Privacy Policy

Account information. Your name, email address, and an optional phone number. Passwords are stored only as a bcrypt hash — we cannot read them.

Company records. The legal details of the companies you keep books for: legal name, address, and tax identification number, along with your customers, vendors, invoices, bills, payments, and chart of accounts.

Bank and credit card data. When you connect a financial account, we receive the account name, type, institution, the last four digits, current balance, and transaction history — date, amount, and description. Where you enter an account manually or import a statement, we store what you provide, which may include a full account number and routing number.

Documents you upload. Receipts, bills, and statements, including the images or PDFs themselves.

Operational records. An audit trail of changes to your books, which records who made a change, what it was before and after, the IP address, and the browser user agent.

Bank connections are made through Stripe Financial Connections. You authenticate directly with your financial institution through Stripe’s interface. Ulix never sees or stores your online banking username or password.

The credential that lets us retrieve your transactions is encrypted at rest with AES-256-GCM before it is written to our database, and it is never returned by our API or exposed to a browser.

We request read-only access to account details, balances, and transactions. We do not request, and cannot perform, the ability to move money out of a connected account.

You can disconnect a linked account at any time from the Bank Connections screen. Doing so revokes our access at the provider. Transactions already imported into your books remain, because they are part of your accounting records.

If you sell on Amazon, you can upload your Amazon settlement reports or authorize Ulix to download them for you. We use only the settlement report: settlement and order IDs, dates, SKUs, quantities, fee and amount descriptions, and amounts. It contains no information about your buyers, and we do not request any.

We use this data only to keep your own books. It is never sold, shared, used for advertising, or combined with other sellers’ data. The authorization Amazon gives us is encrypted with AES-256-GCM before it is stored and is never shown in a browser.

You can disconnect Amazon at any time; the authorization is deleted immediately. Settlements already posted stay in your books because they are part of your accounting records, and they are removed when you delete the company or your account.

If you sell on Shopify, you can install the Ulix app on your store or upload Shopify’s payouts and orders exports. Ulix reads, and only reads: orders and refunds (order numbers, dates, products and SKUs, quantities, prices, discounts, shipping charged, tax lines and how each order was paid), Shopify Payments payouts and their transactions (amounts, fees, chargebacks, reserves), and each product’s cost per item. To work out sales tax by state, Ulix reads the ship-to state or province and country of an order and nothing else about the address.

Ulix does not request or store your customers’ names, email addresses, phone numbers or street addresses. When an export file contains them, those columns are skipped and never saved. Shopify’s privacy requests are answered automatically: a customer data request is answered that Ulix holds no customer personal data; when a store uninstalls the app, Shopify asks Ulix to erase that store’s data and the copied orders, refunds and payout transactions are deleted. Journal entries already posted stay in your books (they carry amounts per category, no customer details) until you delete the company or your account.

The access Shopify gives Ulix is encrypted with AES-256-GCM before it is stored, is never shown in a browser, and is deleted when you disconnect the store in Ulix or uninstall the app in Shopify. Store data is used only to keep your own books — never sold, shared, used for advertising, or combined with other merchants’ data.

To provide the service: recording transactions, producing financial statements, matching payments to invoices and bills, preparing 1099 information, and keeping an audit trail.

To categorize transactions automatically, and to extract fields from receipts and bills you upload, using the artificial-intelligence processing described below.

To secure the service — authenticating you, detecting misuse, and diagnosing errors.

We do not sell your information. We do not use your financial data for advertising, and we do not share it with data brokers.

Ulix uses Anthropic’s Claude models to suggest a category for bank transactions, to extract fields from uploaded documents, and to power the in-app bookkeeping assistant. This means specific data is transmitted to Anthropic:

• For categorization: the transaction date, amount, description, memo and check number, together with your chart of account names.
• For document extraction: the receipt, bill or statement image or PDF you uploaded, in full.
• For the assistant: the records it needs to answer your request, such as an invoice or a vendor record.

We do not send your online banking credentials, full account numbers, or routing numbers for AI processing. Anthropic processes this data to return a result to us; it is not used to train their models.

Automated categorization produces a suggestion. Entries are reviewable and correctable, and the reasoning behind a suggestion is recorded so you can audit why a transaction was classified as it was.

We share information only with the service providers that operate Ulix:

• Stripe — bank connections and payment processing.
• Shopify — only when you connect your store: Ulix reads your store’s orders, payouts and product costs from Shopify. Ulix sends Shopify nothing about your books.
• Anthropic — the AI processing described above.
• Supabase — database and document storage.
• Vercel — application hosting.
• Google and Meta — advertising measurement on our public website and sign-up pages only (the home page for visitors, pricing, the demo, sign-up and sign-in), to tell whether our ads lead to visits and new accounts. Their tags never load inside Ulix once you are signed in or in our phone apps, receive no financial data, names or email addresses, and do not load at all when your browser sends Do Not Track or Global Privacy Control.

We may also disclose information where required by law, or to protect the rights and safety of our users. If the business is ever sold or merged, your information may transfer as part of that transaction, and this policy will continue to apply until you are given notice of a change.

Your data is stored in the United States. We do not store customer financial data outside the United States.

Accounting records are retained for as long as your account is active, because bookkeeping and tax records have to remain available for later periods and for audit. You can delete your account yourself from Settings: your name, email and sign-in are erased, companies only you use are deleted with all their records and documents, and companies you share with others stay with them (their records keep showing that a deleted user made an entry). We also delete data on request, except where we are required to retain records to meet a legal or tax obligation.

We keep encrypted, access-restricted backups of the database and stored documents in a separate Amazon Web Services archive in the United States, so the service can be recovered after a disaster. Data you delete may remain in those backups for a period after it is removed from Ulix.

Data is encrypted in transit using TLS and encrypted at rest by our database and storage providers. Bank access credentials receive an additional layer of application-level AES-256-GCM encryption. Access to each company’s books is restricted to the users you invite, with role-based permissions, and every change to your books is recorded in an audit trail. You can turn on two-step sign-in with an authenticator app, and repeated failed sign-in attempts are temporarily blocked.

No system is perfectly secure. If we become aware of a breach affecting your information, we will notify you.

You can access and correct your information inside the application, disconnect a linked financial account at any time, export your data as CSV, and request deletion of your account.

Depending on where you live, you may have additional rights to access, correct, delete, or port your information, and to object to certain processing. Contact us to exercise them.

Ulix is business software and is not directed to anyone under 18. We do not knowingly collect information from children.

If this policy changes, the date at the top of this page is updated. Material changes will be communicated in the application.

Questions about this policy or about your data can be sent to Axella Research at privacy@axellaresearch.com.