Privacy Policy

Last updated: November 1, 2026

AP Guardian is made by Dev Alchemist Labs, LLC (“we”, “us”). This policy explains, in plain language, what happens to your data when you use AP Guardian. The short version: the free scan reads your Business Central data only to find duplicate payments, shows you the result, and keeps nothing afterwards.

1. What AP Guardian does

AP Guardian looks for invoices and payments that may have been paid twice in Microsoft Dynamics 365 Business Central. You can use it in two ways:

• Connect: you sign in with your own Microsoft account, pick an environment and a company, and AP Guardian reads that company’s vendor records to run the scan.
• Upload: you export your Vendor Ledger Entries from Business Central (and, if you like, your posted purchase invoices and your Vendors list) and drop the files into the page. The files are read inside your browser and are never sent to us.

2. What we read when you connect

With your permission, and only with the access your own Microsoft account already has, AP Guardian reads:

• the list of your Business Central environments and companies;
• your vendor records (the vendor card, such as vendor number, name, tax registration number, address, phone and email);
• vendor ledger entries, and purchase invoices and purchase credit memos (only posted ones are used; any others are set aside straight away);
• basic company information, such as your currency.

Read only. Microsoft’s consent screen may say the app can “read and write” Business Central data, because Business Central does not offer a read only permission. AP Guardian only ever reads. It never creates, changes or deletes anything in Business Central.

Bank account details are never shown beyond the last 4 digits and never kept. When you connect, AP Guardian does not ask Business Central for vendor bank account details. If a file you upload includes them, they stay in your browser.

3. What we don’t keep

Nothing from the scan. The scan runs in our server’s memory while your page is open. When the scan finishes, the result is sent to your browser and nothing is saved on our side: no database, no copies of your ledger, no stored reports.

• Your sign in: after you sign in, the Microsoft access that lets us read your data is stored in an encrypted cookie in your own browser, never on our side. It lasts at most 60 minutes. Choosing Disconnect deletes it from your browser; otherwise it expires on its own. We never keep a copy on our side. During sign in, a second cookie holds a one time security code for at most 10 minutes.
• Your decisions (Confirm, Not a duplicate, Recovered) stay in your browser tab only. Close the tab and they are gone, so download the report to keep them.
• Upload scans: your file never leaves your computer. To save you time next time, your browser may remember which column is which (column headings only, never your data). You can clear it by clearing your browser’s site data.
• Reports you download are created in your browser and saved wherever you choose. We do not receive a copy.

4. The little we do keep

• Basic service logs: counts and short error codes (for example, how many entries a scan read, or that a sign in failed). These never contain vendor names, invoice numbers, amounts or any other content from your books.
• Network information: our hosting provider, Cloudflare, sees your IP address and basic request details when you visit, as any website host does. We use IP addresses only to limit abuse (for example, too many sign in attempts), and we do not build profiles from them.
• Messages you send us: if you email us, we keep the conversation as long as needed to help you.

We do not use advertising cookies, tracking pixels or third party analytics.

5. Who else is involved

• Microsoft: you sign in with Microsoft, and your data is read from your own Business Central. Microsoft’s own terms and privacy statement apply to your Microsoft account and Business Central.
• Cloudflare: hosts AP Guardian and runs the scan in its data centers.

We do not sell, rent or share your data with anyone else, and we do not use it to train any artificial intelligence. AP Guardian does not use AI to find duplicates; the checks are fixed rules.

6. Your data, your control

Your Business Central data belongs to you. When you connect, we act on your behalf, only to run the scan you asked for. Because we keep nothing from the scan, there is nothing to delete afterwards. You can also:

• choose Disconnect at any time to delete your sign in from your browser;
• remove AP Guardian’s access in your Microsoft Entra admin center (Enterprise applications) at any time;
• email us with any question about your data at support@devalchemistlabs.com.

Depending on where you live, you may have rights to access, correct or delete personal information we hold about you. Email us and we will respond within 30 days.

Vendor records can contain personal information, for example when a vendor is a sole trader. We process it only to run your scan and keep none of it.

7. Security

We describe how we protect your data on our Security page at https://apguardian.devalchemistlabs.com/security.

8. Children

AP Guardian is a business tool and is not meant for anyone under 18.

9. Changes

If we change how AP Guardian handles data, for example when we launch paid monitoring, we will update this policy before the change takes effect and change the date at the top. If a change means we would keep data we do not keep today, we will say so clearly on the page before you connect.

10. Contact

Dev Alchemist Labs, LLC, Colorado, USA support@devalchemistlabs.com

AP Guardian is not made, endorsed or supported by Microsoft. Microsoft, Dynamics 365 and Business Central are trademarks of the Microsoft group of companies.