Privacy policy.
What LedgR collects, why, where it is kept and for how long, in plain words. It covers this website, clientledgr.app, and the LedgR app at my.clientledgr.app.
Last updated .
- No cookies or trackersThis website sets none and runs none
- Basic Google profile to sign inGmail and texts only if you connect them, and only what’s with your clients is kept
- Kept in the United StatesLedgR’s database, in Google Cloud
- Never soldAnd not shared for advertising
Who we are
Lanting Digital LLC
LedgR is made and run by Lanting Digital LLC (“we”, “us”). Questions about this policy or your information go to caleb@lantingdigital.com.
This website
No cookies or trackers
clientledgr.app sets no cookies and runs no analytics, advertising or tracking scripts. It is served by Google’s Firebase Hosting.
The early-access form
If you ask about early access, we receive what you type:
- your name and email address;
- if you add them, your firm, your phone number and how you keep track of clients today;
- the time you sent it and your browser’s user-agent string.
We store it in LedgR’s database and email it to Caleb Lanting through Gmail, so he can reply. We use it only to get in touch with you about LedgR.
Stopping abuse
To limit how many requests one connection can send in an hour, the form counts requests by a one-way hash of your network address. The address itself is not stored.
Signing in to the app
Google sign-in, basic profile only
You sign in to my.clientledgr.app with your Google account. LedgR asks Google only for the standard sign-in permissions (openid, email and profile), which share your Google account ID, name, email address and profile picture.
What signing in does not give LedgR
Signing in does not give LedgR your Gmail, contacts, calendar or files. Gmail is a separate connection that each person chooses for themselves, described next.
If you connect Gmail
In Settings, you can connect your Gmail so emails with your clients appear on their pages. LedgR then asks Google for read-only access to your Gmail. Every few minutes it checks for new mail and keeps only messages sent to or from an email address that belongs to one of your firm’s clients, and Google Voice texts and voicemails from a client’s phone number. For each, it stores the sender, recipients, subject, date and text on that client’s page, where the people in your firm can see it. Any other mail is looked at by its sender and recipients only, and never stored. Google’s access for LedgR is kept encrypted on LedgR’s servers and never reaches a browser. You can disconnect at any time in Settings: LedgR gives the access back to Google at once, and messages already on client pages stay, as part of the firm’s records. LedgR’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is never used for advertising, never sold, and never used to train AI models.
If you connect texts from your Mac
In Settings, you can connect LedgR Helper, a small app for the Mac that has your iPhone’s texts in Messages. With your permission (macOS calls it Full Disk Access), it reads Messages on that Mac. LedgR sends it your firm’s client phone numbers and email addresses only in scrambled form (salted hashes), so the client list is never kept on the Mac in plain text. It sends LedgR only one-to-one texts with a client’s number or address from the past year onward: the text, the date, whether you sent or received it, and the client’s number. Group chats and texts with anyone else never leave the Mac. You can disconnect at any time, in Settings or on the Mac; LedgR stops accepting that Mac at once, and texts already on client pages stay, as part of the firm’s records.
What LedgR keeps
Your firm membership: your name, email address, your role (owner or assistant) and whether you are still active. Your browser keeps you signed in, so a refresh doesn’t sign you out.
Checking requests come from the app
The app uses Google’s reCAPTCHA Enterprise, through Firebase App Check, to confirm that requests come from the real LedgR app. Google processes information about your browser and device to do this.
Your firm’s records
The firm’s information stays the firm’s
Firms use LedgR to keep records about their clients and prospects: names, contact details, notes, call logs, follow-ups, tasks and pipeline figures. The firm decides what goes in. We hold it to provide LedgR to that firm.
Only the firm’s team can see it
Each firm’s records can be read only by that firm’s active members. How this is enforced is on the security page.
Our own access
We access a firm’s records only to run, support or secure LedgR, when the firm asks us to, or when the law requires it.
Requests from a firm’s clients
If you are a client of a firm that uses LedgR and want to see or change what the firm holds about you, ask the firm. We will help the firm answer.
Where it is kept, and who helps
In the United States
LedgR’s database is Google Cloud Firestore in the nam5 location, a multi-region within the United States. LedgR’s server code runs in Google Cloud’s us-central1 region.
Service providers
Google (Firebase and Google Cloud) hosts the website, the app and the database, handles sign-in and App Check, and Gmail carries the early-access emails to us. If you connect your Gmail, LedgR reads mail with your clients from it, as described above.
We don’t sell it
We do not sell personal information, and we do not share it for advertising.
How long it is kept
Early-access requests
We keep a request while we are in touch about LedgR. Ask us and we will delete it.
Firm records
Records are kept while the firm uses LedgR. Advisory firms have to keep their books and records, so notes are never rewritten: a correction is added as a new version and the original is kept, and the activity log can’t be changed. Deleting a client archives that client’s records instead of erasing them; they are kept for five years, in line with the SEC’s books-and-records rule for advisers (Rule 204-2), then destroyed. The owner can export everything at any time.
Backups
The database is protected by point-in-time recovery covering the last seven days and a daily backup kept for fourteen weeks. A deleted record can stay in those backups until they expire.
The records archive
Advisory firms must keep their books and records for years, so copies of the database also go into a separate archive set to hold each copy for six years. After that, the copy is destroyed.
When a firm leaves
The owner can export the firm’s records first, then close the firm in Settings (Your account, then Delete my account, then type the firm’s name). Everyone’s access ends at once and the records are deleted from the live app. A final copy goes into the records archive first; archive copies are kept for the retention period the books-and-records rules require, then destroyed. An assistant who deletes their own account just leaves the firm: what they wrote stays on the firm’s records under their name.
Security and incidents
How it is protected
Invite-only sign-in, each firm walled off from every other, owner and assistant roles and a server-written activity log. The security page has the details.
If something goes wrong
We will notify an affected firm within 72 hours of becoming aware of a security incident that affects that firm’s client information.
Your choices
See, correct or delete
Email caleb@lantingdigital.com to see, correct or delete information we hold about you. For records a firm keeps about you, ask the firm.
Children
LedgR is a tool for advisory firms and is not meant for children under 13.
Changes to this policy
When this policy changes, we will post the new version here with a new date.