Privacy notice

Storage and deletion

PDFs use private encrypted object storage. Uploaded and derived financial content expires 24 hours after presign. Source and export access is authorized and proxied through the application, so Fulla Ledger does not issue public object URLs and object locations are not exposed to the browser. Static site assets and images are delivered through a content delivery network.

Subprocessors

Fulla Ledger uses a small, named set of processors:

• Amazon Web Services — private S3 object storage for uploaded and derived files, SES for transactional email, and CloudFront for static asset delivery.
• Stripe — payment processing, subscriptions, invoices, promotion codes, and refunds. Card data is entered with Stripe; Fulla Ledger stores only customer, subscription, invoice, and purchase references.
• Google Analytics: aggregate traffic measurement on selected public pages when configured and permitted by the regional rules and browser preferences below. It sets analytics cookies, but never runs on private financial or workspace pages. Statement content, account identifiers, and workspace data are not sent to it.
• OpenRouter and its routed model endpoints — vision extraction of application-rendered page images, pinned to the evaluated policy described below. Page images leave Fulla Ledger only for these routes.

Each processor handles only the categories above and is named here rather than described in general terms.

Analytics preferences

For visitors whose IP address is identified as United States, public-page analytics is on by default without a permission banner. Everywhere else, including when we cannot determine a country, it stays off until you choose to allow it. No Google Analytics tag or measurement request is sent before analytics is permitted.

You can reject analytics below at any time without affecting the service. A rejection, Global Privacy Control, or Do Not Track overrides both the United States default and an earlier choice to allow analytics. Analytics never runs on private financial pages, including your documents, reviews, workspaces, account, or billing pages.

We determine country on our server using a local, offline IP-country database. This lookup does not send your IP address to an external lookup service, and the country lookup endpoint does not return or log your IP address. IP geolocation data is provided by DB-IP through its Country Lite database.

Only an explicit choice saves a necessary first-party preference cookie in this browser for up to one year. The United States default does not save an “allow” preference. Clearing cookies removes your saved choice. When a choice is saved, the page may reload to apply it; rejecting analytics also removes Google Analytics measurement cookies.

Loading this browser's analytics preferences. Analytics stays off until permission is determined.

Vision providers

Application-rendered page images are sent through OpenRouter only to the model and provider endpoint pinned by the active evaluated policy. The only route in use is Mistral through Mistral's zero-data-retention endpoint, requested with formal OpenRouter ZDR and data collection denied. PDF text can be supplemental evidence.

Identifiers

Account, card, routing, ABA, and IBAN-like values are reduced or masked before scoring, persistence, review events, exports, support diagnostics, and telemetry. Unsafe output is rejected in process memory.

Accounts, credits, and billing

Identity, workspace membership, consent, page ledger, subscription projection, credit products, credit purchases, credit grants, lot balances, lot expiration, discount references and redemption records, API-key hash and prefix, and deletion state persist as needed to operate and account for the service. A credit lot expires no later than 365 days after issue, while its purchase, grant, redemption, and expiration records may remain in the billing and audit history. API key secrets are shown once and stored only by hash.

Transactional email

Fulla Ledger sends account email to your account address only: address verification, password reset, workspace invitations, conversion-ready notices, allowance or quota notices, billing failures, credit purchase receipts, and support acknowledgements. These messages are transactional rather than marketing, do not include statement content, and are delivered through Amazon SES. The service records a recipient hash and delivery status so messages are neither lost nor duplicated.

Support consent

Support may access only one currently owned document selected on a ticket, after explicit versioned consent and before the document expires. Operator access is audited. Revocation or cleanup clears the link.

Administration and audit

Authorized operators can view account, workspace, billing, credit, discount, support, export, conversion-cost, and deletion records in a separate private dashboard. Operator grants, credit changes, discount changes, subscription controls, workspace access changes, and consent-bound source access are audited.