Privacy

Last updated: October 16, 2026

This Privacy Policy explains how Graffend Corporation (“Bellfold,” “we,” “us,” or “our”) collects, uses, shares, and protects information in connection with the Bellfold service, app.bellfold.com, and www.bellfold.com (together, the “Service”). Graffend Corporation is located at 2120 University Ave., Berkeley, CA 94704, USA.

Bellfold emails the invoices you create in QuickBooks Online to your customers, from your own email account. To do that, it reads your invoices from QuickBooks Online and sends email through the email account you connect. This policy explains what that involves.

Information we collect

Account information. You sign in to Bellfold with your Intuit (QuickBooks Online) account. Intuit shares your email address and basic profile information with us; we keep only your email address. We also keep your account settings, including the notification contact and BCC email addresses you set up, and the email templates you save.
QuickBooks Online data. When you connect a QuickBooks Online company, we use Intuit’s authorization (OAuth) to read your company information and your invoices — including each invoice’s customer name, billing email address, invoice number, amount, due date, and invoice PDF — so we can email them for you. We store each invoice’s number, total amount, and billing email address, and a record of each email we send. We do not store customer names, invoice line items, or invoice PDFs; we fetch them from QuickBooks Online when an email is sent. Bellfold does not write to or change your QuickBooks Online data.
Your connected email account. To send invoice emails from your address, we store your email account’s address and the credentials needed to send from it. See “Your connected email account” below.
Payment information. Paid subscriptions are processed by Stripe. We give Stripe your company name and billing email address to set up your subscription. You enter your card details directly with Stripe, and they are handled under Stripe’s privacy policy; we do not receive or store full card numbers.
Website analytics. We use Google Analytics (GA4) on www.bellfold.com to understand how the site is used. It may collect your IP address, device and browser type, and the pages you view. The Bellfold app and docs.bellfold.com do not use analytics. See “Cookies and similar technologies”, including how the site responds to “Do Not Track.”
Support communications. If you contact us, we receive the information you choose to share.

Your connected email account

Bellfold sends your invoice emails from your own email account, so they come from your address and your customers’ replies go to you. You connect one email account:

Google Workspace or Gmail. We ask Google for permission to send email on your behalf (the gmail.send scope) and for your email address (openid and email). We do not request any permission to read your mail.
Microsoft 365 (work or school account). We ask Microsoft for permission to send mail as you (Mail.Send), to sign you in and read your basic profile (User.Read, openid, profile, email), and to keep sending when you are not signed in (offline_access). From your profile we read and store only your email address. We do not request any permission to read your mail.
Your own mail server (SMTP). If you connect an SMTP server, we store its host name, port, user name, and password.

How we use it. We use your connected email account only to send the invoice emails that Bellfold sends for you — from your address, to the billing email addresses on your invoices and any BCC address you set up — and to show you which account is connected. Microsoft 365 saves a copy of each email in your Sent Items folder, and other providers may also keep a copy in your sent mail.

What we don’t do. We never read, search, or store the contents of your mailbox — your inbox, sent mail, contacts, or calendar. We do not keep the emails we send: we keep a delivery record (the recipients, the time, the delivery status, and any error), not the message or its attachment.

How we protect it. Bellfold encrypts the access and refresh tokens from Google and Microsoft, and your SMTP password, with AES-256-GCM before storing them, in addition to the database encryption described under “Security”.

Disconnecting. While your subscription or free trial is active, you can disconnect your email account in the app’s settings. Disconnecting immediately deletes the tokens or SMTP password we hold, and Bellfold stops sending from that account. After your account ends and becomes read-only, it can no longer be disconnected in the app; we delete the stored credentials when we delete your account. Disconnecting in Bellfold does not, by itself, remove the permission you granted at Google or Microsoft. You can remove it at any time from your Google Account’s third-party apps and services page or Microsoft’s My Apps page. A record that the account was connected and disconnected, including its email address, is kept as described under “Data retention and deletion”.

Google user data and Limited Use

Bellfold’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

We use Google user data only to provide Bellfold’s invoice-sending feature that you see and control in the app.
We transfer Google user data only as needed to provide that feature, for security purposes, to comply with applicable law, or as part of a merger, acquisition, or sale of assets after obtaining your explicit prior consent.
We do not sell Google user data, use it for advertising, or transfer it to advertising platforms, data brokers, or information resellers, and we do not use it to determine credit-worthiness or for lending.
Google Workspace APIs are not used to develop, improve, or train generalized or non-personalized AI and/or ML models.
People at Bellfold do not read Google user data unless you give us your affirmative agreement to view specific data (for example, to help with a support request), it is necessary for security purposes such as investigating abuse, or it is necessary to comply with applicable law.

We apply the same commitments to information we receive from Microsoft, and we do not use information from Microsoft for advertising or marketing.

How we use information

We use information to provide and operate the Service: to detect new invoices in QuickBooks Online and email them for you, to send you account notifications, to bill your subscription, to respond to support requests, to keep the Service secure, and to improve the Service. Information from your connected email account is used only as described in “Your connected email account”. We do not sell your personal information.

We share information only with the service providers and parties needed to run the Service, and where required by law. Our service providers process information on our behalf, under our instructions and confidentiality obligations:

Amazon Web Services (AWS) — hosts and runs the Service, including www.bellfold.com and docs.bellfold.com, in the United States (US East, N. Virginia). Amazon Simple Email Service (SES) sends Bellfold’s own account notifications — for example, connection problems, failed sends, and billing and trial reminders — to the notification contacts on your account. SES does not send your invoice emails.
MongoDB Atlas (MongoDB, Inc.) — stores the Service’s database and its backups, on AWS in the United States.
Stripe — processes subscription payments.

Other parties receive information as part of the Service you use:

Intuit / QuickBooks Online — you sign in with Intuit, and we read the QuickBooks Online data you authorize. We access, store, and otherwise process that data on your behalf, not on Intuit’s behalf.
Your email provider — Google, Microsoft, or the operator of your SMTP server. Your invoice emails, including recipient addresses and any attached invoice PDF, pass through the provider you connect, under that provider’s own terms and privacy policy.
Google — Google Analytics and Google Fonts on www.bellfold.com.

We may also disclose information if required by law or legal process, to protect the rights, property, or safety of Bellfold, our users, or others, or as part of a merger, acquisition, or sale of assets (subject to the additional limits above for Google user data).

Information about your customers and other recipients

The Service processes information about people who are not Bellfold users: your customers (their names, billing email addresses, and invoice details), the recipients of your invoice emails, and the notification contacts and BCC addresses you add. We process this information on your behalf and on your instructions, as your service provider, only to provide the Service to you. You are responsible for having the right to email these people and for giving them any notice the law requires. If one of your customers contacts us about their information, we will refer them to you and help you respond.

Data retention and deletion

We keep your account and QuickBooks Online data while your account is active.

When your subscription or free trial ends. Your account ends when your subscription period or free trial actually ends, not on the day you ask to cancel. Your account then becomes read-only for 90 days, and you can reactivate it during that time. Bellfold does not send invoice emails while your account is read-only. During that time Bellfold may still receive notices from QuickBooks Online about new or changed invoices, and it records each invoice’s number, amount, and billing email address; to stop this sooner, disconnect Bellfold in QuickBooks Online’s app settings. When the 90 days end, we delete your account and its data, including your QuickBooks Online and email-account credentials, invoice records, send history, templates, and settings, and we email your notification contacts to confirm the deletion. Our deletion process runs daily, so this happens within a day after the 90 days end. If your subscription is paused because a payment failed, your account has not ended; it ends, and the 90 days begin, when the subscription is cancelled.

What deletion does not cover.

Security and audit records — a log of actions on your account, which can include your company name and the email addresses of the people and email account involved — are kept for up to 400 days after each action, for security, fraud prevention, and legal compliance.
Backups. Copies of deleted data remain in our encrypted database backups until those backups expire, up to 12 months.
Service logs, which can include account identifiers and occasionally an email address, are kept by our hosting provider to operate, troubleshoot, and secure the Service, and are not deleted when your account is deleted.
Billing records held by our payment processor, Stripe — your customer record there, your invoices, and your payment records, which include your company name and billing email address — are kept for tax and accounting purposes. If you ask us to delete your data, we also delete your customer record at Stripe, including any saved payment method; your invoices and payment records are kept.
Emails already sent remain in your recipients’ mailboxes and in your own sent mail, which Bellfold does not control.

If you never start a trial. If you connect a QuickBooks Online company but never start a free trial, Bellfold stays connected to it: it continues to receive notices about new and changed invoices and records each invoice’s number, amount, and billing email address, but does not email them. This continues until you disconnect Bellfold in QuickBooks Online’s app settings. To have the data deleted, ask us as described below.

Disconnecting QuickBooks Online. You can disconnect Bellfold from your QuickBooks Online company at any time from QuickBooks Online’s app settings. Disconnecting stops Bellfold’s access to your QuickBooks Online data, but does not by itself delete the data we already hold.

Asking us to delete your data. To have your account and its data deleted sooner, email support@bellfold.com. Before acting, we will verify that the request comes from an administrator of the QuickBooks Online company. Deleting your account also cancels any subscription and deletes your customer record at Stripe. We will delete the data within 30 days of verifying the request and tell you when it is done, subject to the exceptions above.

Security

We use reasonable technical and organizational measures to protect information. Information is encrypted in transit and at rest: our database and its backups are encrypted at rest, and Bellfold additionally encrypts email-account tokens and SMTP passwords before storing them, as described above. We limit access to production systems and data to the people who need it to run the Service. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Where we store information

Bellfold stores and processes information in the United States. If you use the Service from outside the United States, your information is transferred to and processed in the United States. Intuit, Stripe, Google, Microsoft, and your SMTP provider handle information under their own policies and may process it in other locations.

Cookies and similar technologies

Bellfold app. The app uses only essential cookies, which are needed to sign you in: a session cookie that lasts up to 8 hours, and short-lived cookies (about 10 minutes) that protect the sign-in and email-connection steps. The app does not use analytics or advertising cookies.
www.bellfold.com. Google Analytics sets cookies (_ga and _ga_<ID>) to measure site usage. The site also loads its fonts from Google Fonts, which sends your IP address and browser information to Google. Google may collect information about your online activities over time and across different websites when you visit www.bellfold.com; learn how Google uses information from sites that use its services. We do not otherwise allow third parties to collect information about your online activities over time and across websites through the Service.
Do Not Track. When your browser sends a “Do Not Track” signal, www.bellfold.com does not configure Google Analytics, send it measurement data, or set its cookies. Your browser still downloads Google’s analytics script and fonts from Google, which exposes your IP address and browser information to Google. The Service does not otherwise respond to Do Not Track or similar signals.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, or to object to certain processing. To exercise these rights, contact us at support@bellfold.com. For deletion, see “Data retention and deletion”.

Children’s privacy

The Service is intended for businesses and is not directed to children under 13, and we do not knowingly collect their personal information.

Changes to this policy

We may update this Privacy Policy from time to time. Changes take effect when we post the revised policy on this page, and we will update the “Last updated” date above. If we make a material change, we will also notify account holders by email or in the app before it takes effect. If we change how we use information from your connected email account, we will ask for your consent before the change applies to you.

Contact us

Questions about this Privacy Policy or our data practices? Contact Graffend Corporation at support@bellfold.com or 2120 University Ave., Berkeley, CA 94704, USA.