Privacy Policy

To prepare a return Pursor reads, from the systems you connect: each order’s date, amounts, tax collected and ship-to address; each marketplace’s settlements and the tax it remitted; the sales tax accounts in your ledger and the entries on them; the bank lines where a state debited you; the files your current provider produced, if you give them to the check; and every notice a state sends. It keeps each return as filed, with the state’s confirmation, for as long as you are a client.

We also hold the account details you give us (names, work email addresses, company name, the registrations you confirm) and billing records. Billing is by bank debit through Stripe; your bank account number goes to Stripe and we never see it.

Your customers are not Pursor’s customers. The ship-to address on an order is what decides which state and locality the tax belongs to, and it is read for that and for nothing else. A buyer’s name is not used, nothing about an individual buyer is profiled, sold or shared, and no marketing is ever sent to anyone who bought from you. If one of your customers asks you to have their data removed, one email to us does it.

Shopify. You install Pursor on your store from Shopify’s own consent screen, which lists the read-only permissions it asks for. Removing the app from your store, or disconnecting it from Pursor, deletes what was read from it; Shopify’s customer data requests and redactions are answered automatically.

Amazon and the other marketplaces. You authorise Pursor in Seller Central under Amazon’s finance role, and Pursor reads your settlements and the tax Amazon remitted on your behalf. Withdraw it under Manage Your Apps, or disconnect in Pursor; either deletes what was read. A marketplace with no connection is read from the reports you upload.

Your ledger. On QuickBooks you sign in on Intuit’s own pages and authorise Pursor for Intuit’s accounting scope, the only one Intuit offers. Pursor reads the sales tax accounts and posts the sales tax entries a person at your company has switched on, and nothing else: no payroll, no customers, no copy of your books. On another ledger, Pursor is a user or app you created and can disable. The tokens are stored encrypted, and disconnecting revokes them and deletes every record read.

Banks. You go through the bank’s own login in Plaid’s or Stripe’s window. Pursor never sees a bank credential and reads balances and transactions only, to match a state’s debit to its return. Disconnecting a bank revokes Pursor’s access; the transactions already read stay as your cash flow’s history until the account is closed.

State portals. Where a state offers preparer or third-party access, Pursor files under its own login and never holds yours. Where it must hold yours, the login is stored encrypted under its own key, bound to your company, and every time it is opened the event is recorded with who and why. The security page has the detail.

A notice from a state or a provider’s bill is read by Anthropic’s Claude models under commercial terms that do not permit training on your data. Each call is stateless: one document in, one reading out, checked against the figures it must foot to before anything is kept. A figure on a return is never produced by a model. What Pursor learns about your company lives in our own database, where it is yours and deletable, not inside any model.

When you connect Pursor to Claude, you sign in to Pursor and approve the connection yourself. Claude can then read, as you, what you can already see in Pursor. It cannot change anything. Pursor records each request Claude makes (who, which tool, what Claude passed it, when) as the audit trail of who read what. It never sees the rest of your conversation with Claude. Disconnecting from your Team page in Pursor ends the connection at once.

Shopify and Amazon (your store and seller accounts, under your own consent), Intuit (QuickBooks connections, under your own company), Plaid and Stripe (bank connections, under your own bank login), Anthropic (reading documents, no training), Neon (database hosting, US), Vercel (application hosting), Stripe (billing), Postmark (the emails Pursor sends), and the states’ own portals, in your name. Each receives only what its job requires. We do not sell data, share it for advertising, or move it to anyone else.

Disconnecting a system stops all reading from it immediately and deletes what was read. When a company leaves Pursor, every return we filed is handed to it with the state’s confirmation, and the rest is deleted on request; otherwise we retain it only while the account is active, plus what billing and tax law require us to keep.

Access tokens and portal logins are stored encrypted; connections use TLS; every sign-in takes a second step; each person’s access is scoped to their own sign-in. Details worth a sceptic’s time are on the security page.

You can ask what we hold about you, have it corrected, or have it deleted. Email contact@pursor.com and a person answers. If you are in a jurisdiction with statutory data rights (GDPR, CCPA and kin), those rights apply and we honour them.

If this policy changes materially, account owners are emailed before the change takes effect. The date at the top is the version.