DB

DistributorBooks

Privacy Policy

1. Who We Are

DistributorBooks ("we," "us," "our") is a self-hosted software application for MLM and direct sales distributors. It is developed and maintained as a private software product. The software is installed and operated on a server controlled by the software owner.

For purposes of this Privacy Policy, the software owner acts as the data controller — meaning we determine how and why personal data is processed within the application.

Contact: admin@distributor-books.com

2. Data We Collect

We collect data in two ways: information you provide directly, and information generated automatically by your use of the software.

2.1 Account and Identity Data

When you create an account or are added by an administrator, we collect:

Data	Purpose	Required?
Full name	Identify your account and personalize the interface	Yes
Email address	Account login, password reset, notifications	Yes
Username	Account login	Yes
Password (hashed)	Authenticate your login — stored as a bcrypt hash, never plain text	Yes
Phone number	Optional contact information shown in your profile	No
MLM company / type	Enable company-specific features (e.g. LifeWave commission calendar)	No
Distributor ID	Reference your MLM company distributor number	No

2.2 Billing and Payment Data

Data	Purpose	Who Holds It
Billing address	Required for payment processing and invoices	DistributorBooks database
Credit card details	Payment processing for subscriptions	Stripe only — we never see your full card number
Card last 4 digits & expiry	Display your saved card on the subscription page	DistributorBooks database
Stripe customer ID	Link your account to your Stripe customer profile	DistributorBooks database
Invoice and payment records	Billing history and accounting	DistributorBooks database

2.3 Financial Tracking Data (User-Entered)

The core purpose of DistributorBooks is financial tracking. You enter this data voluntarily:

• Income entries — amounts, dates, categories, descriptions, payment method
• Expense entries — amounts, dates, categories, mileage, receipt images
• Sales records — customer info (optional), product, price, commission
• Commission log — weekly amounts, status, pay dates
• Work hours — clock-in and clock-out times, dates, descriptions
• SSA-related data — SSN last 4 digits, claim number, benefit type, IRWE details (optional, only if SSA reporting is enabled for your account)

This data is stored solely to provide the service you requested. It is not analyzed, mined, or shared.

2.4 Automatically Collected Data

Data	Purpose
Login timestamps	Security audit log — track when accounts are accessed
Activity log entries	Record significant actions (data exports, password changes, admin actions) for security and debugging
Session data	Keep you logged in during your browser session — stored server-side, expires on logout

We do not collect IP addresses beyond what your server logs automatically, do not use cookies beyond session management, and do not use any web analytics, tracking pixels, or third-party analytics scripts.

3. How We Use Your Data

We use your data only for the following purposes:

• Providing the service — generating reports, displaying your financial records, calculating NESE for SSA reporting
• Account management — creating and managing your account, authenticating logins, processing password resets
• Billing and payments — creating invoices, processing subscription payments via Stripe, maintaining billing records
• Communication — sending transactional emails you request (password reset, invoice delivery, trial ending notice)
• Security — detecting and preventing unauthorized access, maintaining audit logs
• Legal compliance — retaining records as required by applicable law

We do not use your data for marketing profiling, behavioral advertising, machine learning model training, or any purpose beyond operating this software for you.

4. What We Do Not Collect or Do

5. Third-Party Services

DistributorBooks uses a minimal number of third-party services. Here is exactly what each one receives:

Service	Purpose	Data Shared	Their Privacy Policy
Stripe	Payment processing for subscriptions	Name, email, billing address, card details (handled entirely by Stripe — we never receive your full card number)	stripe.com/privacy
Google Fonts	Typography (Outfit font loaded from Google CDN)	Your IP address and browser type are sent to Google's CDN when the page loads	policies.google.com/privacy
Your FTP server (optional)	Backup and data export destination you configure	Only the data you choose to export — sent to your own server using credentials you provide	N/A — your own server

No other third-party services receive your data. We do not use Google Analytics, Facebook Pixel, Intercom, HubSpot, or any marketing or analytics platform.

6. Data Storage and Security

DistributorBooks is self-hosted software. Your data is stored on the server where this software is installed — not in a shared public cloud. The security of your data depends significantly on the security of that server.

Security measures built into the software:

• Passwords — hashed using bcrypt with a work factor of 10. Plain text passwords are never stored.
• Sessions — server-side PHP sessions with secure session IDs. Sessions expire on logout.
• CSRF protection — all forms use CSRF tokens to prevent cross-site request forgery attacks.
• Input sanitization — all user input is sanitized before display to prevent XSS attacks.
• Parameterized queries — all database queries use prepared statements to prevent SQL injection.
• Role-based access control — users can only access their own data. Admins use impersonation to view other accounts.
• Receipt uploads — stored outside the web root with IIS permissions restricting direct access.
• Card data — full card numbers are never transmitted to or stored by this software. Stripe handles all card data via their PCI DSS-compliant infrastructure.

Server security is your responsibility:

As a self-hosted application, you are responsible for keeping the server, operating system, PHP, and MySQL up to date, enabling HTTPS with a valid SSL certificate, and restricting server access to authorized users.

7. Data Retention

Data Type	Retention Period
Account data	Retained while your account is active. Deleted within 30 days of an account deletion request.
Financial records (income, expenses, sales, commissions, hours)	Retained while your account is active. You may delete individual entries at any time. All records deleted with your account.
Invoices and payment records	Retained for 7 years to comply with standard accounting and tax record requirements, even after account deletion.
Activity log	Retained for 12 months, then automatically purged.
Session data	Deleted on logout or after 24 hours of inactivity.
Backup files	Retained for the period configured in Admin → Backup Settings (default 30 days), then automatically deleted.

8. Your Rights

Regardless of where you are located, you have the following rights with respect to your personal data:

To exercise any of these rights, contact us using the details in Section 13. We will respond within 30 days. We do not charge a fee for reasonable requests.

9. GDPR — EU and UK Users

If you are located in the European Union or United Kingdom, the General Data Protection Regulation (GDPR) applies to the processing of your personal data. Our legal basis for processing is:

Processing Activity	Legal Basis
Running your account, delivering the software service	Contract — necessary to perform the service you signed up for (Article 6(1)(b))
Processing subscription payments	Contract — necessary to fulfill your subscription agreement (Article 6(1)(b))
Sending transactional emails (password reset, invoice, trial notice)	Legitimate interests — necessary to operate the service (Article 6(1)(f))
Maintaining security and audit logs	Legitimate interests — fraud prevention and system security (Article 6(1)(f))
Retaining billing records	Legal obligation — accounting and tax record requirements (Article 6(1)(c))

In addition to the rights listed in Section 8, EU/UK users have the right to lodge a complaint with your national data protection authority. In the UK, this is the Information Commissioner's Office (ICO). In the EU, find your authority at edpb.europa.eu.

Since DistributorBooks is self-hosted software, cross-border data transfers depend on where you choose to host your server. If you host outside the EU, you are responsible for ensuring your hosting arrangement complies with GDPR Chapter V requirements for international transfers.

10. CCPA / CPRA — California Residents

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you additional rights:

• Right to Know — You have the right to know what personal information we collect, use, and disclose. This Privacy Policy serves that purpose.
• Right to Delete — You may request deletion of your personal information, subject to certain exceptions (such as billing records required by law).
• Right to Correct — You may request correction of inaccurate personal information we hold about you.
• Right to Opt Out of Sale or Sharing — We do not sell or share your personal information for commercial purposes. No opt-out is necessary.
• Right to Non-Discrimination — We will not discriminate against you for exercising any of your CCPA rights.
• Right to Limit Use of Sensitive Personal Information — We collect SSN last 4 digits and financial data solely to provide the service. We do not use sensitive personal information beyond what is necessary to operate the software.

To submit a verifiable consumer request, contact us using the details in Section 13. We will respond within 45 days. You may designate an authorized agent to make a request on your behalf.

Categories of personal information collected in the past 12 months: Identifiers (name, email, username); financial information (income, expenses, billing data); commercial information (subscription and payment records); internet activity (login timestamps, session data).

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

11. Children's Privacy

DistributorBooks is a financial management tool intended for adults operating MLM or direct sales businesses. We do not knowingly collect personal information from anyone under the age of 18. If you believe a minor has created an account, please contact us and we will promptly delete the account and all associated data.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the software, or applicable law. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Display a notice within the application for users who are logged in
• Send an email notification to registered users if the changes are significant

Continued use of DistributorBooks after changes are posted constitutes acceptance of the updated policy. We encourage you to review this page periodically.

We commit to reviewing and updating this Privacy Policy at least once per year, as recommended by CCPA/CPRA compliance guidelines.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: