Double Rule LLC Privacy Policy

Updated: November 14, 2026

At a glance

• Who we are. Double Rule LLC runs two products. DoubleRule does the books, payroll and tax returns for US small businesses. Mendiola is an AI operating system that accounting firms use to serve their own clients.
• Who decides. For our website, sales and account records, Double Rule LLC decides how personal information is used. For the financial records we handle for a client, the client decides. On Mendiola, the accounting firm decides, and we act as its service provider.
• What we collect. What you type into our forms and booking pages, basic website usage, and, for clients, the business and financial records we need to do the work.
• Bank connections. Bank and card accounts connect through Plaid, read-only. We never see your bank username or password.
• What we don't do. We don't sell personal information or bank data. We don't share it for cross-context behavioural advertising.
• Where it goes. Our team in the United States and in Clark Freeport, Philippines, and service providers that host and run our systems.
• Your rights. Ask to see, correct or delete your information. We confirm receipt within 10 business days and answer within 45 days.
• Contact. connect@doublerule.com or 323 842 4789.

---

1. Who we are and what this policy covers

1.1 About us

Double Rule LLC ("DoubleRule", "we", "us", "our") is a US company founded in 2013. Our headquarters is at 5555 Corporate Ave., Suite 200, Cypress, CA 90630, USA. Our operations office is at 701/A 55 One West Gatwick Gateway, Clark Freeport, Pampanga, Philippines.

We offer two products. Together we call them the "Services".

1. DoubleRule. A done-for-you service for US small businesses: bookkeeping (weekly reconciliations and monthly close), accounting, payroll processing, receivables and payables, catch-up work and tax returns, plus a startup track. Our clients' books live in the DoubleRule app, which is built on the Jaz accounting ledger.
2. Mendiola. An AI operating system sold only to accounting firms ("Firms"). Firms use it to serve their own clients ("End Customers"). Mendiola has its own website at mendiola.io and its app at app.mendiola.io. Double Rule LLC owns and operates it.

DoubleRule's clients sign in to the DoubleRule app through Mendiola, at app.mendiola.io. When they do, they use Mendiola as DoubleRule's client, and this policy applies to them as it does to every DoubleRule client.

This policy covers:

• our websites, doublerule.com and mendiola.io, including their forms and free tools (the "Sites"). This policy is published at mendiola.io/privacy and on doublerule.com;
• the DoubleRule service and the DoubleRule app; and
• the Mendiola platform.

1.2 Who decides how information is used

Who is responsible for a piece of personal information depends on why we hold it.

If you are an End Customer of a Firm that uses Mendiola, your Firm's own privacy notice governs how your information is used. Please send questions and requests about that information to your Firm. If you contact us, we will pass your request to the Firm and help it respond.

1.3 Business use only

Our Services are for businesses and accounting firms, in the United States and, for Mendiola, also in the Philippines. They are not for personal, family or household use, and we don't market them to consumers. We don't knowingly collect personal information from anyone under 16.

1.4 Other notices

• Job applicants. If you apply to work with us, in the United States or the Philippines, we handle your application under this policy, and use it only to consider you for the role.
• Outside fulfilment partners. Where we use another firm, such as a payroll bureau, to deliver part of the Services, it receives only what it needs for that work, under a contract that requires it to keep the information confidential.

1.5 Questions

Email connect@doublerule.com, or call 323 842 4789.

---

2. Information for prospective clients and Firms

2.1 When this section applies

This section applies to you if you:

• visit one of our Sites, use a free tool, or fill in a form;
• book a call or meet with us;
• subscribe to our newsletter or download something from us;
• were referred to us, or represent a business or Firm that is talking to us about the Services; or
• are buying the Services on behalf of your employer.

2.2 What we collect and where it comes from

We may also receive business contact details from partners, from events we attend, and from providers of business contact information.

mendiola.io collects less than this: it has no analytics and no cookies, and a request to book a walkthrough is an email you send from your own mail app.

2.3 How we use it

• To reply to you, prepare for calls and hold them.
• To send what you asked for, such as a sample pack or a checklist.
• To recommend a plan, quote a price, and set up a free trial or onboarding.
• To send our monthly email if you subscribed. Every email has an unsubscribe link.
• To learn which pages and tools help people, fix problems, and test different versions of a page.
• To keep the Sites secure, for example by filtering automated form submissions.
• To keep records of our sales conversations and meet our legal obligations.

We may use AI tools to help with these tasks, for example to summarise a call or draft a follow-up. A person on our team reviews what they produce.

2.4 Sample data you share before you sign up

To scope the work, you may send us statements, reports or access to your current books. These can include personal information about people your business deals with, such as employees, contractors, customers and vendors. You decide what to send. We use it only to understand your needs and price the Services. We keep it in our email and file storage and don't use it for anything else. If you don't become a client, we delete it on the schedule in section 3.9.

2.5 Our Sites: cookies and tools in your browser

Cookies and similar technologies on doublerule.com (round-72 site)

mendiola.io sets no cookies and runs no analytics. When you start a booking from the foot of a page, it keeps your firm name and email in your browser's session storage until the booking page reads them, then removes them.

We don't use advertising cookies or social media tracking pixels on the Sites.

Calculators. Our calculators (runway, break-even, budget planner, quote builder, health check, vendor lookup, tax calendar and chart of accounts templates) run in your browser. The numbers you type are not sent to us.

Links and embedded services. The Sites link to and embed services run by others, such as Calendly. Their own privacy policies apply to what they collect.

2.6 How long we keep prospect information

We keep prospect information for 2 years from our last contact with you, unless you ask us to delete it sooner or you become a client.

If you unsubscribe or ask us to delete your data, we keep your email address on a suppression list so we don't contact you again.

Vercel and Calendly keep their own records under their own retention rules.

---

3. Information for clients, Firms and End Customers

3.1 When this section applies

This section applies to you if you work for a DoubleRule client, work for a Firm that uses Mendiola, or are an End Customer (or work for one) whose Firm uses Mendiola.

We handle three kinds of data when we deliver the Services:

• Client Data: the financial, tax and business records we handle for a client or a Firm.
• Engagement Records: the record of the work we do and our dealings with you.
• Account and Usage Data: what we need to run accounts, sign-ins, billing and the apps.

3.2 Client Data

What it is. Client Data is the financial, tax and business information that a DoubleRule client, a Firm or an End Customer provides to us, or tells us to collect, so that we can deliver the Services. It also includes what we produce from that information, such as reconciled ledgers, reports, financial statements and tax returns.

On Mendiola, Client Data includes information that a Firm or its End Customers upload or connect to Mendiola, and everything the Firm produces from it in Mendiola. We call this "Mendiola Client Data". The Firm controls it.

Where it comes from.

• From the client, Firm or End Customer directly, for example uploaded statements, receipts and documents.
• From accounts they connect, such as banks and cards (through Plaid; see section 3.3), payroll providers, payment processors and other accounting software. These connections use the provider's own integration or a sign-in the client authorises.
• From prior years' work, for returning clients, so we don't ask for the same thing twice.

What it can contain. Business records often name people. Client Data can include:

• names and contact details of people in transactions, such as employees, contractors, customers, vendors, owners and officers;
• their relationship to the business, such as a job title or ownership share;
• amounts paid to or received from them, such as invoices, bills and pay;
• for payroll: Social Security numbers, home addresses, pay rates, tax withholding details and bank details for direct deposit;
• for tax returns: owner and officer names, ownership percentages, taxpayer identification numbers and the other details each return requires; and
• bank and card account details received through Plaid (see section 3.3).

Some of this is sensitive personal information under state law, such as Social Security numbers and financial account numbers. We use it only to deliver the Services (see section 4.7).

Third-party systems. When a client or Firm gives us access to a bank, payroll provider or other system, that provider's own privacy policy governs what it does with the data.

3.3 Connected bank and card accounts

When you connect a bank or card account in the DoubleRule app or in Mendiola, the connection is made through Plaid Inc. ("Plaid").

• We never see your bank login. You sign in to your bank through Plaid. We never see or store your bank username or password.
• Connections are read-only. We can read account information. We cannot move money or make changes at your bank.
• What we receive. Account names and types, the last four digits of account numbers, balances and posted transactions. We don't receive full account or routing numbers.
• How we use it. Only to keep the books for the business that connected the account. On Mendiola, only to provide the Services to the Firm and its End Customer.
• What we don't do. We don't sell bank data, rent it or use it for advertising.
• Plaid's role. Plaid's handling of your information is described in the Plaid End User Privacy Policy.
• Disconnecting. You can disconnect an account at any time in the app or by asking us (or, for Mendiola, your Firm).

3.4 Tax return information

When we prepare a tax return, the information you give us for it is "tax return information" under section 7216 of the Internal Revenue Code. We use it to prepare and file your return. We don't use it for any other purpose, or disclose it to anyone, without your written consent in the form the IRS requires, unless the law allows it without consent. For example, we may share it with our own staff and service providers who help us prepare the return.

Our team in the Philippines works on tax returns. Under the IRS rules, a preparer must get the taxpayer's consent before disclosing tax return information to anyone outside the United States. We ask for this consent before that work starts, and we follow the IRS's additional limits on disclosing taxpayer identification numbers outside the United States.

3.5 How we use Client Data

We use Client Data to deliver and improve the Services. For example:

• To do the work. Reconcile accounts, categorise transactions, close the month, run payroll, manage receivables and payables, prepare financial statements and prepare and file tax returns.
• To use automation and AI. We use rules and AI tools to suggest categories, match transactions and draft work for our team to review. The AI model providers that process Client Data are Anthropic and Google (through Vercel's AI Gateway), TypeSafe, and, for reading documents, Google Document AI and Mistral AI. We don't use Client Data to train or fine-tune AI models.
• To support you. Answer your questions and fix problems.
• To manage the account. Check that billing matches the plan, for example monthly expenses for the Growth plan.
• To improve the Services. Build better categorisation rules and features, within the limits the law sets for a service provider. Mendiola Client Data is used only to provide Mendiola to the Firm it belongs to: what Mendiola learns from a Firm's work stays within that Firm.

We don't use Mendiola Client Data for our own marketing, and we don't use it to build profiles of End Customers.

3.6 Mendiola: data we handle for Firms

On Mendiola, we act for the Firm. In short:

• The Firm decides what data goes into Mendiola, which End Customers it serves, and who on its team can see what.
• We process Mendiola Client Data only to provide Mendiola to the Firm, under our agreement with it and its Data Processing Agreement (Annex 1 of the Mendiola Platform Agreement, at mendiola.io/terms).
• If an End Customer asks us about their data, we refer them to their Firm.
• When a Firm's agreement ends, the Firm may export its Mendiola Client Data for 90 days. We then delete it within 30 days, and copies in backups expire on our backup cycle.
• If a security incident affects Mendiola Client Data, we tell the affected Firm without undue delay, and within 72 hours of becoming aware of it.

When DoubleRule's own team uses Mendiola to serve DoubleRule clients, DoubleRule is the Firm. Section 3.5 applies to that data.

3.7 Engagement Records

What they are. Engagement Records are the record of the work we do. They include:

• instructions, approvals and sign-offs from clients and Firms;
• emails, chat messages and notes from calls and meetings;
• working papers and records of the steps we took on a client's books;
• financial statements we prepared, including drafts;
• scheduling details and follow-up questions; and
• our own methods, checklists and timelines.

How we use them. To deliver the Services, answer support requests, manage our relationship with you, improve our processes, and keep records of what we did and why.

Engagement Records can contain Client Data. When they do, we use that Client Data only for record keeping and legal purposes.

3.8 Account and Usage Data

Account Data is what we need to run your account: name, business email and phone, sign-in details for the DoubleRule app or Mendiola, your settings and role, billing details, and the history of what you bought.

Usage Data is collected automatically when you use our apps: IP address, device and browser type, pages viewed, actions taken, sign-in times and error logs. In the apps we use Vercel Web Analytics, which counts page views without cookies. We don't record sessions.

How we use it.

• To set up and run accounts. Create sign-ins and send you service messages. If others share your account, they may be able to see or change your details.
• To keep accounts secure. Verify sign-ins, spot unusual activity and prevent fraud.
• To support you. Troubleshoot problems and follow up.
• To tell you about the Services. We may email you about features or services that may help your business. You can opt out of marketing email at any time.
• To improve the apps. Find out what works and what doesn't, and build new features.

3.9 How long we keep client information

We keep information only as long as we need it, then delete it or de-identify it. Starting schedule:

We may keep information longer when the law requires it, to resolve a dispute, or to enforce our agreements. Backups are overwritten on a rolling cycle.

---

4. General information

4.1 Call and meeting recordings

If we record a call or video meeting, we tell you at the start and ask for consent where the law requires it. California requires the consent of everyone on the call. Recordings capture voices, names and, if cameras are on, images. We use them and their transcripts for notes, training, service delivery and improving our work. We keep them for up to 2 years, or less if you ask us to delete them and the law allows it.

4.2 Who we share personal information with

We share personal information only as described here.

• Service providers. Companies that help us run our business and the Services. They include hosting and infrastructure (Vercel, Supabase and Trigger.dev for Mendiola), the Jaz ledger platform, website hosting (Vercel), scheduling (Calendly), email delivery (Resend, for sign-in codes and transactional email), email and file storage, AI model providers, and bank data connections (Plaid). Our contracts require them to use the information only to serve us and to keep it confidential. The providers that process Mendiola Client Data are listed in Appendix C of the Mendiola Platform Agreement (mendiola.io/terms).
• Our team. Our staff in the United States and in Clark Freeport, Philippines, when they need the information to do their jobs.
• Government agencies. When we file returns, forms or payroll reports that you have authorised.
• Providers you connect. Banks, payroll providers and other systems a client or Firm connects, so the connection works.
• People you tell us to share with. For example your lender, investor, outside tax adviser or auditor.
• On Mendiola, the Firm. End Customer data is shared with the Firm that serves that End Customer, and with the people the Firm gives access to.
• Professional advisers. Our lawyers, accountants, insurers and bankers, under a duty of confidentiality.
• Legal requests. When we believe in good faith the law requires it, for example a subpoena or court order, or to protect the rights, property or safety of DoubleRule, our clients or others.
• Business transfers. If we sell, merge or transfer all or part of our business, information may pass to the buyer, subject to this policy.

Tax return information is shared only as section 3.4 allows.

We don't sell personal information, and we don't share it for cross-context behavioural advertising. We don't sell or rent bank data received through Plaid.

4.3 De-identified and aggregated data

We may turn information into data that is de-identified or combined so that no client, Firm, End Customer or person can be identified. We don't try to re-identify it. We may use it to improve the Services.

4.4 Where we process information

We are based in the United States, and our operations team works from our office in Clark Freeport, Pampanga, Philippines. That team accesses client records, including Client Data and tax return information, to deliver the Services. This means personal information is transferred to and processed in the Philippines.

Client books are kept in the Jaz ledger platform, which hosts every organisation in Singapore. Mendiola is hosted in Singapore: the application runs on Vercel (region sin1) and the database on Supabase (AWS ap-southeast-1). Background jobs run in the United States on Trigger.dev (us-east-1). Some service providers process data in other countries.

Wherever it is processed, we protect information with the safeguards in section 4.5 and with contracts where the law requires them.

4.5 Security

We protect information with administrative, technical and physical safeguards. They include:

• Sign-in protection for our apps. Users sign in with a one-time code sent by email, which expires after 10 minutes, or with a passkey or security key. You can choose to trust a browser for 30 days.
• Encryption in transit. The Sites and apps are served only over HTTPS.
• Encryption at rest. Our database provider encrypts stored data. Bank access tokens and personal ledger keys are also encrypted field by field (AES-256-GCM).
• Staff access. Access limited by role, reviewed every quarter, and removed on a person's last day.
• A written information security program. Our policies and procedures for protecting information, kept up to date.

No system is completely secure. If a breach affects your information, we will notify you, and the authorities, as the law requires.

4.6 Your choices

• Update your details. Change your account details in the app, or ask us.
• Marketing email. Use the unsubscribe link in any marketing email, or ask us. We will still send messages about the Services you use.
• Cookies and browser storage. Most browsers let you block or delete cookies and clear stored data. The Sites still work without them.
• Browser privacy signals. We don't sell or share personal information, so there is nothing for a Global Privacy Control or "Do Not Track" signal to switch off.
• Bank connections. Disconnect an account in the app at any time (section 3.3).
• Client Data. If you think a client or Firm has given us data about you, contact that business first. It decides what happens to that data.

4.7 US state privacy rights

What this section covers. It covers personal information for which Double Rule LLC is the "business" or "controller":

• information in section 2 (prospective clients and Firms);
• Engagement Records and Account and Usage Data in section 3, but not Client Data inside them;
• call recordings in section 4.1; and
• individual tax return data, if we prepare your personal return (section 1.2).

For Client Data, including Mendiola Client Data, we act for the client or Firm. Send requests about that data to the business that holds it. We will help it respond.

Your rights. Depending on where you live, you can ask us to:

• tell you what categories of personal information we collect about you, where we got it, why we use it and who we share it with;
• give you a copy of the specific personal information we hold about you;
• correct inaccurate personal information;
• delete your personal information, subject to legal exceptions (for example, records we must keep for tax purposes); and
• stop selling or sharing your personal information, or using it for targeted advertising. We do none of these.

We won't treat you differently for using these rights.

How to ask. Email connect@doublerule.com with "Privacy request" in the subject, or call 323 842 4789.

What happens next.

1. We confirm we received your request within 10 business days.
2. We verify your identity. We usually match details in your request against what we hold, and we may ask for a little more. We ask for no more than we need.
3. We respond within 45 days. If we need more time, we tell you within those 45 days and take up to 45 more.

Authorised agents. Someone you authorise can make a request for you. We will ask for proof of your written permission, and we may ask you to confirm your identity with us directly.

Appeals. If we decline your request, you can appeal by replying to our decision. We answer appeals within the time your state's law sets. If you disagree with the outcome, you may contact your state's attorney general or privacy regulator.

Sensitive personal information. We use sensitive personal information, such as Social Security numbers, financial account numbers and account sign-in details, only for purposes the CCPA regulations allow, such as delivering the Services you asked for, keeping them secure and preventing fraud. We don't use it to infer characteristics about you.

Selling and sharing. In the past 12 months we have not sold personal information or shared it for cross-context behavioural advertising. We have no actual knowledge of selling or sharing the personal information of anyone under 16.

Categories collected and disclosed in the past 12 months.

4.8 Philippine Data Privacy Act

Our Clark Freeport team processes personal information in the Philippines. The Data Privacy Act of 2012 (Republic Act No. 10173) and its rules may apply to that processing. Where they apply, you may have rights under that law, including to be informed, to access, to correct, to object, to erasure and to data portability, and to complain to the National Privacy Commission.

For a privacy question or request under Philippine law, email connect@doublerule.com with "Data privacy" in the subject.

4.9 Changes to this policy

We may update this policy. We will post the new version here with a new effective date. If we make a material change to how we use personal information, we will tell clients and Firms in advance by email or in the app. For Firms, the Mendiola Platform Agreement's own notice terms also apply.

4.10 Contact us

Double Rule LLC 5555 Corporate Ave., Suite 200 Cypress, CA 90630, USA

Email: connect@doublerule.com Phone: 323 842 4789

Operations office: 701/A 55 One West Gatwick Gateway, Clark Freeport, Pampanga, Philippines