Website: https://ownmybooks.com and its subdomains. Privacy contact: privacy@ownmybooks.com.
1. Scope and responsibilities
This Policy covers Sovereign Software, LLC (Sovereign, we, us), ownmybooks.com and its subdomains, Sovereign Accounting Sync and its desktop Payroll integration, website inquiries and support. The current offer is for U.S. businesses with users aged 18 or older. The current product is locally managed desktop software with a hosted accounting connector; a future hosted multi-tenant product is not represented as presently available. Other products require their applicable notices.
Business records may contain information about employees, customers, vendors and people besides the account holder. The business determines which records and workflows to authorize. For personal information processed solely to provide Hosted Services on that business's instructions, Sovereign acts as processor/service provider under the applicable DPA. Sovereign determines its own purposes for website inquiries, marketing preferences, account administration and legal compliance. Merely supplying customer-operated software does not mean Sovereign receives its records.
Independent third-party services have their own terms and notices. This Policy does not control how an accounting provider other than Sovereign, a bank or another independent recipient handles its copies.
2. Local apps and customer-hosted deployments
The desktop application protects a local encrypted company file through a passphrase. Local records can include business setup and payroll information. This is a distinct storage boundary, not a company-wide zero-knowledge promise. Exports, backups, diagnostics and integrations may have different protections.
Customer controls its device, local administrators, encrypted company file and its own exports/backups. Customer-owned records are not automatically transmitted to Sovereign merely because its software processes them. Authorized connector requests and support submissions are separate.
Your approved journals, account mappings, account-plan details and detailed operation history stay in the encrypted company file on your computer. The hosted connector keeps connection information and limited operational records: your accounting-provider credentials and authorization material, the status of your connection and access, a record of each posting it makes, and account-setup information. It handles the accounting information a request needs, and does not keep the contents of your accounting system's responses.
What the connector keeps includes identifiers that stay linkable to your business and to a particular operation. We do not describe them as anonymous.
3. Hosted integrations and Sovereign Accounting Sync
Sovereign hosts the connector with Railway for early adopters. It serves a test environment and a production environment. The production environment is used internally against Sovereign's own books; customer connections to live accounting data begin after the accounting provider approves the app.
Sovereign Accounting Sync connects the selected company in your accounting system through your accounting provider's authorization step. The accounting permission can allow both reads and writes and can be broader than the selected workflow. A connection does not authorize a particular account creation or journal posting; separate human review and approval are required.
The early-adopter workflows process these categories:
- Company details. When you import company details, the connector reads your company information from your accounting system — company and legal names, address and, where your accounting system provides it, your employer identification number — and passes it to the app on your computer for setup review.
- Chart-of-accounts information, used to map payroll to your accounts and to plan any missing payroll accounts.
- Employee profile information from your accounting system — names, active status, employment details and, where your accounting system provides them, email and phone — for matching and import review. The connector receives the full employee record your accounting system returns and passes on only the profile fields the review needs. A tax identification number is reduced to a note that one exists.
- Reviewed payroll-account creation requests and approved accounting journals, including dates, mapped accounts, amounts and descriptions, together with journal readback for verification and recovery.
- Connection and operational records: your accounting-provider credentials and authorization material, connection, enrollment and access status, an operational record of each posting and account-setup information. Those records do not contain an entry's amounts, descriptions, document number, posting accounts or employee details; that detail stays in the company file on your computer. Automated agreement-acceptance recording is not yet enabled.
The connector receives your accounting provider's responses in readable form while it processes them. Those responses can include more than the app shows, including records created before you connected. The connector does not keep the contents of those responses; it does keep the identifiers described above.
Employee-profile access does not mean the accounting connection imports payroll history or year-to-date payroll.
Your payroll records stay in the encrypted company file on your computer; Sovereign cannot open that file. Your accounting-provider credentials are different. The connector keeps them encrypted, and Sovereign's service can decrypt them because it has to use them to keep the connection working while the desktop app is closed. Local-file protection does not prevent authorized connector processing of readable accounting data.
The hosted connector separately protects each connection's stored credentials, ends desktop access when a disconnect completes, and retires an earlier installation's access when the company reconnects. Sovereign's service can still decrypt connection credentials to maintain the authorized connection.
We plan to record agreement acceptance — the account or representative and company accepting, the version accepted, the time, the authority relied on and the supporting evidence. That recording is not currently enabled in the connector. A privacy acknowledgment is not marketing consent, and an entered name does not independently verify identity.
4. Subscription billing and independent accounting services
Stripe is our selected provider for Sovereign subscription checkout, recurring billing and account-portal payment management. Subscription billing is not yet integrated. That role concerns subscription billing, not execution of payroll payments or a customer-owned Stripe accounting integration. Billing may involve payer/business contact details, invoices, payment-method information, transaction/subscription status and tax information as presented at checkout.
An accounting provider other than Sovereign operates under its own terms and privacy notice. Accounting Sync does not currently provide banking services. A separate future banking feature requires updated disclosures before use.
5. Purposes, recipients and processing limits
We use app and integration information to provide the functions the customer authorizes, maintain authorized connections, provide requested support, protect the Service and fulfill applicable legal obligations. Broad API access is not permission to reuse accounting records for unrelated purposes. We disclose information as lawfully necessary for those purposes, including limited disclosures required by law or needed to address fraud, security threats or legal claims.
In the accounting flow, information moves among your computer, the hosted connector and your accounting provider. Hosting providers process information to operate those services. Authorized partner access requires client authority. Our partner policy is that a change of partner does not transfer your records or change who is billed without your authorization, and that where partner options are offered they may include remote alternatives, including AnyWay Tech, an MSP owned by Sovereign's owner; merely listing a partner gives it no access to client records. A customer-selected advisor is not automatically Sovereign's subprocessor.
6. Website forms and product updates
Our Jotform signup form requires your email and consent. Name, business, role and interest are optional. It is used for product-update and testing-interest signups.
Form submissions are processed through Jotform and may also appear in configured notification mailboxes or approved integrations. They are website records, separate from the customer's encrypted Payroll file and from anything the accounting connector handles. A website inquiry, software purchase or accounting system connection is not by itself marketing enrollment. Contact privacy@ownmybooks.com to change preferences or request assistance with a form submission.
Vercel hosts our website; this is separate from the accounting connector hosted on Railway. Website hosting and form providers can receive IP addresses, browser/request information and configured cookies or diagnostic data when their resources load. The types of cookies and diagnostic data depend on the website and form resources you use; the site should not be treated as cookie-free.
7. Support and correspondence
When you contact us, supplied information and related correspondence are processed by personnel and systems responding to the request. Troubleshooting material may contain business or personal data and leaves the local-file boundary when shared.
Do not send passwords, tokens, tax IDs, bank details, employee records or full financial files through general forms or ordinary support email. Ask support@ownmybooks.com for an appropriate route before sharing sensitive diagnostic material.
8. Logout, disconnect, cancellation and deletion
Signing out ends a local session; it does not itself revoke your accounting provider's authorization. Disconnecting the selected connection, canceling a subscription and requesting deletion have different effects. Disconnection does not reverse completed entries in your accounting system or erase customer-controlled company files, existing exports/backups or copies the customer's accounting provider holds independently.
When you disconnect, the connector asks your accounting provider to revoke access, removes its copy of your credentials and ends desktop access in the same request. An unresolved operation can defer completion. Scheduled cleanup removes the remaining connection information afterward. If the revocation does not succeed, the connector keeps retrying and still removes its own copy of your credentials; your accounting provider may continue to show the authorization until you remove it there. An outage delays this work until the connection catches up.
Separately from that, our planned policy remains to purge connection credentials and connection information within 24 hours of the effective paid-period end following cancellation, or an earlier manual desktop disconnect. Scheduling a cancellation would not start that clock. That complete automated process is not fully deployed, so this is not a 24-hour deletion guarantee.
The subscription-end deletion trigger is not implemented. An offline disconnect takes effect only when it reaches the connector; offline requests are not currently queued for later delivery. Unresolved operations and outages can delay cleanup. Section 9 describes what the connector keeps.
Acceptance evidence, billing records, support correspondence, Jotform submissions, marketing preferences and notification-mail copies have separate retention needs. We have not yet established fixed retention periods for all of these categories. They are not governed by the connector schedule in Section 9; contact privacy@ownmybooks.com about a particular record or a deletion request.
The active-product policy provides full customer backup/export before cancellation becomes effective, with no contractual post-cancellation export window. Nonwaivable privacy rights remain available under applicable law. Sovereign bills the customer directly for the subscription, including where the customer enrolled through a partner portal. Subscription cancellation follows the Terms; partner access remains subject to the customer's authorization.
Railway's edge logs separately record client IP addresses and browser details in clear for about 30 days under Railway's own policy. We do not currently promise a shorter retention period for these logs.
9. Retention and safeguards
Operational records. For each journal posting operation, the connector keeps an operational record. Its purpose is to prevent the same payroll from being posted twice and to check and settle an uncertain outcome, including after reconnection or restoration of an older company file.
These records contain business and transaction identifiers, processing status, and limited activity history needed to prevent duplicate entries and resolve processing errors. They do not contain the entry's amounts, descriptions or document number, the accounts it posts to, employee details, or your accounting system's response beyond those identifiers. The detailed payroll records remain in the company file on your computer. The identifiers they do contain stay linkable to your business and to a particular operation.
Scheduled cleanup. The hosted connector runs cleanup on a schedule, including after a restart. It reduces finished operational records after the default 90-day period, or during disconnect cleanup, and deletes the resulting identity records 13 months after the operation. Those identity records retain a protected fingerprint of the accounting provider's company identifier rather than the readable identifier. An unresolved operation retains its full record until its outcome is settled.
Older records may remain until the retention process has handled them, including readable company identifiers retained without a previous time-based limit. A deletion confirmation reports what was actually removed.
Resolved account-setup plans are removed 30 days after they are resolved. An authorization session expires after 10 minutes.
Security records. The hosted connector records failed sign-in activity and limited security events. Failed sign-in records are kept for 30 days, posting events for 14 days and other events for 90 days. Failed sign-in records use protected address fingerprints to count repeated attempts; these records are not described as anonymous. The event log does not contain accounting data, request contents, your accounting provider's identifiers or network addresses.
See Privacy and security updates for what the hosted connector does and the limits that still apply.
Retention otherwise depends on the record and its purpose, including applicable legal, security and dispute obligations. Local journal and audit history, hosted connection and account-setup information, website form records, and any separately implemented acceptance records are different stores with different rules. Short-lived authorization state or removal of a credential is not a retention schedule, and unlinking does not prove backup erasure.
For additional detail about the information stored for a particular service or record, contact privacy@ownmybooks.com.
Local encryption, protected desktop credentials and hosted access restrictions are different boundaries. We use safeguards appropriate to processing risk; no system eliminates all risk. See our Security Overview for current controls and limitations. Encryption of the local company file does not make every service flow end-to-end encrypted; the connector processes readable accounting data.
10. Requests, choices and international processing
Contact privacy@ownmybooks.com for access, correction, deletion or an available copy. Depending on applicable law and circumstances, rights may include portability, objection, restriction, withdrawal of consent, appeal, or complaint to a supervisory authority. Withdrawal does not affect lawful processing before withdrawal. Not every right applies to every person or record.
For business-controlled records, that business may need to authorize or respond. We will provide appropriate assistance and respond as required by applicable law. Do not send sensitive identity documents through a general form.
The Service is offered to U.S. businesses and users aged 18 or older. Business records can nevertheless contain information about minors, for example employees or dependents; user eligibility is not a claim that no minors' information can be processed.
Processing by hosting, form and other service providers may occur outside your state or country. We do not currently promise U.S.-only storage. The Subprocessor and Service Provider Register describes providers and the location information available for them.
11. Changes and contact
We will date and retain published versions and provide appropriate notice of material changes before they apply, obtaining consent when required. A new policy does not retroactively broaden previously obtained consent. Agreement reacceptance and privacy acknowledgment are separate from any optional marketing permission.
Privacy Office: privacy@ownmybooks.com. Mail: Privacy Office, Sovereign Software, LLC, PO Box 470, Wynne, AR 72396. Support: support@ownmybooks.com.
Contact directory
- Formal contractual notices: legal@ownmybooks.com; Sovereign Software, LLC, Attention: Legal Notices, PO Box 470, Wynne, AR 72396.
- Privacy requests: privacy@ownmybooks.com; Privacy Office, Sovereign Software, LLC, PO Box 470, Wynne, AR 72396.
- Routine support: support@ownmybooks.com.
- Security and vulnerability reports: security@ownmybooks.com.
- Subscription cancellation: the customer account management portal.