Privacy policy
Fairlead Expenses is an internal application for Allyx personnel. This policy explains what personal data it holds about you, why, who else receives it, and how to reach us about it.
1. Who this policy covers
Fairlead Expenses (the "Application") is operated by Allyx, Inc., a Delaware corporation ("Allyx," "we," "us," or "our"). It is not offered to the public or to Fairlead customers. Only Allyx employees, contractors, and other personnel whom Allyx has approved may sign in ("you").
Allyx is the controller of the personal data described here. This policy covers the Application only. The Fairlead platform and website are covered by the Fairlead privacy policy. Your employment or engagement with Allyx, and any Allyx policy on expenses and reimbursement, may give you further information about how Allyx handles personnel data.
2. What we collect
Sign-in and account data
You sign in with your Google account. Google tells us your email address and, where your Google account provides them, your name and profile picture address. We never receive your Google password. Administrators assign you roles, such as submitter, approver, or administrator, and can suspend your access.
Expense records
When you create or act on a reimbursement, purchase, or bill, we store what you enter: the vendor or payee, dates, amounts, currency, reference numbers, business purpose, account coding, and the receipts and other files you attach. We also record who submitted, approved, returned, reopened, voided, or exported each document, and when.
Accounting records
When an administrator connects the Application to Allyx's QuickBooks Online company, the Application reads and stores the employee, vendor, and account lists it needs to code and export expenses. If you are an employee or contractor, this may include your name and email address as they appear in QuickBooks. Approved expenses are written back to QuickBooks as bills or purchases, with their attachments.
Security and technical data
For each session we store a session record and its expiry. For security-relevant events, such as sign-in, access changes, approvals, exports, and rejected requests, we record the action, its outcome, the time, the request method and path, your IP address, and your browser's user agent. Passwords, access tokens, cookies, and file contents are removed from these records before they are stored.
We do not use analytics, advertising, or tracking tools in the Application, and we do not ask for special categories of personal data. Please do not put health or other sensitive details in a business purpose or an attachment unless an Allyx policy requires it.
3. How we use it
We use this data only to run Allyx's expense process:
- to sign you in, confirm that you are approved, and apply the permissions of your roles;
- to record, review, approve, and export expenses, and to reimburse personnel;
- to keep Allyx's accounting records in QuickBooks Online accurate and complete;
- to secure the Application, investigate misuse, and keep an audit trail of financial and access decisions; and
- to meet Allyx's legal, tax, and audit obligations, and to establish or defend legal claims.
Where the law requires a legal basis, we rely on the performance of your employment or engagement, Allyx's legitimate interest in managing and auditing its finances securely, and compliance with legal obligations. Every approval is made by a person. The Application does not make automated decisions about you, does not sell or share your personal data for advertising, and does not use it to train artificial intelligence models.
4. Who receives it
Inside Allyx, your records are visible to the people whose roles require them: you, the approvers and administrators of the Application, and Allyx finance and accounting staff. Outside Allyx, these service providers process data for the Application:
| Provider | Purpose | Data |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, file storage, and network protection | All data held by the Application |
| Google LLC | Sign-in with your Google account | Email address, name, profile picture address |
| Intuit Inc. (QuickBooks Online) | Allyx's accounting system of record | Employee, vendor, and account lists; exported expenses and attachments |
Google and Intuit also act under their own privacy policies for the accounts Allyx and you hold with them. We may disclose personal data to Allyx's accountants, auditors, and legal advisers, to a successor in a merger or acquisition, or where the law, a court, or a public authority requires it.
5. Cookies and browser storage
The Application uses only what it needs to work. A session cookie keeps you signed in. It expires after 7 days without activity and after 30 days at most, and it is removed when you sign out. A short-lived cookie protects the Google sign-in step and expires within 10 minutes. Your browser's local storage keeps your display preferences: light or dark mode, the ledger columns you chose, and whether the side menu is collapsed. These preferences stay on your device and are not sent to us.
6. How long we keep it
Expense records, attachments, and the accounting data behind them are kept for as long as Allyx needs them to meet its accounting, tax, and audit obligations. Security audit records cannot be edited or deleted in the Application, so that the trail of financial and access decisions stays complete. When you leave Allyx, your access is suspended, and your records are kept with Allyx's financial records for the same periods. Sessions end at the limits described in section 5.
7. How we protect it
- Access is limited to approved Google accounts and to the permissions of each person's roles.
- Data travels over encrypted connections, and the QuickBooks connection credentials are encrypted at rest.
- Receipts and attachments are served only to signed-in users with access to the document.
- Administrators can review and revoke active sessions, and every access and financial decision is written to the audit trail.
No system is perfectly secure. If a breach affects your personal data, we will tell you and any authority we must notify, within the time the law requires.
8. Your choices and rights
You can see and correct your own expense records in the Application while they are drafts or returned to you. Depending on where you live, you may also have the right to access, correct, or delete your personal data, to restrict or object to its use, to receive a copy in a portable format, and to complain to a data protection authority. Some records must be kept to meet legal obligations, so deletion may not always be possible. We will explain when that applies. We will not treat you differently for exercising these rights.
To make a request, email privacy@fairleadhq.com. We may need to confirm your identity first, and we will reply within the time the law allows.
9. Where it is processed
Allyx is based in the United States, and the Application's providers may process data in the United States and in other countries where they operate. If you work for Allyx from outside the United States, we rely on the safeguards the law recognises for these transfers, such as standard contractual clauses, where they are required.
10. Changes to this policy
We may update this policy when the Application or the law changes. We will post the new version here with a new effective date and tell Application users about any material change before it takes effect.
11. Contact
Allyx, Inc., attention: Privacy. Email privacy@fairleadhq.com. For legal notices, email legal@fairleadhq.com.