Who we are and scope

Roxby is provided by PortalSix, LLC, a Maryland limited liability company. In this notice, “we,” “us,” and “our” refer to PortalSix, LLC.

This notice explains how we handle personal information when you create or use a Roxby customer account, use the web or mobile applications, connect a service, join a workspace, receive service messages, or contact customer support. The separate website privacy notice covers the public website, waitlist, and Help Center.

Our role and your workspace

We determine how we use account, service-administration, security, billing, and support information to operate Roxby. For that information, we act as the business or controller where those terms apply.

Customers decide what records to place in their workspaces, who may access them, and how to use the product's sharing and export features. When a business customer uses Roxby to process personal information for which it determines the purpose and means, we process that information for the customer as its service provider or processor. Direct questions about information controlled by a workspace to the workspace owner. We assist customers with applicable requests.

Information we collect

Depending on the features you use, we collect:

  • Account and authentication information: name, email address, verified-email status, authentication method, passkey public-key material and credential metadata, session and recovery information, and security events. We do not receive the private cryptographic key stored by your passkey provider.
  • Workspace and authority information: workspace names, legal entities, books, properties, ownership information, roles, memberships, invitations, permissions, and records of administrative actions.
  • Financial and rental records: bank and card account metadata, balances and transaction activity made available through a connection, booking and payout records, statements, receipts, invoices, accounting exports, categories, reconciliations, journal and report data, notes, and evidence you upload.
  • Commercial information: trial eligibility and dates, plan, subscription and billing status, payment and refund records, accepted terms, and cancellation history. A payment provider may collect payment-card information under its own notice; we do not need to store full card credentials.
  • Device and usage information: app and operating-system version, device type, language, time zone, network and request data, security signals, feature interactions, error codes, and bounded diagnostic information.
  • Support and communications: messages, attachments, call or meeting details you choose to provide, and the records needed to investigate and answer a request.

Do not include Social Security numbers, payment-card credentials, guest identity documents, health information, or other information the product does not request.

Sources of information

We receive information directly from you and other authorized workspace members. We also receive information from services you choose to connect, such as financial institutions, Plaid, booking channels, accounting products, identity providers, and property managers. Devices, browsers, and our service infrastructure provide request, security, and diagnostic information.

An administrator, accountant, manager, or co-owner may invite you or provide information about your role. A connected source may provide records concerning other people. The customer remains responsible for having authority to provide and use that information.

How we use information

We use personal information to:

  • create and secure accounts, sessions, workspaces, memberships, and permissions;
  • import, organize, reconcile, calculate, display, search, report, export, and preserve the records and audit history you request;
  • operate trials, subscriptions, billing, service notices, and customer support;
  • detect abuse, investigate security events, prevent unauthorized access, and protect customers and the service;
  • diagnose faults, measure approved product outcomes, and improve reliability and usability;
  • comply with law, enforce agreements, establish or defend legal claims, and complete authorized retention or deletion actions; and
  • carry out another purpose that we explain when we collect the information and, where required, obtain consent.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising or targeted advertising, and we do not use customer financial records for advertising.

How we disclose information

We disclose information to:

  • workspace members and recipients that an authorized user selects through invitations, permissions, sharing, or exports;
  • service providers that host, secure, store, transmit, monitor, or support Roxby under contracts and instructions appropriate to their role;
  • connected services when you authorize an exchange or ask us to perform an integration;
  • professional advisers, auditors, insurers, and authorities when reasonably necessary to comply with law, protect rights and security, or handle a claim or transaction; and
  • a successor in a merger, financing, reorganization, or sale, subject to appropriate confidentiality and applicable notice requirements.

The customer service-provider disclosure identifies the principal providers and optional integrations that may receive customer information.

Financial connections and imported records

When you connect a bank or card account through Plaid, Plaid and the financial institution process the information needed to establish and maintain the connection. Plaid provides Roxby with the account and transaction information you authorize for the selected service. Review Plaid's notices and permissions in the connection flow. We do not receive your bank password from Plaid.

When you connect or upload records from a booking channel, accounting product, or property manager, we process the records covered by your selection. Data availability depends on the source and the permissions you grant. Disconnecting a source does not delete information already imported into your workspace.

Automated features and AI

Roxby uses rules and automated systems to organize records, propose matches or categories, identify differences, and answer supported questions. These outputs may be incomplete or wrong and require review where the product indicates.

We do not use customer accounting content to train a model shared across customers or made available to third parties. If an external inference provider processes customer information for a feature, we minimize the information sent, prohibit provider training where the provider offers that control, apply the disclosed retention limit, and identify the provider before enabling that processing.

Retention and deletion

We keep ordinary workspace content while the workspace has an active trial or paid subscription, subject to customer deletion choices and legal holds.

For a trial that never becomes paid, you may view and export existing records for 30 days after trial expiration. Unless you reactivate or a legal hold applies, we delete ordinary workspace content from live systems by 90 days after trial expiration.

After a paid subscription ends, you may view and export existing records for 12 months. Unless you reactivate or a legal hold applies, we delete ordinary workspace content from live systems within 30 days after that access window ends. We send reminders 30 days and 7 days before access ends and confirm live-system deletion.

Ordinary recovery-backup copies expire within 90 days after deletion from live systems. We restrict them to disaster recovery, do not use them for reactivation, and reapply current deletion instructions before a restored system serves users.

We keep limited PortalSix business records on separate schedules:

  • invoices, payments, refunds, and tax records for seven years after the close of the fiscal year in which the transaction occurred;
  • accepted terms, checkout consent, cancellations, and material customer notices for seven years after the customer relationship ends;
  • a minimal record that a verified deletion request was completed for seven years after completion;
  • security, authentication, and administrative logs for 12 months, with 90 days readily searchable;
  • ordinary support records for two years after the matter is resolved;
  • confirmed incident or dispute evidence until resolution and for two years afterward, unless a different legal period applies; and
  • records subject to a legal hold until the hold is released, with each hold reviewed at least annually.

Where applicable law requires a separate privacy-request record, we retain the request and response for the required period, including at least 24 months when the California Consumer Privacy Act applies. These limited records do not include customer journals, receipts, imported statements, or other customer accounting content merely because that content might be useful evidence.

Your choices and privacy rights

Workspace permissions, connection controls, exports, and account settings let you review and manage many records directly. You may disconnect a source, but the disconnection does not automatically delete information already imported. Workspace owners may request workspace export or deletion. Deleting one user's login does not delete a shared workspace.

Depending on your location and our role, you may ask to access, correct, delete, or receive a copy of personal information; restrict or object to certain processing; withdraw consent; or appeal a denied request. You may also use an authorized agent where law permits. We do not discriminate against you for exercising a privacy right.

Send a request to privacy@roxby.app. We verify identity and workspace authority before disclosing or deleting information. We may deny or limit a request where law permits, including to protect another person's information, preserve security, comply with a legal obligation, or maintain information needed for a legal claim. If we process information only for a business customer, we may direct the request to that customer and assist it.

Security

We use administrative, technical, and organizational safeguards designed for the nature of the information we process. These include authenticated access, workspace and book permissions, encryption in transit, provider access controls, environment separation, audit records, and controls intended to prevent one workspace from accessing another.

No internet service can guarantee absolute security. Protect your sign-in methods, use your own account, review workspace access, and report suspected compromise to support@roxby.app.

International processing

We and our providers may process information in the U.S. and other countries where they operate. Those countries may have different data-protection laws. Where law requires a transfer mechanism, we use an applicable contractual or legal safeguard and require relevant providers to protect the information under their agreements with us.

We do not promise that every part of the service remains in one state or country unless a separate written agreement expressly provides that commitment.

Children

Roxby is intended for adults and is not directed to children. Do not create an account for a child or submit a child's personal information unless the product expressly requests it and you have the authority required by law.

Changes to this notice

We publish each approved version at a permanent version URL. We provide notice of material changes and obtain consent where applicable law requires it. The current privacy route identifies the version and effective date that apply.

Contact us

Email privacy questions and requests to privacy@roxby.app.

You may also write to:

PortalSix, LLC

306 W Redwood St, Suite 201 Baltimore, MD 21201 United States