What we collect, and what we do with it.

This policy covers goatkeeper.io, the Goatkeeper app, and the bookkeeping and tax work we do. Goatkeeper is operated by High Leverage, LLC (“we,” “us,” or “our”). Our terms of service are the agreement between us; this page explains how we handle information under it.

What we collect

What you tell us. Your name, email, phone number, and business name and details, such as its address, entity type, and EIN. The messages you send your team or Gus, and your answers about transactions. The names you type when you sign an agreement or consent, with the date, the version, and the IP address and browser you signed from.

What you send us for your books and returns. Bank and card statements, receipts, prior returns, and tax documents such as W-2s, 1099s, and K-1s. These can include your Social Security number and information about your spouse and dependents. Your Social Security number reaches us only on those documents and in the answers your returns require, never through a form on this website.

What your bank tells us. Transactions, balances, and account names, only for accounts you connect yourself through Plaid. We never see or store a bank login.

What Commas tells us. Whether a payment went through, the amount, and the date. Commas holds your card or bank details; we never see them.

What your browser and device tell us. Pages you visit on goatkeeper.io and in the app, the site that sent you, the campaign link you came from, your browser and device type, and your IP address and the country it points to. In the app we also record sign-ins and who viewed or changed what in your books, so there is a record if anything ever looks wrong.

What others tell us. If someone refers you to us, their name and the contact details they gave us for you.

We do not buy personal information about you from anyone.

Why we use it

• To keep your books, prepare and file your returns, and answer your questions.
• To run your account: signing you in, sending you texts and emails about your books, and keeping the app working.
• To bill the subscription and any back work through Commas.
• To keep your information safe, prevent fraud, and keep records of who did what.
• To meet our legal duties, such as keeping tax records and answering lawful requests.
• To tell people who asked about Goatkeeper, such as by booking a call, about the service. Every marketing email has a way to stop them.
• To see which pages and campaigns bring people to us, counted by our own script.
• To advertise Goatkeeper and measure whether our ads work, using what happens on our public website. See “Advertising” below.

Nobody pays us for personal information. Nothing from your books, your bank accounts, your documents, your messages with your team, or your tax returns is ever shared with an advertising company or used for advertising. We do advertise, and our public website shares limited information with the advertising platforms we use. The “Advertising” section below says exactly what, and how to opt out.

Your tax return information

Because we prepare tax returns, federal law (section 7216 of the Internal Revenue Code and Treasury Regulation 301.7216) limits how we use and share your tax return information. We use it to keep your books and prepare and file your returns. We share it with the services below only with your consent to disclose, and we use it for anything else only with your consent to use, which is optional. You sign each consent separately in the app, on its own screen, and you can read them on our tax information consents page. Nothing in this policy replaces or widens those consents.

Federal financial privacy law also applies to a tax preparer. We do not share your nonpublic personal information with companies outside Goatkeeper except to provide the service you asked for, with your consent, or as the law allows or requires.

Bank connections

Bank connections run through Plaid. When you connect an account, you enter your bank credentials on Plaid’s screen, not ours, and we never see or store them. Plaid sends us transaction and balance data for the accounts you picked, and its handling of your information is covered by the Plaid end user privacy policy. Disconnect an account in the app and the feed stops.

Who else touches your information

Your bookkeeper and your accountant see your books because that is the job. Past them, we use a short list of outside companies, each doing one job for us, and each getting only what that job needs:

• Supabase stores your books, documents, returns, messages, and account, on servers in the United States.
• Vercel hosts this site and the Goatkeeper app, and runs the code behind them.
• Google (Gemini), Anthropic (Claude), and OpenAI provide software that reads your bank statements and transactions and suggests how each one is sorted, and that reads the messages you send us, along with your books, to draft answers to your questions, including Gus’s. A person on our team checks what it suggests and steps in whenever an answer needs one. They receive your statements, transactions, messages, and the parts of your books a question is about, not your Social Security number, and they may process it outside the United States.
• Plaid connects the bank accounts you choose to connect, and sends us their transactions and balances.
• Commas processes your payments. It receives your name, email, business name, and the amount of each charge.
• Resend delivers the email we send you.
• Advertising platforms, such as Meta, Google, TikTok, and LinkedIn, receive what the “Advertising” section below describes, from our public website only. They receive nothing from the app.
• Twilio and Ready deliver the text messages we send you, if you have agreed to get them. They receive your phone number and the text of each message.
• Slack carries messages inside our own team, such as a note that a new statement arrived or a question needs an answer, so the right person picks it up. It receives your business name and short notes about work waiting on your books.

We may also share information with our lawyers, accountants, and insurers when they advise us, under a duty to keep it confidential. If Goatkeeper is ever sold or merged, your information would go to the new owner under this policy, and we would tell you first. We hand information to a government agency only when the law requires it, and we tell you unless the law bars us from telling you.

Text messages

We text you only if you agree to it. When you book a call, you agree to up to 3 reminders about that call. If you sign up for transactional messages on our text sign-up form, or become a client and turn them on, we also text about your account: appointment reminders, a statement we need, a question waiting on you, a month that closed, or a deadline. We send marketing texts (promotions and offers, about 4-6 a month) only if you tick the separate marketing box on that form. Message frequency varies. Message and data rates may apply. Reply STOP to stop and HELP for help. Agreeing to texts is never a condition of buying anything. The details are in our SMS terms.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are not shared with any third party.

Cookies and tracking

This site and the app use our own script to count visits and remember which page or campaign first brought you here. It sets two cookies of our own: one that recognizes your browser for a year, and one that lasts for a single visit. It never reads what you type into a form. If your browser sends a Global Privacy Control or Do Not Track signal, our counting script on this site does not run. The app also keeps you signed in with storage on your device, which it needs to work.

Our public website also carries tags from the advertising platforms we use. They set their own cookies. The next section covers them.

Advertising

We run ads for Goatkeeper on platforms such as Meta (Facebook and Instagram), Google (including YouTube), TikTok, and LinkedIn. To show those ads to the right people and to know which ones work, our public website, goatkeeper.io, shares the following with the platforms we advertise on:

• Pages you view on goatkeeper.io, along with what a browser normally sends: your IP address, your browser and device type, the platform’s own cookie or click identifier, and the address of the page.
• That you took a step toward becoming a customer, such as booking a call or sending us your details.
• A scrambled (hashed) copy of the name, email address, and phone number you gave us when you took that step, so the platform can match it to an ad you saw. The platform can match it only to an account it already holds for you.

The platforms may use this to measure our ads, to show our ads to you again, and to find people similar to you. Each one handles what it receives under its own privacy policy and gives you its own ad settings.

What is never shared for advertising. Anything from the Goatkeeper app. Your books, transactions, bank connections, documents, messages with your team, and tax returns stay out of advertising entirely. There are no advertising tags inside the app. Federal law (section 7216) separately bars us from disclosing your tax return information to an advertising platform without your written consent, and none of the consents we ask you to sign covers that.

How to opt out. Turn on Global Privacy Control or Do Not Track in your browser. When our website sees either signal, the advertising tags never load and we send the platforms nothing about your visit or your booking. You can also write to goat@goatkeeper.io and we will stop sharing your information for advertising and ask the platforms to remove what we sent.

How long we keep it

Your books, returns, and the documents behind them stay with us for seven years after the last return we filed for you, which is the window the IRS and the states can reach back into, and are then deleted. The records of what you agreed to and signed, and the log of who did what in your account, are kept at least as long, because they are how anyone can prove what happened. If you never became a customer, we keep what you told us when you asked about Goatkeeper only while we might still be talking, and delete it when you ask. Anything we are not required to keep, we delete sooner when you ask.

How it is protected

Information is encrypted in transit and at rest. Access inside the company is limited to the people working on your account, needs a second sign-in step, and is logged in a record no one on our team can edit. Our information security policy is written down and is available on request. No service can promise a breach will never happen; if one touches your information, we tell you what happened and what we are doing about it, as the law requires.

What you can ask for

• A copy. Everything we hold about you and your books, in common formats.
• A correction. Anything we have wrong.
• Deletion. Anything we are not required by law to keep. Tax records and the signed records above stay for as long as the section above says, and we tell you what we kept and why.
• Stopping texts or marketing email. Reply STOP to a text, use the link in an email, or ask us.
• Taking back a tax information consent. Any time, under Agreements in the app.

Write to goat@goatkeeper.io from the email on your account, or ask your team in the app. We confirm within 10 days and answer within 30. If we ask for more to confirm it is really you, it is only to protect your information. Someone you authorize in writing can ask for you. If we say no to any part of a request, we tell you why, and you can ask us to look at it again. We never treat you differently for asking.

Cancel and your records go with you. We do not hold a customer’s records back over a bill.

State privacy laws

Some states, including California, Virginia, Colorado, Connecticut, and Texas, have privacy laws that give their residents rights to know, see, correct, and delete personal information, and to opt out of its sale, targeted advertising, and certain profiling. Many of those laws apply only to companies above a size threshold, and many do not cover information that federal financial privacy law already covers. Where one of them applies to us, you have its rights, and we give everyone the rights in the section above whether or not a law requires it.

For those laws: nobody pays us for personal information. Some of these laws define “sale” or “sharing for targeted advertising” broadly enough to cover the advertising tags on our public website, described under “Advertising” above, which we began using on October 13, 2026. You can opt out of that at any time by turning on Global Privacy Control or Do Not Track in your browser, which we honor automatically, or by writing to goat@goatkeeper.io. We will not treat you differently for opting out. We do not use it for profiling that leads to decisions with legal or similarly significant effects. We use sensitive information, such as Social Security numbers and account details, only to provide the service. California residents may also ask which companies, if any, received their personal information for those companies’ own direct marketing; the answer is none.

Children

Goatkeeper is for adults running businesses. We do not knowingly collect information from anyone under 18 through the site or the app. A tax return can include information about your children as dependents, which you give us; we handle it the same way as the rest of your tax information.

Changes

When this policy changes how we handle your books, your bank information, or your tax return information, we email customers before the change takes effect. Other changes, such as a new advertising platform or a new company on the list above, are posted here with a new date at the top. The date at the top is the last time anything changed.

Reaching a person

Write to goat@goatkeeper.io and a real person answers. Goatkeeper is operated by High Leverage, LLC in the United States.

Parts of this policy are adapted from templates that General Legal, PC published under the CC0 1.0 license. General Legal has not reviewed this policy.