Last Updated: 16 October 2026
1. Introduction
YourCFO ("we," "us," or "our") operates the website https://yourcfo.tech and the YourCFO financial planning platform (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.
2. Information We Collect
2.1 Account Information
When you register, we collect your name, email address, and organization details.
2.2 Financial Data
You may upload or input financial data including revenue projections, cost structures, cap tables, and historical financial records. This data is used solely to provide the forecasting and analysis features of the Service.
2.3 Third-Party Integration Data
When you connect third-party services, we receive data from those platforms to populate your financial model. Integrations include:
- QuickBooks (Intuit): accounting data such as income, expenses, and chart of accounts
- Xero: accounting data including profit & loss and balance sheet items
- HubSpot: CRM data such as deal pipelines and customer metrics
- Google Analytics: website traffic and conversion data
We only access data scopes you explicitly authorize during the OAuth connection flow. You can disconnect integrations at any time.
2.4 Payment Information
Payments are processed by Stripe. We do not store your credit card details. Stripe's privacy policy governs payment data: https://stripe.com/privacy.
2.5 Usage Data
We automatically collect technical information such as browser type, IP address, pages visited, and feature usage patterns to improve the Service. Browser-based analytics run only if you accept analytics cookies; see section 6.
3. How We Use Your Information
- To provide and maintain the financial planning Service
- To process your transactions and manage your subscription
- To sync data from connected third-party integrations
- To generate financial projections, forecasts, and scenario analyses
- To send service-related communications (e.g., account verification, billing notices)
- To improve and optimize the Service
- To comply with legal obligations
4. Data Storage & Security
Your data is stored securely using Supabase infrastructure with row-level security (RLS) policies ensuring data isolation between organizations. All data is encrypted in transit (TLS) and at rest. Integration credentials are stored using Supabase Vault encryption.
5. Data Sharing
We do not sell your personal or financial data. We share data only in these circumstances:
- Service Providers: Supabase (hosting), Stripe (payments), connected integrations you authorize, and, only if you accept analytics cookies, Google (Google Analytics) and PostHog (product analytics)
- Organization Members: Data is shared within your organization as configured by your team permissions
- YourCFO Staff: On concierge plans, a named YourCFO staff account is a member of your organization so our team can do the accounting and modelling work you have engaged us for. See 5.1 below
- Legal Requirements: When required by law, regulation, or legal process
5.1 Staff Access on Concierge Plans
If you are on a concierge plan, a named YourCFO staff account is added as an administrator of your organization and of your linked YourBooks business, so that our team can carry out bookkeeping, reconciliation, reporting and modelling on your behalf. That account can see and change the same data as any administrator on your own team, including your ledger, transactions and forecasts.
The account is listed in your member list alongside your own team and identified as a YourCFO account. It is added automatically when your plan includes concierge service, and on those plans it cannot be removed from within the product; contact us and we will remove it, which ends the concierge arrangement. On all other plans nothing is added unless you choose to add it, and you can remove it yourself at any time from your team settings.
Staff access is used only to deliver and support the Service. We do not use it to sell your data or to build products for other customers from your numbers.
6. Cookies and Similar Technologies
We use cookies and browser storage (such as local storage) in two groups: essential storage, which is always on, and analytics, which runs only if you accept it. We do not use advertising cookies and we do not run ads.
6.1 Essential Cookies and Local Storage
These are needed for the Service to work and do not require consent:
- Sign-in session: keeps you logged in across YourCFO and YourBooks
- Preferences: settings such as your selected organization or business and display options
- Your cookie choice: remembers whether you accepted or rejected analytics, so we do not ask again on every visit
- First-touch attribution: a record, kept in your browser's local storage, of how you first arrived at our site (for example the referring site or campaign link), so we can understand which channels bring visitors to us
6.2 Analytics (only with your consent)
If you accept analytics cookies, we use:
- Google Analytics 4 (Google): measures website traffic, such as pages viewed, how visitors arrive, and general device and location information
- PostHog: measures how the website and the product are used, such as pages viewed, clicks, and which features are used, so we can improve the Service. If you are signed in, this usage may be linked to your account
Until you accept, PostHog does not record any events and does not store anything in your browser, and Google Analytics does not set analytics cookies. Google Analytics is configured with Google Consent Mode, which may still send Google limited signals without cookies (for example, that a page was loaded). If you reject, analytics stays off.
Some events about your account (for example, that a data sync completed) may be recorded by our servers in PostHog as part of operating the Service and are not affected by your browser cookie choice.
6.3 Changing Your Choice
You can change your choice at any time using the Cookie settings link in the website footer, or here: . You can also clear cookies and local storage in your browser settings.
7. Your Rights
You have the right to:
- Access and export your data
- Correct inaccurate information
- Delete your account and associated data
- Disconnect third-party integrations at any time
- Opt out of non-essential communications
8. Data Retention
We retain your data for as long as your account is active. Upon account deletion, all associated data is permanently removed within 30 days.
9. Children's Privacy
The Service is not intended for individuals under the age of 18. We do not knowingly collect data from minors.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent notice on the Service.
11. Contact Us
If you have questions about this Privacy Policy, please contact us at [email protected].