Skip to content
Vuluru
Vuluru / Legal

Vuluru One Privacy Policy

Version 4. Last updated: October 16, 2026.

1. Introduction

Vuluru, Inc. ("Vuluru," "we," "us," or "our") operates the Vuluru One platform and the www.vuluru.com website. This Privacy Policy describes how we collect, use, share, and protect your personal information when you use our Service or visit our website.

When we process data on your behalf as part of the Service (for example, your customers' or vendors' information that you enter into Vuluru One), we act as a data processor under your instructions. When we collect data directly from you (for example, your account registration or website visits), we act as a data controller. Our commitments as a processor are in the Data processing section of our Terms of Service.

This policy should be read together with our Terms of Service and Cookie Policy.

2. Information We Collect

We collect the following categories of information:

  • Account information. Your name, email address and Google account ID when you sign in with Google (we never receive your Google password); the passkeys you register (we store only their public keys); your recovery codes (we store only a one-way fingerprint of each, never the codes themselves); and the company details you enter: legal name, business type, fiscal year, time zone and subdomain.
  • Customer Data. Accounts, journal entries (including those from a journal entry file you import), customers, vendors, invoices, bills, payments, and bank lines from a bank you connect (directly, such as Mercury, or through Plaid) or from a transactions file you import, plus anything else you or your Authorized Users enter. You retain full ownership of Customer Data. See Section 7 of our Terms of Service.
  • Bank connections through Plaid. For each account you choose: the account's name, type and last 4 digits, its balance, and its transactions (date, amount, description and payee, as your bank gives them). We never see your bank username or password, and we don't keep full account or routing numbers, anything about your identity, investments, loans or income, or lines from accounts you don't choose.
  • Imported journal entry files. When you import a journal entry file (CSV), we don't keep the file itself. We keep the drafts it makes, which rows of the file each came from, and a record of the import: the file's name, its size and a one-way fingerprint (SHA-256) of it, who imported it and when, and how many rows it had and drafts it made. The file's name and contents are never written to our logs.
  • Activity records. Your sign-ins, sessions, and an audit record of who did what and when in a company's books. The audit record is permanent while the company exists, because the books depend on it.
  • Technical data. Your IP address and request details, which pass through Cloudflare and our servers to deliver and protect the Service.
  • Communication data. Support requests and other messages you send us, whether by email or in the Service, together with any context you choose to include, and the invite emails we send for a company.

3. How We Collect Information

  • Directly from you. When you sign in, create or join a company, enter or import data, connect a bank, or contact us.
  • Automatically. Through essential cookies when you use the Service (see our Cookie Policy). We don't use web beacons or analytics tools.
  • From third parties. From Google when you sign in; from a bank you connect, directly or through Plaid; and, where your company uses an outside Super Intelligence (SI) provider, that provider's answers. We do not purchase personal data from data brokers.

4. How We Use Your Information

We use the information we collect to:

  • Provide, operate, maintain, and improve the Service
  • Send product updates, security alerts, and administrative notices
  • Respond to support requests and communicate with you
  • Detect and prevent fraud, abuse, or security incidents
  • Comply with legal obligations, resolve disputes, and enforce our agreements
  • Send marketing communications only if you've agreed to receive them, with an opt-out in every message

We may generate aggregate, de-identified data that does not identify you or any individual. We use this data for product improvement, benchmarking, and research. We will not re-identify or de-anonymize aggregate data. See Section 7 of our Terms of Service for details.

5. Lawful Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following lawful bases as defined by Article 6 of the General Data Protection Regulation (GDPR):

  • Contract Performance. Processing necessary to provide the Service, manage your account, and, once fees apply, process payments under our Terms of Service.
  • Legitimate Interests. Processing for product improvement, fraud prevention, and platform security, where those interests are not overridden by your rights. You may object to processing based on legitimate interests at any time (see Section 10).
  • Consent. Processing for marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.
  • Legal Obligation. Processing necessary to comply with applicable laws, such as tax record-keeping, regulatory requirements, or law enforcement requests.

6. Data Sharing & Third Parties

We do not sell, rent, or trade your personal data to third parties for their marketing purposes. We share information only with the following recipients, and only to provide and protect the Service:

  • Microsoft Azure hosts the Service, its database and its backups, in the United States.
  • Cloudflare sits in front of the Service and protects it. All traffic, including books content in transit, passes through it.
  • Google provides sign-in.
  • Postmark (AC PM LLC, part of ActiveCampaign) sends invite and notice emails, and the invoices a company emails to its customers from Vuluru One. It processes them in the United States, and it keeps a copy of each email it sends, including any attachment, for 45 days.
  • Outside SI providers, only by choice. xAI (Grok) is used for Vuluru, Inc.'s own books, under Vuluru's account. For any other company, content goes to an outside SI provider only if its Owner turns one on and accepts that provider's SI data addendum.
  • A bank you connect sends us your bank lines. Its own terms govern your relationship with it.
  • Plaid, only if you connect a bank through it. You sign in to your bank on Plaid's own screen, and Plaid sends us the account details and transactions listed in Section 2. When you connect, you agree to Plaid's End User Services Agreement and End User Privacy Policy, under which Plaid may also use what it collects for its own purposes, such as preventing fraud and improving its products, and may keep de-identified data; we don't control those uses. We send Plaid only a random identifier for that connect attempt and your company's Vuluru One address to return you to, never your name or email.
  • Professional advisors — legal counsel, accountants, and auditors, as needed and under confidentiality obligations
  • Law enforcement and government authorities — only when required by law, subpoena, or court order
  • Corporate transaction parties — in connection with a merger, acquisition, or sale of assets, we will provide notice and ensure the acquiring entity is bound by this Privacy Policy or one that is equally protective

All third-party service providers are contractually obligated to protect your data and may only use it for the purposes we specify. We do not currently use analytics providers, and we do not sell or share your personal data for advertising. We'll update this list, with notice, before adding a provider that processes your data.

7. International Data Transfers

Vuluru, Inc. is based in the United States, and we store data in the United States. Cloudflare's network may handle traffic at locations outside the United States on its way to our servers. If we offer the Service to customers in the EEA, UK or Switzerland, we will put appropriate transfer safeguards in place first.

8. Cookies & Tracking Technologies

We use only essential cookies: to keep you signed in, to complete sign-in safely, to hold an invite while you sign in, and to remember that you dismissed a notice or a passkey offer. Cloudflare may set its own security cookies. We use no analytics, advertising or preference cookies, and no cross-site tracking. The full list is in our Cookie Policy.

9. Data Retention

We retain your personal data only as long as necessary to fulfill the purposes described in this policy:

  • Active companies. We keep account information and Customer Data while the company uses the Service.
  • After termination. The company's Owner can view and export its books for 12 months. After that, Customer Data is deleted, except where the law requires us to keep it.
  • Backups. Copies in our daily backups expire within 91 days of deletion.
  • The audit record is kept for as long as the company's books exist.
  • Emails we send (invites, notices and invoices) are kept by our email provider, Postmark, for 45 days after sending, with their delivery records. Postmark then deletes them, which can take up to 7 more days. A record of each invoice sent (who, when, to whom, and the PDF's fingerprint) stays with the invoice. If an email address bounces, or its owner marks one of our emails as spam, Postmark keeps that address on a list so we don't send to it again, until it's removed. We'll remove it on request: we remove a bounced address ourselves, and we ask Postmark to remove one marked as spam.
  • Imported journal entry files aren't kept: we read the file when you import it and don't store it. The import's record (the file's name, size and fingerprint, who imported it and when, and how many rows it had and drafts it made) and the drafts themselves are part of the company's books, so they're kept and deleted with the books, as described above for active companies and after termination.
  • A bank connected through Plaid. When you disconnect it, we ask Plaid to remove the connection (if Plaid doesn't confirm within a day, we tell you, so you can remove it at my.plaid.com), delete our copy of the connection key, and delete our record of where the bank feed had reached (its sync cursors). Bank lines already brought in stay in your books.
  • Legal retention. Some records may be kept longer where the law requires.
  • Aggregate data. De-identified, anonymized data that cannot identify you may be retained indefinitely for product improvement and research.

These periods match Section 17 of our Terms of Service.

10. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  • Right to Access. Request a copy of the personal data we hold about you.
  • Right to Rectification. Request correction of inaccurate or incomplete personal data.
  • Right to Erasure. Request deletion of your personal data, subject to legal retention requirements.
  • Right to Data Portability. Request your data in a structured, commonly used, machine-readable format (CSV and JSON).
  • Right to Restrict Processing. Request that we limit how we process your data in certain circumstances.
  • Right to Object. Object to processing based on legitimate interests, including direct marketing.
  • Right to Withdraw Consent. Where processing is based on consent, withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
  • Right to Lodge a Complaint. If you are in the EEA or UK, you have the right to lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at hello@vuluru.com. We will respond to verified requests within 30 days. We will not discriminate against you for exercising your privacy rights.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights:

  • Right to Know. You may request the categories and specific pieces of personal information we have collected about you, the sources of collection, the purposes for collection, and the categories of third parties with whom we share it.
  • Right to Delete. You may request that we delete your personal information, subject to certain legal exceptions.
  • Right to Opt-Out of Sale or Sharing. We do not sell or share your personal information as defined by the CCPA/CPRA. We do not use your data for cross-context behavioral advertising.
  • Right to Non-Discrimination. We will not deny you services, charge different prices, or provide a different quality of service because you exercised your CCPA rights.

The categories of personal information we collect are described in Section 2 of this policy. To submit a request, contact us at hello@vuluru.com.

12. Children's Privacy

The Service is not directed at children under the age of 13, and we do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at hello@vuluru.com. If we learn that we have collected personal data from a child under 13, we will take steps to delete it promptly.

13. Data Security

We implement and maintain technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

  • Encryption at rest for the database and backups, provided by Microsoft Azure
  • TLS (version 1.2 or later) for all connections, end to end through Cloudflare to our servers
  • Each company's data kept apart by the application and by row-level security in the database
  • Roles (Owner, Accountant, Viewer), and a passkey at every sign-in, after Google, and again for sensitive changes
  • Connection secrets encrypted under a key held outside the database
  • Daily backups to storage that can't be changed or deleted for 35 days, and restores that are tested before first use and every quarter after

In the event of a personal data breach likely to result in risk to your rights and freedoms, we will notify affected customers without undue delay, and within any deadline the law sets.

No method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security. For more details on our security practices, see our Security page. To report a security issue, email security@vuluru.com.

14. Super Intelligence (SI) and Automated Proposals

Super Intelligence (SI) uses language models to propose entries, answers and explanations. Every proposal that would change your records is presented to a person who can accept, edit or reject it, and SI never posts anything itself. By default (Local), SI sends your content to no outside model provider. A company's Owner may choose an outside model provider, as described in Section 7 of our Terms of Service.

SI's proposals work on your business records. They aren't used to make decisions about you as an individual, such as decisions about employment, credit, or eligibility for a service.

If we introduce processing that produces legal effects on you or similarly significantly affects you, we will update this policy, provide appropriate notice, and implement safeguards including the right to obtain human intervention, to express your point of view, and to contest the decision.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We'll tell you about a material change at least 14 days before it takes effect, by email to the address on your account. Non-material changes (such as formatting or clarifications) may take effect when posted. The "Last updated" date at the top of this page shows when the policy was last revised.

16. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about how we handle your data, contact us at:

Vuluru, Inc.
Privacy Inquiries
Email: hello@vuluru.com
Security issues: security@vuluru.com

If you are located in the EEA or UK and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.