TheGuyBooks

TheGuyBooks Host Legal Integration Pack

Version 1.3 — October 18, 2026

Change in 1.3: this pack is now published at theguybooks.com/docs/host-legal-pack and linked from Section 8.3 of the TheGuyBooks Terms of Service, so the copy a Host reads is always the current one. It describes the integration as it is: your users sign in through the hosted, Host-branded login that TheGuyBooks serves at the address you are given or on a domain you attach, and you manage clients in the host administration interface (your host console) or through the API — the pack no longer describes an iframe or snippet integration. Section references are aligned to the Terms of Service dated October 18, 2026: the retention clock for a client you remove is Section 6.5, Survival is Section 6.6, Permitted Resale (Section 8.1) now names the hosted sign-in, and the support response commitment is Section 12.5. The Part 2 and Part 3 model language on termination and data export now states the export window and the restore road in the same words as the Terms. No obligation was added or removed.

Change in 1.2: this pack now reflects the security-incident terms that govern the relationship — Section 11.7 of the TheGuyBooks Terms of Service (breach notification to Hosts) and Section 6 of the TheGuyBooks Privacy Policy (breach notification for login and account data) — and the allocation of responsibility in Section 4.3 of the Terms. Part 1 gains a section explaining how incidents are handled and who tells whom; Obligation 3 gains one disclosure; the Part 3 model language gains a "Security incidents" paragraph; the go-live checklist gains two items. This pack describes those terms and points to them; it does not restate or replace them. Where this pack and the Terms of Service or Privacy Policy differ, the Terms of Service and Privacy Policy control.

Change in 1.1: Obligations 1 and the Part 2 model language now describe sign-in as it actually works — an always-on device-verification step on every account, plus an optional authenticator app. No obligation was added or removed.

This pack is published at theguybooks.com/docs/host-legal-pack and linked from the welcome email every Host receives. It covers the three legal-integration steps a Host must complete before going live with TheGuyBooks, and provides ready-to-use model language for the Host's own Terms of Service and Privacy Policy. The model language is written in the first person from the Host's perspective so it can be inserted into the Host's documents without modification. Completing the steps in this pack is a condition of the access-control and flow-down obligations in Sections 4 and 8 of the TheGuyBooks Terms of Service. The current Terms of Service and Privacy Policy are published at theguybooks.com/terms and theguybooks.com/privacy; section numbers in this pack refer to those documents as in force on the date above.

Part 1 — Your Three Obligations Before Go-Live

Obligation 1: Authentication is handled by TheGuyBooks

TheGuyBooks authenticates your users through its own login, served under your brand. You do not build, host, or operate a login for the books — your users sign in at the hosted, Host-branded login that TheGuyBooks serves at the address you are given or on a domain you attach, through TheGuyBooks' Identity Service, which provides password creation, password change, password reset, an always-on device-verification step (the first time a user signs in from a browser TheGuyBooks does not recognise, TheGuyBooks emails that user a one-time code and then recognises that browser for 30 days; this step cannot be switched off), and an optional authenticator app whose code replaces the emailed one while it is enabled. Under Section 4 of the TheGuyBooks Terms of Service, you are responsible for:

  1. Determining which of your users are entitled to access which books, and conveying those entitlements to TheGuyBooks in the host administration interface (your host console) or through the API;
  2. Promptly instructing TheGuyBooks to revoke a user's access when that user's authorization or standing with you ends — by removing the client in your host console or through the API, or by having the client's owner remove the person from the client's own user list; and
  3. If you use the API, keeping your API key server-side at all times — never in browser code, client bundles, or public repositories.

A Host that uses no API at all meets items 1 and 2 by inviting and removing clients in the host console. You are not responsible for authenticating your users for the books; TheGuyBooks does that, under your brand.

Where the line of responsibility sits. Under Section 4.3 of the Terms of Service, access to, disclosure of, loss of, or damage to books data that results in whole or in part from a failure on your side of this line — an entitlement you did not convey correctly, an entitlement you did not revoke promptly, or an API key you exposed or mishandled — is your responsibility, is not a security incident or breach of the TheGuyBooks service, and falls under your indemnification obligations in Section 18. The incident-handling terms described below apply to breaches of TheGuyBooks' own systems, not to access that results from a failure under this Obligation.

Obligation 2: Bind your users with compatible terms

Before any of your users access the bookkeeping feature, your Terms of Service must bind them to terms that, at minimum:

  1. Disclose that bookkeeping functionality is provided by a third-party service provider;
  2. State that the bookkeeping feature is software, not accounting, tax, legal, or financial advice;
  3. Make the user responsible for the accuracy of the data they enter and the books they keep;
  4. Disclaim all warranties and liability of the third-party service provider to the user, and state that the provider is an intended beneficiary of those disclaimers;
  5. State that books data is stored and processed by the third-party service provider on its infrastructure in the United States; and
  6. State that access to the bookkeeping feature depends on the user's account standing with you and on your subscription with the service provider, and explain what happens to books access and data export on termination; and
  7. Disclose that login and authentication for the bookkeeping feature are provided directly by the third-party service provider, which holds the user's login credentials.

The model language in Part 2 satisfies all seven requirements as written.

Obligation 3: Update your Privacy Policy

Your Privacy Policy must disclose, at minimum:

  1. That you use a third-party service provider to deliver bookkeeping functionality;
  2. The categories of data processed through that feature (financial books data and any names or descriptions users enter into it);
  3. That the data is stored in the United States on the provider's infrastructure;
  4. That the provider acts as your service provider/processor for your books data and does not use it for its own purposes, and that the provider acts as a controller of your users' login and authentication data;
  5. How your users exercise privacy rights over their bookkeeping data (through you, not the provider); and
  6. Who notifies your users of a security incident: you, for an incident affecting their books data (see "How security incidents are handled" below); the provider directly, for an incident affecting their bookkeeping login credentials.

The model language in Part 3 satisfies all six requirements as written.

How security incidents are handled

This section is information, not a new obligation. It describes terms that already bind the parties, so that your own documents and your own incident plan line up with them.

Books data (Tenant Data). TheGuyBooks processes your users' books data on your behalf. If TheGuyBooks confirms a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to that data within its systems, Section 11.7 of the Terms of Service requires TheGuyBooks to notify you without undue delay, and in any event within 72 hours after confirming the breach, and to provide the information reasonably available to it to support your own notification obligations. That notice is sent to the email address on your Host account, so keep that address monitored. Notifying your users is your responsibility, not TheGuyBooks': you are the controller of your users' books data, you hold the relationship with them, and TheGuyBooks will not contact your users about an incident affecting books data except as required by law (Section 11.6). Whether and how you must notify your users, and whether you must notify any regulator, is determined by the laws that apply to you, and you should have a plan for that before go-live.

Login and authentication data. TheGuyBooks is the controller of your users' bookkeeping login credentials (Section 11.1 of the Terms of Service; Section 1 of the Privacy Policy). If TheGuyBooks confirms a breach affecting that data, or affecting your Host account and billing information, Section 6 of the Privacy Policy commits TheGuyBooks to notify the affected Hosts or End Users directly, by email to the address on file, within the same 72-hour window, describing what happened, what information was involved, what TheGuyBooks has done in response, and what steps the recipient can take. You do not need to relay that notice; you should expect your users to receive it directly and be ready to answer their questions.

Incidents on your side of the line. An incident that results from your failure under Obligation 1 — an unrevoked entitlement, an exposed API key — is governed by Section 4.3 of the Terms of Service, not by Section 11.7, and is yours to handle and to notify. If you suspect your API key has been compromised, Section 3.4 requires you to notify TheGuyBooks immediately at Admin@theguys.app so the key can be rotated.

What the provider will and will not say about numbers. The 72-hour windows above are quoted from the documents that contain them. If those documents change, the documents control; this pack will be reissued, but you should rely on the published Terms of Service and Privacy Policy, not on this summary, when drafting your own commitments.

What happens when you remove a client

This section is also information, not a new obligation. When you remove a client (in your host console or through the API), Section 6.5 of the Terms of Service governs what follows, counted from the moment of removal: the client's users lose access at once and the seat is freed at once; for 24 hours you can undo the removal yourself; for 90 days you can obtain the client's complete books export (through the API, or by asking support@theguys.app) and can ask TheGuyBooks to restore the client with its users' access as it stood at removal; after those 90 days the client's books data is deleted within 30 days, and encrypted backup copies age out within 365 days (twelve months). Your own terms should tell your users what you will do with that window — the Part 2 and Part 3 model language below does.

Part 2 — Model Language for Your Terms of Service

Insert the following section into your Terms of Service. It is written in your voice ("we" means you, the Host; "you" means your user) and can be used verbatim.

Bookkeeping Services

Third-Party Service Provider. Bookkeeping functionality available through our website or application is provided by TheGuyBooks, a hosted bookkeeping platform operated by TheGuys App LLC (the "Bookkeeping Provider"). The Bookkeeping Provider hosts, stores, and processes the financial books data associated with your bookkeeping account on its own infrastructure in the United States, on our behalf and at our direction. Your bookkeeping account and books are reached through the sign-in page we provide for the bookkeeping feature, which the Bookkeeping Provider operates under our name.

Not Professional Advice. The bookkeeping feature is software. It is not, and does not provide, accounting, audit, tax, legal, investment, or other professional advice, and no output of the feature constitutes such advice. All computations, classifications, and reports are derived entirely from the data and settings you supply. You should consult a qualified professional before relying on your books for any tax filing, financial statement, or business decision.

Your Responsibility for Your Books. You are solely responsible for the accuracy, completeness, and legality of the information you enter into the bookkeeping feature; for reviewing and verifying all reports and output before relying on them; for all filings, statements, and decisions made in reliance on your books; and for exporting and retaining any financial records you are required by law to keep.

Availability. The bookkeeping feature depends on the continued operation of the Bookkeeping Provider's platform and on our subscription with the Bookkeeping Provider. The feature may be modified, suspended, or discontinued, in whole or in part, at any time, including as a result of suspension or termination of our subscription, scheduled maintenance, or events outside our control. We are not liable for any unavailability of the bookkeeping feature.

Data Handling. Your books data is processed and stored by the Bookkeeping Provider as our service provider, as described in our Privacy Policy. You sign in to the bookkeeping feature using the Bookkeeping Provider's secure login system, which manages your login, password reset, an extra check the first time you sign in from a browser it does not recognise (it emails you a one-time code), and an optional authenticator app. We do not store your bookkeeping password; the Bookkeeping Provider holds it in hashed form. The Bookkeeping Provider does not receive your payment card details.

Termination and Data Export. If your account with us is closed or your access to the bookkeeping feature ends, your access to your books ends at the same time. You are responsible for exporting any records you need before that time. For 90 days after your access ends you may ask us for one export of your books data in a machine-readable format, and during those 90 days we may be able to restore your access on request. After those 90 days your books data is deleted under the Bookkeeping Provider's retention terms — within 30 days, with encrypted backup copies aging out within 365 days (twelve months).

Disclaimer and Limitation for the Bookkeeping Feature. THE BOOKKEEPING FEATURE AND ALL OF ITS OUTPUT ARE PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING ANY WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR ACCURACY. TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER WE NOR THE BOOKKEEPING PROVIDER WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, BUSINESS, OR DATA, ARISING OUT OF OR RELATED TO THE BOOKKEEPING FEATURE OR ITS OUTPUT, AND THE BOOKKEEPING PROVIDER HAS NO LIABILITY TO YOU OF ANY KIND. YOU AGREE THAT THE BOOKKEEPING PROVIDER, TheGuys App LLC, IS AN INTENDED THIRD-PARTY BENEFICIARY OF THIS SECTION AND MAY ENFORCE IT DIRECTLY.

Part 3 — Model Language for Your Privacy Policy

Insert the following section into your Privacy Policy. It is written in your voice and can be used verbatim.

Bookkeeping Data

If you use the bookkeeping feature available through our site, the financial books data associated with your bookkeeping account — including journal entries, chart of accounts, transaction records, imported transaction data, reconciliation records, and any names, descriptions, or notes you enter — is hosted, stored, and processed on our behalf by TheGuyBooks, a bookkeeping platform operated by TheGuys App LLC, on its infrastructure in the United States.

TheGuys App LLC acts as our service provider and processor for your books data. It processes your books data only to provide the bookkeeping service to us and does not sell it, use it for advertising, or use it for its own purposes. It maintains technical safeguards for this data, including database-level account isolation, encryption in transit and at rest, and audit logging, and it uses its own infrastructure providers (such as hosting and database providers) to deliver the service.

Your bookkeeping login is provided by TheGuys App LLC's secure login system. When you sign in to the bookkeeping feature, TheGuys App LLC collects and holds your login credentials — your email address, your password in hashed form, and any second factor you enable — and acts as a controller of that login and authentication data. We do not share your payment card details with TheGuys App LLC. Access to your books depends on your account standing with us and on signing in through TheGuys App LLC's login.

To access, correct, delete, export, or ask questions about your bookkeeping data, or to exercise any privacy rights you may have over it, contact us using the contact information in this Privacy Policy. We are responsible for responding to those requests and will coordinate with our service provider as needed. If your account or access to the bookkeeping feature ends, you may request an export of your books data from us within 90 days; after those 90 days the data is deleted under our service provider's retention terms — within 30 days, with encrypted backup copies aging out within 365 days (twelve months).

Security incidents. TheGuys App LLC has contractually committed to notify us, without undue delay and within the time stated in its Terms of Service, if it confirms a breach of security affecting our books data in its systems, and to give us the information it has so that we can meet our own obligations. If such a breach affects your bookkeeping data, we will notify you as required by applicable law, using the contact information on your account with us. Your bookkeeping login credentials are held and controlled by TheGuys App LLC, not by us; if a breach affects that login data, TheGuys App LLC will notify you directly by email, as described in its Privacy Policy at theguybooks.com/privacy, and we will help you with any questions you have about that notice.

Part 4 — Additional Model Language for Reseller Hosts

If you resell access to the bookkeeping feature to your own customers (rather than using it solely for your own books), insert the following additional section into your Terms of Service alongside the Part 2 language.

Your Bookkeeping Subscription with Us

Your bookkeeping subscription is with us. We set the pricing, billing, and plan terms for your subscription, we bill you, and we provide your support. The Bookkeeping Provider is our wholesale infrastructure provider; apart from authenticating your login through its login system, it has no contractual relationship with you, does not bill you, and does not provide you support. All questions, requests, and disputes regarding your bookkeeping subscription should be directed to us.

If our wholesale relationship with the Bookkeeping Provider is suspended or ends, or if your subscription with us is suspended or ends, access to the bookkeeping feature ends for the accounts affected. Your sole remedies for any such interruption are those stated in your agreement with us, and the Bookkeeping Provider has no liability to you in connection with any such interruption.

Part 5 — Go-Live Checklist

Complete every item before directing users to your books page.

  1. If you use the API, your TheGuyBooks API key exists only in your server environment configuration — not in client code, build artifacts, or version control.
  2. You have conveyed each user's entitlements to TheGuyBooks in your host console or through the API, so each user can access only the books they are entitled to.
  3. The Part 2 model language (and Part 4, if you resell) is published in your Terms of Service, and your users accept those terms before accessing the bookkeeping feature.
  4. The Part 3 model language is published in your Privacy Policy.
  5. Your support contact for bookkeeping questions is live and stated in your terms, so your users' requests route to you.
  6. You have tested your removal road: removing a client in your host console (or through the API) ends its users' access at once, and you know the 24-hour undo and the 90-day export and restore window in Section 6.5 of the Terms of Service.
  7. The email address on your TheGuyBooks Host account is one that a responsible person reads promptly, because a breach notice under Section 11.7 of the Terms of Service is sent there and your own notification clock may start when you receive it.
  8. You have an incident plan for books data: who on your side receives a breach notice from TheGuyBooks, who decides whether and how to notify your users and any regulator, and how your users will be contacted. The Part 3 model language tells your users that this notice comes from you.

Part 6 — Contact

Integration and onboarding questions: support@theguys.app (we respond within one business day — Section 12.5 of the Terms of Service)

Legal questions regarding this pack or the TheGuyBooks Terms of Service: legal@theguys.app

Security reports: Admin@theguys.app