Last Updated: August 12, 2026

Get Actual, inc. (Actual or “us” or “we”) is providing you with this Privacy Policy (“Privacy Policy”) because we understand that you are concerned about privacy, and we are committed to protecting the privacy of persons who visit our Website (“Visitors”), persons who register to use the Services, or otherwise use the Services as defined below (“Customers”), and persons who register to attend our corporate events (“Attendees”). This Privacy Statement describes Actual’s privacy practices in relation to the use of our Website and the related applications and services, including subscription services, offered by Actual (the “Services”).

It is our policy to respect your privacy and the privacy of all users. We value the trust you place in us, and we want to ensure that you understand what information we gather about users of our Website, how we use that information, and the safeguards we have in place to protect it.

By using our Website or Services, you acknowledge that you have reviewed this Privacy Policy. This Privacy Policy describes our practices and is not intended to make consent the legal basis for every use of personal information. Where applicable law requires consent, we will request it separately and you may withdraw it as described below. This Privacy Policy applies to personal information we process about Visitors, Customers, Attendees, account users, and other individuals who interact with us.

1. Website covered

This Privacy Policy covers the information practices of our Website that links to this Privacy Policy, including: https://getactual.io and all sub-domains; (collectively referred to as “The Actual Website” or “our Website”).

The Actual Website may contain links to other Websites. The information practices and the content of such other Websites are governed by the privacy policies of such other Websites. We encourage you to review the privacy policies of such other Websites to understand their information practices.

2. Information we collect

When expressing an interest in obtaining additional information about the Services or registering to use the Services, Actual may require personal and business contact information, such as name, business name, role, business address and country, phone number, and email address (“Required Contact Information”). When purchasing subscriptions, we may require billing name and address, tax identification information, subscription details, and payment-method information processed by our payment provider (“Billing Information”). We may also collect account credentials and preferences, communications with us, and information about Users, Company ownership, and business registration that is needed to verify eligibility for particular Services. Fields identified as required are necessary to create or administer an account, provide the requested Services, comply with law, or enter into a contract; if they are not provided, we may be unable to provide the applicable Service.

Customers and Users may submit information through the Services, including budgets, bids, charts of accounts, estimates, purchase orders, invoices, expense records, production and general location information, collaborator details, support communications, and uploaded documents (“Customer Service Data”). Required Contact Information, Billing Information, account information, and Customer Service Data about Customers are referred to collectively as “Data About Actual Customers”, or in the case of Attendees, “Data About Actual Attendees”.

If an eligible US Company applies for or uses cards, ACH funding, or other financial services, we and the applicable financial-service providers may also collect dates of birth, government-issued identification, beneficial-ownership information, bank-account and transaction information, sanctions-screening and identity-verification results, and other information required by law, an issuing bank, or a provider. International availability of the software Services does not make these US-only financial services available to a non-US Company.

As you navigate our Website, we may also collect information through the use of commonly used information-gathering tools, such as cookies and Web beacons (“Website Navigational Information”). Website Navigational Information includes standard information from your Web browser (such as browser type and browser language), your Internet Protocol (“IP”) address, and the actions you take on our Website (such as the Web pages viewed and the links clicked).

3. Use of information collected

We use Data About Our Customers to perform the Services requested. For example, if you fill out a “Contact Me” Web form, we will use the information provided to contact you about your interest in the Services.

We also use Data About Actual Attendees to plan and host corporate events, host online forums and social networks in which event attendees may participate, and to populate online profiles for Attendees on our Website. Additional information on our privacy practices with respect to Data About Actual Attendees may be found in additional privacy policies on the event Websites, as the case may be.

We may also use Data About Actual Customers and Data about Actual Attendees for marketing purposes. For example, we may use information you provide to contact you to further discuss your interest in the Services and to send you information regarding us, its affiliates, and its partners, such as information about promotions or events. This marketing use does not include mobile phone numbers, SMS opt-in data, or SMS consent data, which are governed by Section 3.1.

Actual uses Website Navigational Information to operate and improve our Website. We may also use Website Navigational Information alone or in combination with Data About Actual Customers and Data about Actual Attendees to provide personalized information about Actual.

3.1 SMS messaging and mobile information

This section is the privacy disclosure governing all of Actual’s SMS messaging programs. When you expressly request or opt in to an SMS program, Actual collects your mobile phone number; records of your request, enrollment, and consent, such as the date, time, source, and disclosure presented; and related message, delivery, opt-out, and help activity. Actual uses this information to send and administer the messages you requested, maintain consent and suppression records, prevent fraud and misuse, secure your account, troubleshoot delivery, and comply with applicable law.

Verification and security-code messages. A one-time verification flow sends one message per affirmative code request. If you separately enroll in SMS multi-factor authentication, message frequency varies based on sign-ins and protected account activity. Additional verification or security-code messages are sent only after another affirmative code request or an applicable SMS multi-factor authentication event. Actual does not send marketing or promotional messages through its verification and security-code SMS program.

Card-purchase and receipt messages. If you separately opt in to this distinct SMS program, message frequency varies based on card activity, generally one alert per transaction plus receipt-processing responses. Consent to this program is not a condition of purchasing or using Actual.

Message and data rates may apply to any SMS program. Reply STOP to opt out or HELP for help.

Mobile information and SMS opt-in and consent data are not shared with third parties or affiliates for marketing or promotional purposes. Actual does not sell, rent, or provide this information to third parties or affiliates for marketing or promotional purposes. This restriction applies notwithstanding anything else in this Privacy Policy, including provisions concerning marketing, joint offers, business partners, or other disclosures. All disclosure categories described elsewhere in this Privacy Policy exclude SMS opt-in data and SMS consent data, except that Actual may provide mobile and messaging information to messaging aggregators and service providers solely to deliver, support, secure, or administer Actual’s messaging programs, or when disclosure is required by law. Those providers may not use this information for their own marketing or promotional purposes.

3.2 Legal bases for processing in the EEA and UK

Where the European Union General Data Protection Regulation (“EU GDPR”) or United Kingdom data protection law, including the UK GDPR, applies, Actual processes personal information only when it has a legal basis. Those laws can apply to certain processing by an organization outside the EEA or UK, including when it offers services to individuals in the EEA or UK or monitors their behavior there. Depending on the context, we rely on one or more of the following bases:

• performance of a contract, or steps requested before entering a contract, to create and administer an account, provide the Services, process subscription payments, provide support, and communicate about the Services;
• compliance with legal obligations, including tax, accounting, sanctions, fraud-prevention, and lawful disclosure obligations;
• our legitimate interests, or those of a third party, in securing and improving the Website and Services, preventing misuse, understanding service performance, administering our business, and communicating about relevant business services, after considering and balancing those interests against the individual’s rights and interests; and
• consent, where required, for optional marketing, non-essential cookies, SMS programs, or another purpose described when consent is requested. Withdrawal of consent does not affect processing that occurred before withdrawal.

If Actual processes Customer Service Data only on a Customer’s documented instructions, the Customer determines the applicable legal basis and Actual acts as a processor as described in Section 9.

4. Website Navigational Information

Cookies, Web Beacons, and IP Addresses. Actual uses commonly used information-gathering tools, such as cookies and Web beacons, to collect information as you navigate our Website (“Website Navigational Information”). This section describes the types of Website Navigational Information used on our Website and how this information may be used.

Actual uses cookies to make interactions with our Website easy and meaningful. When you visit our Website, Actual’s servers send a cookie to your computer. Standing alone, cookies do not personally identify you; they merely recognize your Web browser. Unless you choose to identify yourself to Actual, either by responding to a promotional offer, opening an account, or filling out a Web form (such as a “Contact Us” or a “Free Trial” Web form), you remain anonymous to us.

Actual uses cookies that are session-based and persistent. Session cookies exist only during one session. They disappear from your computer when you close your browser software or turn off your computer. Persistent cookies remain on your computer after you close your browser or turn off your computer. Please note that if you disable your Web browser’s ability to accept cookies, you will be able to navigate our Website, but you will not be able to successfully use the Services.

Where applicable law requires consent for a non-essential cookie or similar technology, we will request consent before using it. You may withdraw that consent through the controls we make available or through your browser settings, although required cookies remain necessary to provide the Website and Services.

The following sets out how Actual currently uses or in the future may use different categories of cookies and your options for managing cookie settings:

Web Beacons

Actual uses Web beacons alone or in conjunction with cookies to compile information about Customers and Visitors’ usage of our Website and interaction with emails from us. Web beacons are clear electronic images that can recognize certain types of information on your computer, such as cookies, when you viewed a particular Website tied to the Web beacon, and a description of a Website tied to the Web beacon. For example, Actual may place Web beacons in marketing emails that notify us when you click on a link in the email that directs you to our Website. Actual uses Web beacons to operate and improve our Website and email communications.

IP Addresses

When you visit our Website, we collect your Internet Protocol (“IP”) addresses to track and aggregate usage, protect the Website, and estimate the regions from which Customers and Visitors navigate our Website. An IP address and information derived from it may be personal information under applicable law.

Actual also collects IP addresses from Customers when they log into the Services as part of our “Identity Confirmation” and may collect them in connection with our “IP Range Restrictions” security features.

5. Public forums, referrals, and customer testimonials

Actual may provide bulletin boards, blogs, or chat rooms on our Website. Any personal information you choose to submit in such a forum may be read, collected, or used by others who visit these forums and may be used to send you unsolicited messages. Actual is not responsible for the personal information you choose to submit in these forums.

Customers and Visitors may elect to use our referral program to inform friends about our Website. When using the referral program, we request the friend’s name and email address. Actual will automatically send the friend a one-time email inviting him or her to visit our Website. Actual does not store this information.

Actual may post a list of Customers, testimonials and video testimonials on our Website that contain information such as Customer names and titles. Actual obtains the consent of each Customer prior to posting any information on such a list or posting testimonials.

6. Sharing of information collected

SMS and mobile data limitation. Nothing in this Section 6 permits mobile phone numbers, SMS opt-in data, or SMS consent data to be shared, sold, rented, or provided to third parties or affiliates for marketing or promotional purposes. Section 3.1 controls if any other provision of this Privacy Policy could be read differently.

Service Providers. We may share Data About Actual Customers and Data about Actual Attendees with our contracted service providers, such as cloud hosting, communications, customer support, analytics, security, identity-verification, and software-development providers, so that these service providers can provide services on our behalf. These providers may act as processors or subprocessors under contract, or as independent controllers when they determine their own legally required purposes. Actual may also share Data About Actual Customers with our service providers to ensure the quality of information provided. Unless otherwise described in this Privacy Policy, we do not share, sell, rent, or trade any information with third parties for their promotional purposes.

Subprocessors. When Actual acts as a processor for a Customer, we may appoint subprocessors to help provide the Services. We require subprocessors by contract to protect personal information and process it only for the services they provide to Actual, subject to applicable law. Our data processing agreement describes the authorization process for subprocessors, notice of material subprocessor changes, and any applicable objection rights. Customers may request our then-current subprocessor list and data processing agreement by emailing support@getactual.io.

From time to time, Actual may partner with other third party companies to jointly offer products or services. If you purchase or specifically express interest in a jointly-offered product or service from Actual, we may share Data About Actual Customers collected in connection with your purchase or expression of interest with our joint promotion partner(s). Actual does not control our business partners’ use of the Data About Actual Customers we collect, and their use of the information will be in accordance with their own privacy policies. If you do not wish for your information to be shared in this manner, you may opt not to purchase or specifically express interest in a jointly offered product or service. Data shared under this paragraph expressly excludes mobile phone numbers, SMS opt-in data, and SMS consent data.

Actual does not share Data About Actual Attendees with business partners unless: (1) you specifically opt in to such sharing via an event registration form, or (2) you attend one of our events and have your attendee badge scanned by a business partner. If you do not wish for your information to be shared in this manner, you may choose not to opt in via event registration forms and elect not to have your badge scanned at our events. If you choose to share your information with business partners in the manners described above, your information will be subject to the business partners’ respective privacy policies.

Billing. Actual uses a third-party payment provider to process subscription payments. The provider may process Billing Information to complete payments, prevent fraud, comply with law, and provide related payment services, in each case subject to its contractual obligations and privacy notice. Actual does not receive the full payment-card number entered into the provider’s payment form.

Compelled Disclosure. Actual reserves the right to use or disclose information provided if required by law or if we reasonably believe that use or disclosure is necessary to protect the rights, property, or safety of Actual or others and/or to comply with law, a judicial proceeding, court order, or legal process.

Sale of Business. If Actual is sold or disposed of as a going concern, whether by merger, sale of assets, sale of equity, change of control, or otherwise, your information collected by us, including any related database of Actual, could, in whole or in part, be sold as part of that transaction. In the event Actual goes through a business transition, such as a merger, acquisition by another company, or sale of all or a portion of its assets, your personal information will likely be among the assets transferred.

7. Communications preferences

Actual offers Visitors, Customers, and Attendees who provide contact information a means to choose how we use the information provided. You may manage your receipt of marketing and non-transactional communications by clicking on the “update information” or “unsubscribe” links located on the bottom of our marketing emails. Additionally, you may send a request specifying your communications preferences to info@getactual.io. Customers cannot opt out of receiving transactional emails related to their account with Actual or the Services.

8. Correcting and updating your information

Customers may update certain registration and profile information through the account settings made available in the Services. To request another correction, update Billing Information, discontinue an account, request a copy of information, or request deletion, email support@getactual.io. We will respond within the period required by applicable law and may retain information where legally permitted or required.

8.1 EEA and UK privacy rights

If the EU GDPR or UK GDPR applies to our processing of your personal information, you may have the right to request access to and a copy of your personal information; correction of inaccurate or incomplete information; deletion; restriction of processing; portability of information you provided to us; and to object to processing based on legitimate interests or for direct marketing. You may also withdraw consent at any time where processing is based on consent and may have rights concerning a decision based solely on automated processing that produces legal or similarly significant effects. These rights are subject to conditions and exceptions under applicable law.

To exercise a right, email support@getactual.io. We may need to verify your identity and authority before acting on a request. We will respond within the period required by applicable law and will explain if we cannot fulfill all or part of a request. Where Actual processes Customer Service Data only on behalf of a Customer, please direct your request to that Customer; we will assist the Customer as required by our data processing agreement and applicable law.

You also have the right to lodge a complaint with a data protection supervisory authority, including the authority in the EEA country where you live, work, or believe an infringement occurred, or the UK Information Commissioner’s Office if you are in the UK. We encourage you to contact us first so we can try to address your concern, but doing so does not limit your right to complain to an authority.

9. Customer Data

Actual Customers may electronically submit data or information to the Services for hosting and processing purposes (“Customer Service Data”). Actual and its service providers process Customer Service Data as provided in the applicable agreement, this Privacy Policy, the Customer’s instructions, or as required by law. This processing may include hosting and securing the data; providing Customer-requested workflow, document-analysis, import, collaboration, and reporting features; preventing or addressing service or technical problems; and responding to Customer support requests. We do not sell Customer Service Data or use it to advertise third-party products.

9.1 Our role and data processing agreements

Actual generally acts as a controller when it determines why and how personal information is processed, including for account administration, subscription billing, security, legal compliance, service analytics, and Actual’s own communications. A Customer generally acts as controller of the personal information it chooses to submit to the Services and Actual acts as its processor when Actual processes that information only to provide the Services on the Customer’s documented instructions. The facts and applicable law determine the parties’ roles in each context.

Where required by applicable law, processing by Actual on a Customer’s behalf is governed by a data processing agreement between Actual and the Customer. That agreement addresses processing instructions, confidentiality, security, subprocessors, assistance with individual-rights requests and impact assessments, incident notification, deletion or return of personal information, audits, and international transfers. If the data processing agreement conflicts with this Privacy Policy concerning Customer Service Data processed on the Customer’s behalf, the data processing agreement controls. Customers may request our data processing agreement by emailing support@getactual.io.

9.2 International data transfers

Actual is based in the United States. We and our service providers may process personal information in the United States and other countries that may have data protection laws different from those where you live. Where the EU GDPR or UK GDPR applies to a restricted transfer, we use a lawful transfer mechanism as required, such as an applicable adequacy decision, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, or another mechanism permitted by law. Where required, we assess the transfer and use supplementary contractual, technical, or organizational measures appropriate to the risk. You may contact us for information about the applicable transfer mechanism and to request a copy of relevant safeguards, subject to lawful redactions.

9.3 Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Services, maintain business and tax records, comply with law, resolve disputes, enforce agreements, prevent fraud, and protect the Services. Retention periods depend on the type and sensitivity of information, the purposes for processing it, contractual commitments, applicable limitation periods, and legal requirements. When personal information is no longer required, we delete or de-identify it or, where deletion from backups is not immediately practicable, isolate it until deletion occurs. Customer Service Data is also retained and deleted in accordance with the applicable agreement and Customer instructions.

10. Security

Actual maintains administrative, technical, and organizational safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, disclosure, or access. These safeguards include measures appropriate to the nature of the information and processing risk, such as encryption in transit, access controls, authentication, logging and monitoring, personnel controls, and incident-response procedures. We review and update safeguards as the Services and relevant risks evolve. Customers remain responsible for configuring available security settings appropriately, managing User access, and maintaining the security and confidentiality of their credentials.

Because we use the Services to maintain Data About Actual Customers and Data about Actual Attendees, this information, which is stored in the Services, is secured in the same manner as described above for Customer Service Data.

Keep in mind, however, that no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, while we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

We cannot enforce or control the security of the computers, electronic devices, or electronic communication methods that a user may utilize to send emails and submit information to us over the Internet. Users are responsible for ensuring that the computers, electronic devices and electronic communication methods they utilize will provide adequate security for communicating with us. To protect user privacy and security, a Website user must keep his or her password confidential. We are not responsible for the disclosure or interception of your information before we receive it.

If we become aware of a personal-data breach, we will investigate and provide notices to affected Customers, individuals, and authorities when and within the time required by applicable law or our data processing agreement.

11. Changes to this Privacy Policy

Actual may change this Privacy Policy as our Services, practices, or legal obligations change. We will post the updated policy with a revised effective date and provide additional or advance notice when required by applicable law or when a change materially affects how we process personal information. If applicable law requires consent for a new processing activity, we will request it separately. Prior versions and additional information about a material change may be requested through the contact details below.

12. How to Contact Us

Questions regarding this Privacy Statement or the information practices of the our Website should be directed here or by mail:

Actual at 143 W 69th St 4B, New York, NY 10023

Privacy questions, requests, or concerns may be sent to support@getactual.io.

Where applicable EU or UK law requires Actual to appoint a representative, Actual will publish the representative’s current contact information here. Individuals in the EEA and UK may direct privacy questions and rights requests to the email or postal address above.