Privacy Policy

AllVPlus SCB Reconciliation · Last updated: 6 October 2026

1. About this policy

This Privacy Policy explains what information AllVPlus ("AllVPlus", "we", "us") processes in AllVPlus SCB Reconciliation (the "Service"), a financial reconciliation system used for AllVPlus business operations and available at https://www.allvplus.dev/. The Service is for authorized AllVPlus users only; it is not offered to the general public.

2. Information the Service processes

• Bank statement and transaction information. Entries from SCB bank statements and related bank reports (bill payment, payment status and adjustment reports): dates and times, amounts, reference numbers and the descriptions printed by the bank, which can include counterparty names and partial account details.
• AllVPlus business records. AllVPlus platform transaction and invoice records, and merchant payout and payment records (including payment status information supplied by payment providers), used to match against bank entries.
• Reconciliation results and manual classifications. Matches, exceptions, and the categories, descriptions and notes that authorized users enter to explain bank entries, together with who made each change and when.
• Authorized user information. The email address, assigned role and activity records of the people who sign in to the Service.
• Technical information. Standard server logs kept by our hosting provider (such as IP address and request time) so that the Service can be operated and secured.

3. Google Account and Gmail access

With the authorization of an authorized AllVPlus user, the Service connects to a designated Google account using Google OAuth and the read-only scope https://www.googleapis.com/auth/gmail.readonly. With this access the Service can read email but cannot send, change or delete it.

The Service looks only at messages that carry a designated label for SCB statement and payment-related report emails. For those messages it reads the sender, subject and received time, and downloads the attachments. It reads the account's label names only to find the designated label, and the connected account's email address only to confirm the connection.

4. Why Gmail access is required

SCB delivers its statement and payment reports to the business mailbox as email attachments. Retrieving them automatically from that mailbox allows the Service to reconcile bank activity without manual downloading and re-keying. Google/Gmail information is accessed only to provide the financial reconciliation functionality requested by the authorized user.

5. How Gmail-derived data is used

• Attachments are opened and read only to extract statement and payment information. The extracted records and file details (such as file name, size, received time and a content fingerprint) are stored in the Service's database and used for reconciliation, review and audit. The text of email bodies is not stored or used.
• Gmail-derived data is not used for advertising or marketing profiling, and is not used for any purpose unrelated to the reconciliation functionality. We do not sell it.
• We do not transfer Gmail-derived data to others except to the service providers needed to operate the Service (section 7), where required by law, or with the user's consent.
• AllVPlus personnel do not read Gmail-derived data except for authorized users reviewing reconciliation results in the Service, with the user's consent, for security or abuse investigation, or to comply with law.

AllVPlus's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Security

• All access to the Service uses encrypted connections (HTTPS).
• Financial data is available only to signed-in authorized users, through authenticated server-side interfaces with role-based permissions. The public pages of this website show no financial data.
• The Google credential used to read the mailbox is kept in the hosting platform's secret storage and is used only by the server-side Service. It is never sent to a browser or shown to users.
• Gmail access is limited to the read-only scope described above.
• Changes to manual classifications are recorded with the user and the time.

No online service can be guaranteed to be completely secure, but we work to protect the information we handle.

7. Third-party service providers

We use the following providers to operate the Service, and each processes information only to provide its service to us: Vercel (application hosting), Supabase (database and user authentication) and Google (Gmail API and the OAuth authorization described above). We do not sell personal information and we do not share it with advertisers. We may disclose information where required by law.

8. Retention

Imported statement and payment evidence, reconciliation results and manual classifications are kept as part of AllVPlus's financial records for accounting, audit and legal purposes, and are not deleted automatically. The stored Google credential is kept until access is revoked, replaced or removed. If you ask us to disconnect Gmail, we stop retrieving email and remove the stored credential; records that were already imported remain part of the financial records unless deletion is requested and permitted by applicable law and our record-keeping obligations.

9. Authorized users

Access to the Service is restricted to authorized AllVPlus personnel. Each person is given a role (viewer, accounting or administrator) that limits what they can see and change. Public visitors to this website do not receive access to financial records, bank information, customer transactions or administrative functions.

10. Revoking Google access

You can withdraw Google access at any time in your Google Account: open https://myaccount.google.com/permissions, select AllVPlus SCB Reconciliation and choose to remove access. Once access is revoked the Service can no longer retrieve email from that account. You can also contact us at admin@allvplus.com to disconnect the integration.

11. Your requests

To ask about, correct or request deletion of information we hold about you, contact us at admin@allvplus.com. We will respond in line with applicable law, including Thai data-protection law, and subject to our financial record-keeping obligations.

12. Changes to this policy

We may update this policy. The "Last updated" date at the top shows the latest version, and changes that affect how Google user data is handled will be published here before they take effect.

13. Contact

AllVPlus · admin@allvplus.com

Home: https://www.allvplus.dev/
Terms of Service: https://www.allvplus.dev/terms