Privacy

Who runs this

Coming Up Roses Bookkeeping and Notary is owned and operated by Levee Rose, a certified bookkeeper and New York notary public working from upstate New York. Levee is one person, not a company with a back office. When you write in, it is Levee who reads it.

What we collect

When you send a note through the contact form on the home page, we receive your name (or whatever you put in the name field), an email address or other way to reach you back, and the message you wrote about your business. That is the entire contact form.

When you become a client, we ask for the information a bookkeeper needs to do the work: legal and operating business names, your state and entity type, any other names you operate under, the bank, processor, and platform accounts you want connected, and the records that go with those. You decide what to share. Anything you do not share, we do not have.

Notary and online notarization records

The contact details and document description a signer provides on the booking page are used to confirm the appointment and are kept as part of the notary record.

For a remote online notarization, the identity verification, the biometric checks, and the session recording are handled by the outside platform under that platform's own privacy policy. Coming Up Roses does not collect or store the signer's identity-verification data or any video recording.

Coming Up Roses retains the booking record and the journal entry for ten years, as New York law requires for notarial records.

Where it lives

Your records live in a private cloud database run by Supabase, hosted on Amazon Web Services in the United States (us-east-1, Virginia). The database is encrypted at rest by the provider. Row-level rules at the database itself make sure each bookkeeper can only read their own client records. A client cannot see another client's data. A bookkeeper cannot see another bookkeeper's clients.

Login is handled by a magic link sent to your email. We do not store passwords. The session uses a signed cookie that is set on your device and is marked secure and HTTP-only.

Who can see your information

Your bookkeeper (Levee, for now) is the only person who can see your business records. The database provider and the cloud host can technically access the underlying systems, the way every cloud service can; they are bound by their own contracts and policies, and they do not have a reason to read your records, and they do not.

Two service providers handle specific jobs for us. Email we send you, including magic links, booking confirmations, and notes you asked for, is delivered by Resend, which processes the recipient name, email address, and message content in order to deliver it. When card payments are live, they are processed by Stripe, which handles the card details itself; we never see or store your card number. Neither provider is given your books.

We do not sell your information. We do not share it with marketing partners. We do not pass it to advertising networks.

The AI assistant inside the app

The bookkeeper desk, client portal, and public site can use Truffles, an assistant powered by Coming Up Roses' own Anthropic Claude key when that key is configured. The app sends the question, recent chat turns, the screen the user is on, and the narrow context needed for the answer. For a signed-in bookkeeper or portal client, that context can include client facts and standing rules that the server fetches from the one account in focus. The browser cannot choose another client's records for the assistant.

Anthropic processes that information to return the answer. We do not use Truffles to sell data, train an advertising profile, or send messages without a human action. Do not type Social Security numbers, tax ID numbers, bank passwords, or other secrets into Truffles.

What you can ask us to do

You can ask for a copy of everything we hold about you and your business. We will send it back as plain files you can open. You can ask us to delete it; we will delete what is not legally required to keep (some bookkeeping records must be retained under tax law). You can ask us to correct anything that is wrong. You can ask which connected accounts and integrations we currently hold credentials for, and ask us to disconnect any of them.

For any of those, write to hello@cominguproses.biz. We aim to answer inside one business week.

The spam check on our forms

We use Cloudflare Turnstile, an invisible spam check, to protect our public forms from automated abuse. It runs in the background when you submit a form and does not ask you to solve a puzzle. To do its work, it loads a small script from Cloudflare and may read basic technical signals from your browser to tell a person apart from a bot. Its use is governed by the Cloudflare Privacy Policy and the Turnstile Privacy Addendum. We do not use Turnstile to track you across the web, and we do not receive advertising data from it.

Cookies and tracking

The site uses a session cookie to keep you signed in. If you visit the site without signing in, no login cookie is set. There is no advertising pixel.

We do keep a plain running count of how many times each public page is viewed and how many people take a next step, such as sending the contact form or joining the founding list. This count lives entirely on our own systems. It records only a number per day per page. It does not use a cookie, does not store your address or any device signal, does not follow you across other sites, and holds nothing that could identify or single you out. The most we can ever learn from it is that a page was viewed a certain number of times on a certain day. We keep it only to know whether people are finding the practice.

The site also uses Vercel Web Analytics. Vercel describes this as cookie-free analytics that stores anonymized visitor data and uses a daily request hash instead of a long-lived tracking cookie. It can show page views, visitor counts, referrers, rough location, browser, operating system, and device information. We use it to understand whether the site is working, not to advertise to you or follow you across other sites.

The site can also send public page traffic to Google Analytics 4 and Cloudflare Web Analytics when their public IDs are configured. Google Analytics 4 may use analytics cookies to show page traffic, referral sources, and broad device information. Cloudflare Web Analytics is cookie-free and reports basic page and performance traffic. These tools measure public pages only; they do not receive client books, client names, uploaded files, private portal messages, or bookkeeping records.

If something goes wrong

If we discover that someone got into a record they should not have seen, we will tell affected clients directly, as soon as we have a clear picture of what happened and what was touched. We will not bury it.

Adult-content creators, a specific note

A meaningful share of the people Levee works with are adult-content creators. Their books are a normal business and are treated as such. We use registered agents and naming discretion so legal names stay off filings that do not require them. We do not flag, label, or treat these clients differently inside the system, and we do not share their information with any payment processor or platform that does not already have an underwriting relationship with them.