Privacy
Last updated 10/27/2026
Who we are
Pardés Invoices is a private invoicing and bookkeeping app run by RBR Hospitality LLC (DBA Pardés NYC), New York. Only invited businesses use it. Questions or requests: rephael@pardesnyc.co.
What the app keeps
- Your account: username, name, email and password (stored only as a secure hash by our sign-in provider).
- What your business enters: company details, clients, invoices, payments, expenses and receipt photos.
- If your business connects a bank (only when the app's admin switches Banking on for you): account names and last 4 digits, balances, and transactions (date, amount, description, the bank's category). Never your bank password: you sign in to your bank in Plaid's window, not in this app.
How it’s used
Only to run the app for your business: invoices and PDFs, emails you send to clients, matching bank deposits to payments, sorting charges into expenses, and backups. We don't sell data, show ads, or use tracking cookies. The app's cookies keep you signed in and remember which company you're working in; your light or dark choice stays in your browser.
Services that help run it
- Supabase: database, file storage and sign-in (United States).
- Vercel: hosting the app (United States).
- Plaid: connecting bank accounts. Plaid's own End User Privacy Policy covers what it does.
- Resend: delivering invoice emails.
- Anthropic (Claude): reading receipt photos you scan, and suggesting a category for unclear bank charges from the store name, amounts and the bank's category. No account numbers, balances, names or bank sign-ins are sent. Under Anthropic's commercial terms this data isn't used to train its models.
- Google Drive: nightly backups, to your business's own drive, when set up.
Learning from other businesses
A business can share, without names, what kind of expense a store is (for example “food cost”), so the app sorts charges better for everyone. Stores and businesses are scrambled with a secret key that only the server has; no amounts or dates are shared. Each business can turn this off on Banking → Rules, which removes what it shared.
How it’s protected
Every connection is encrypted (TLS). Each business's data is walled off in the database, so one business can't see another's. Bank access keys are encrypted and never reach your browser. Two-step sign-in with an authenticator app is available to every account.
Keeping and deleting
Your data stays while your business uses the app. Disconnecting a bank removes its accounts and transactions from the app and ends Plaid's access. To delete your account or your business's data, email rephael@pardesnyc.co and we'll do it within 30 days, apart from records the law requires a business to keep.