permits or requires processing.
• AI Web Search: When a question needs public information, such as identifying an unfamiliar merchant or explaining a fee or rate, the Quaestor Intelligence chat agent may send a short search query to Microsoft's Grounding with Bing Search service. The agent is built to keep your private information, such as your name, amounts, balances, and account details, out of every search, and to look up only the public topic, like a merchant name from your transactions or a type of fee. Microsoft processes search queries under its own terms and the Microsoft Privacy Statement, outside our cloud providers' data processing agreements. Answers that use web results are designed to include links to their sources.
• Cloud Hosting: Our infrastructure is hosted by cloud service providers.
• Financial Data Aggregators: We use secure financial-data connection services to connect your external bank accounts. Your use of those services may be subject to their own terms and privacy policies.
• Payment Processors: We use third-party payment processors to process subscription payments securely.
• Operational Monitoring: We use Microsoft Azure Application Insights to monitor reliability, errors, and usage. This processing is operational rather than advertising-based and remains active when marketing measurement is declined. We attach acquisition context to browser-generated Application Insights telemetry only while marketing measurement is enabled. Canonical server milestone telemetry may continue to include bounded attribution that was previously collected while measurement was enabled and retained in your account record until account deletion; changing your browser choice stops new browser capture and advertising-provider delivery but does not rewrite committed operational records.
• Analytics and Advertising Measurement: While marketing measurement is enabled, Reddit Pixel receives events only on eligible public pages on quaestorledger.com. Microsoft Advertising Universal Event Tracking (UET) uses the same public-page boundary and may also receive three canonical account milestones only from the exact clean HTTPS root of app.quaestorledger.com, after a fixed operator-controlled rollout cutoff; it never initializes from private/account routes, query strings, or fragments. Google Analytics and Google Ads browser delivery is currently paused behind a separate operator-controlled release gate and, if later enabled, is subject to the public-apex boundary. These providers receive only bounded actions, sanitized page categories or attribution values, and only for the three Microsoft milestones, an opaque stable event identifier; we do not send ledger entries, balances, receipt content, linked-bank details, chat content, email addresses, phone numbers, or other profile fields to them.

8. Connected Financial Accounts

If you choose to connect financial accounts, you authorize us and our financial-data connection partners to access, process, and transmit read-only account, balance, transaction, institution, and related financial data as needed to provide the Service. We do not receive or store your bank login credentials.

9. Cookies and Similar Technologies

We use cookies, pixels, local storage, and similar technologies in the categories below. When opt-out launch mode is enabled, first-party acquisition measurement and separately enabled public-page advertising tags are on by default unless you select Decline marketing or your browser sends a supported Global Privacy Control signal. When strict mode is enabled, those technologies remain off until you select Allow marketing. You can change this choice at any time through Your Privacy Choices in the footer. Google browser delivery has an additional release gate that is currently off.

• Essential and preference storage: Authentication and security mechanisms keep your session working. A first-party cookie named ql_marketing_consent_v1, shared only between quaestorledger.com and app.quaestorledger.com, and a local-storage mirror remember an affirmative allowance or denial. When you choose Allow marketing, a companion shared cookie named ql_marketing_consent_granted_at_v1 records the time of that choice so that account milestones from before it are not reported to Microsoft. It is browser-scoped, client-stored, unsigned, retained for no more than one year, kept unchanged by a repeated Allow, cleared when you decline, withdraw, or send a Global Privacy Control signal, started again from the current time if measurement later resumes, and never sent to Microsoft. An explicit choice whose recorded time cannot be read reports nothing. In opt-out mode, the absence of the choice cookie means measurement may be enabled by default; it is not recorded as an affirmative consent choice.
• Global Privacy Control: If your browser sends Sec-GPC: 1 or exposes an enabled Global Privacy Control signal, we treat it as a request to disable marketing measurement before acquisition capture or advertising-tag initialization. This browser-level signal takes priority; turn it off before making a different explicit choice through Your Privacy Choices.
• Operational monitoring: Azure Application Insights helps us detect errors, investigate outages, and understand application health. It remains active regardless of your marketing choice. Browser-generated telemetry excludes acquisition context when marketing measurement is disabled; canonical server milestone telemetry may still use bounded attribution previously retained in your account record.
• First-party acquisition storage: While marketing measurement is enabled, ql_telemetry_acquisition_v1 and its local-storage counterpart retain a validated, sanitized first/last-touch record for up to 90 days. Landing pages are limited to public-page categories or /other. External referrer hosts are retained only when they are the exact domain or a subdomain of this closed reviewed list: bing.com, reddit.com, google.com, google.ca, duckduckgo.com, search.brave.com, yahoo.com, yahoo.ca, or producthunt.com. The path and query are not retained, and referring hosts are not sent to Google. Any other external referrer is treated as direct unless validated campaign parameters independently identify a campaign. The ref=producthunt marker that Product Hunt appends to its outbound links is recorded as the campaign source producthunt; the marker itself is not retained.
• Google Analytics and Google Ads: Google browser delivery is intentionally paused while automatic Google-tag measurements are being disabled and independently verified. If the separate release gate is later enabled, delivery while marketing measurement is enabled is limited to allowlisted public pages on quaestorledger.com, excludes authenticated app pages, and explicitly suppresses the browser referrer. Advertising personalization signals remain disabled. Prior permission remains required wherever applicable law or Google policy requires it. See the Google Privacy Policy.
• Reddit Pixel: While marketing measurement is enabled, Reddit may receive manual page-visit actions only from allowlisted, clean public URLs on quaestorledger.com (a URL carrying the Product Hunt marker ref=producthunt is not clean for the pixel); it does not initialize or receive events on app.quaestorledger.com or private/account routes. Because the pixel can inspect the live URL and inbound referrer, external delivery is allowed only for an origin-only referrer from the closed reviewed domain list above (excluding producthunt.com, which is kept for first-party attribution only) or a clean same-site public-page referrer. Paths, queries, IP literals, unapproved or special/private-use hostnames, and private-looking tokens suppress delivery. We do not currently send signup milestones or use Reddit advanced matching. See the Reddit Privacy Policy.
• Microsoft Advertising UET: While marketing measurement is enabled, Microsoft may receive manual public-apex page views and allowlisted public interactions such as landing views, trial-button clicks, and authentication starts; a URL carrying the Product Hunt marker ref=producthunt is never reported to Microsoft. UET loads lazily only from an eligible action. After both the production tag ID and a fixed UTC rollout cutoff are enabled, it may additionally receive signup_completed, trial_started, and activated_trial from the committed account-milestone projection, but only at the exact clean HTTPS root of app.quaestorledger.com. Canonical UET alone may accept the exact origin-only Entra External ID referrer https://quaestorledger.ciamlogin.com/; a path beyond /, query, fragment, credentials, port, alternate host, or use from public UET is rejected. A milestone is reported only if it occurred at or after the rollout cutoff and not more than five minutes before your Allow choice. Each such event contains only its action name and an opaque stable event identifier; no timestamp is sent. A denied or Global Privacy Control state, private paths, queries, fragments, unsafe inbound referrers, and malformed or missing rollout configuration all fail closed. An org-scoped, at-most-three-ID local-storage marker on app.quaestorledger.com suppresses repeat delivery in this browser across browser sessions; it is cleared there on denial, Global Privacy Control, or withdrawal, or at the next app load while measurement is closed, and a milestone already reported before a withdrawal is not reported again after a later Allow. The stable identifier supports provider deduplication, but browser or network failure can still create a reporting gap. Automatic initial and single-page-application page views and automatic consent handling are disabled. Because UET can remain resident on the authenticated SPA after an eligible canonical initialization, provider-side Insights/Clarity, automatic data enhancement, advanced matching, and automatic SPA/raw-URL tracking must remain disabled as a production release gate. We do not send profile fields, customer-list uploads, financial content, or arbitrary event properties. Prior permission remains required wherever applicable law or Microsoft policy requires it. Microsoft states that UET event data may be retained for up to 390 days and that UET cookies may persist for up to 13 months. See the Microsoft Privacy Statement.

You can choose Your Privacy Choices in the footer at any time. Turning off marketing measurement stops future delivery through our marketing wrappers; clears the Quaestor browser acquisition record, the bounded canonical-delivery marker on that origin, and accessible Google, Reddit, and Microsoft marketing cookies; and retains your denial and Microsoft opt-out signals. We also honor supported Global Privacy Control signals. These controls do not delete acquisition fields already retained with your account or canonical operational copies; use account deletion for the account-record lifecycle described above. Browser restrictions, provider-controlled storage, or records already transmitted may not be removable through this control; you can also use browser privacy controls and the provider choices linked above.

10. Data Security

We use administrative, technical, and organizational safeguards designed to protect personal and financial data, including encryption in transit and at rest, access controls, authentication controls, logging, monitoring, and third-party security review where appropriate. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

11. Security Incidents

If we determine that a security incident requires notice under applicable law, we will provide notice to affected users and regulators as required. We may also notify users of security issues when we believe notice is appropriate to help protect accounts or data.

12. Your Rights

Depending on your location, you may have the right to access, correct, delete, or obtain a portable copy of personal data we maintain about you. You may also have the right to opt out of certain processing activities, including targeted advertising, sale or sharing of personal data, or certain profiling activities, where applicable. We do not sell personal data for money. Use Your Privacy Choices, enable Global Privacy Control, or contact support@quaestorledger.com to exercise applicable rights. We may verify your identity before fulfilling a request. If we deny a request, you may appeal by replying to our denial notice or contacting support@quaestorledger.com with the subject line "Privacy Appeal." We will not discriminate against you for exercising privacy rights.