Privacy Policy

Effective October 28, 2026

FLUID Inc. ("FLUID", "we", "us") runs WellKept Books, a time, billing and practice tool used by bookkeeping firms (each a "Customer"). This policy explains what personal information the Service holds, why, who can see it, and the choices you have. It covers the people who sign in (a Customer's owner and staff) and the people whose details a Customer enters, such as its clients and their contacts.

For information a Customer enters about its own clients and staff, the Customer decides what goes in and why, and we handle it on the Customer's behalf. If you are one of a Customer's clients, contact that firm first about your information.

What we hold

• Account details: name, email address, phone, job title, role, working days, sign-in color, and the billing and pay rates the owner sets. Passwords are stored only as a one-way hash. We can't read them.
• Work records: time entries and their notes, timers, shifts, to-dos, personal notes, calendar events, invitations and time-off requests, messages between team members, alerts, and a log of key actions (who did what, and when).
• Client and billing details the Customer enters: client names, contacts, addresses, phone numbers, email addresses, their accountant, tax and filing details, rates, billing rules and invoices.
• Uploaded timesheets: spreadsheets the owner imports. The Service reads the rows into time entries. A temporary copy of what it read is kept only while the import is being reviewed. It is deleted when the import is finished or cleared, and a preview nobody finished is deleted after a day.
• Sign-in and security records: when you're signed in, the Service keeps a session record with your IP address and browser type. To slow down password guessing, it briefly remembers failed sign-in attempts by email and IP address, for about five minutes.

Cookies and browser storage

The Service uses only what it needs to work: a session cookie that keeps you signed in (encrypted, and it expires after two hours without activity), a security cookie that protects forms, and, if you choose "Keep me signed in", a cookie that keeps you signed in until you sign out. Your browser also stores your light or dark appearance choice and, for the current tab only, the screens you visited, so Back works.

We don't use analytics, advertising or tracking tools, and the Service loads no outside fonts or scripts.

How we use it

Only to provide the Service: signing you in, recording and approving time, preparing invoices and exports, reminders and calendar invites, messages, keeping the Service secure, fixing problems, supporting the Customer, and meeting legal obligations. We don't sell personal information, share it for advertising, or use it to profile anyone.

Who can see it

• Inside a Customer's firm: access follows roles. The owner sees time, pay, rates, clients and invoices for the whole firm. Staff see their own time and the calendar, messages and to-dos they're part of.
• Service providers: Laravel Cloud, which hosts the Service and its database, and the infrastructure it runs on. When email is turned on, an email delivery provider sends invitations and alerts. Providers may use the information only to provide their service to us.
• Files you export: invoice and QuickBooks files go to whoever downloads them. We don't send them anywhere.
• When required: to comply with the law or a valid legal request, to protect people's rights and safety, or as part of a merger or sale of our business, under the same protections.

How long we keep it

As long as the Customer uses the Service, or until the Customer deletes it. When a Customer stops using the Service, it may ask within 30 days for an export. We then delete its data, and backup copies expire on their normal schedule. Sign-in sessions end when you sign out or after inactivity.

Security

The Service is served only over encrypted connections (HTTPS). Passwords are hashed and sessions are encrypted. Access is limited by role, and repeated wrong passwords lock that sign-in for a few minutes. No system is perfectly secure. If a breach affects your personal information, we will notify the Customer, and you where the law requires.

Your choices

You can see and correct much of your own information in the Service, and the Customer's owner can correct or remove the rest. Depending on where you live, you may have the right to ask for access to, a copy of, correction of or deletion of your personal information. Send requests to legal@fluidcontent.com. If the information was entered by a firm you work with, we will pass the request to that firm, because it decides what it keeps. We won't treat you differently for making a request.

Where it's stored

Information is stored and processed in the United States or other countries where our hosting provider operates.

Children

The Service is a business tool for adults. It isn't meant for anyone under 18, and we don't knowingly collect children's information.

Changes

We will update this policy when our practices change. The effective date at the top shows the current version. If a change is significant, we will tell the Customer's owner account before it takes effect.

Contact

FLUID Inc. · legal@fluidcontent.com · see also our Terms of Service