Privacy policy

1. Who this policy covers

• Clients and the people authorized to act for them
• Prospective clients who contact us or book a call
• Website visitors

If you are an employee, contractor or vendor of a client and your information appears in a client's records, we process that information on the client's behalf and under their instructions. Ask your employer or the business that engaged us about their own privacy practices.

2. What we collect

Information you give us directly

• Identity and contact: name, business name, email address, phone number, mailing address
• Business details: entity type and structure, industry, number of accounts, estimated transaction volume, what you use today for bookkeeping
• Financial records: bank and credit card statements, loan statements, asset and depreciation records, payroll reports, prior-year tax returns, platform settlement reports, and the answers you give us about individual transactions
• Vendor information that appears in your records, including names of people and businesses you pay
• Correspondence: emails, portal messages, call notes and the questions you ask us

Information created by providing the service

• Your chart of accounts, categorization rules and the decisions you confirm
• Financial statements and the general ledger we produce for you
• Service records: which quarters we closed, what we asked, what you answered

Information collected automatically

• Standard server and security logs, including IP address, browser type, pages requested and timestamps, used for security and troubleshooting
• Essential cookies required for the site and portal to work, including keeping you signed in

What we do not do: we do not run website analytics or advertising trackers. We do not use advertising cookies, pixels or retargeting. If that ever changes, we will update this policy before turning anything on.

Billing information is collected and processed by our payment processor. We see a confirmation and the last four digits of a card. We do not store full card numbers.

Children. Our services are for businesses. We do not knowingly collect information from anyone under 18.

3. How we use your information

• To prepare your books and produce your financial statements
• To ask you about transactions we cannot categorize, and to record your answers as rules for future quarters
• To set and adjust your plan based on actual transaction and account volume
• To bill you and keep records of billing
• To communicate with you about your account, your quarterly deliverables and service changes
• To improve our own internal templates and procedures, using what we learn rather than your underlying data
• To detect and prevent fraud, abuse or unauthorized access
• To meet our legal, tax and recordkeeping obligations

We do not sell your information. We do not share it with advertisers or data brokers, and we do not use your financial information, your business name or your figures in our marketing. Any sample financial statements we publish use invented numbers for a fictional business.

4. How we share your information

We share only what is necessary, and only with:

• Service providers who help us operate, each bound by written agreement to protect your information and use it only to provide their service to us:
  • our client portal and document storage provider
  • our payment processor
  • our email and scheduling providers
  • Box, SOC 2 Type II and ISO 27001 certified
• AI processing services used to categorize transactions. These operate under business agreements that prohibit using your data to train their models. Section 6 explains this in detail.
• Our own personnel and subcontractors. Anyone working on your account is bound by a written confidentiality agreement and can only access the clients they are assigned to. All of our personnel and subcontractors are located in the United States. If that ever changes, we will update this policy before it does.
• People you tell us to share with, such as your tax preparer, lender, attorney or bookkeeper, on your written instruction
• Professional advisors, such as our own attorney, insurer or accountant, where necessary and under a duty of confidentiality
• Legal and safety, where we are required by law, subpoena or court order, or where necessary to protect our rights or someone's safety

A note on tax information. If any of your work involves tax return preparation, additional federal rules govern how tax return information may be used or disclosed, and we will obtain your written consent where those rules require it.

Business transfers. If our business is sold or merged, client records may transfer as part of that transaction. We would notify active clients in advance.

5. How long we keep your information

You may ask us to delete your information at any time. We will do so except where we are required to keep it by law, or where we need it to resolve a dispute or enforce our agreements.

6. Artificial intelligence, in plain terms

We use AI tools to help categorize transactions. We think you should know exactly how.

• What the AI sees: a date, a description and an amount. Your account numbers, routing numbers and balances are never extracted and never leave your statement.
• What it does: proposes a category for each transaction. Anything unclear is flagged for a person, not guessed.
• What it does not do: it does not make final decisions. Every quarter is reviewed by a person before it reaches you.
• Training: we work under business agreements that prohibit the provider from using your data to train their models, on accounts we control.
• We never ask for your bank login, and we do not connect to your accounts. We work from statements you provide.

7. How we protect your information

We maintain a written information security program covering how client data is stored, accessed, retained and disposed of, and we review it at least annually. It includes:

• A designated person responsible for the program
• A written risk assessment
• Encryption of client data in transit and at rest
• Multi-factor authentication on every system that holds client information
• Access limited to the people working on your account
• Confidentiality agreements and security training for anyone who handles client records
• Written vendor review, including the security practices of our portal and processing providers
• A written incident response plan
• Secure disposal of records at the end of their retention period

If something goes wrong. If we discover a security incident affecting your information, we will notify you promptly with what we know, what was affected and what we are doing, and we will meet the notification requirements that apply to us.

No system is perfectly secure, and we will not claim otherwise. What we can tell you is exactly what we do, which is what this section is for.

8. Your choices and rights

Regardless of where you live, you may:

• Ask what information we hold about you
• Ask us to correct anything inaccurate
• Ask us to delete your information, subject to our legal retention obligations
• Ask for a copy of your records in a usable format
• Unsubscribe from any non-essential email at any time

California residents. The California Consumer Privacy Act applies to businesses that meet at least one of three thresholds: annual gross revenue above roughly $26.6 million, buying, selling or sharing the personal information of 100,000 or more California consumers or households, or deriving half or more of revenue from selling or sharing personal information. We meet none of them, so the CCPA does not currently apply to us.

We have chosen to honor the core rights it provides anyway, because we think they are reasonable:

• The right to know what personal information we collect and how we use it
• The right to request a copy of it
• The right to request correction of inaccurate information
• The right to request deletion, subject to our legal retention obligations
• The right not to be treated differently for exercising any of these

We do not sell or share personal information as those terms are defined under California law, and we have never done so.

To exercise any of these, email hello@tallyquarter.com. We will verify your identity before acting on a request, and you may use an authorized agent with written permission. We aim to respond within 45 days.

If our business grows past those thresholds, we will update this policy and comply as required.

Shine the Light. California's Shine the Light law lets residents request information about personal information shared with third parties for their direct marketing purposes. We do not share personal information for anyone's direct marketing purposes, so there is nothing to report. You may still ask, at hello@tallyquarter.com.

Do Not Track. We do not track visitors across websites, so we do not respond to Do Not Track signals differently.

9. Other websites

Our site links to a small number of other sites, including our scheduling provider and our parent firm. Their privacy practices are their own. We encourage you to read them.

10. Changes to this policy

We will post any changes here with a new date. If a change is material, we will email active clients before it takes effect.

11. Contact and complaints

Tax GPS Group LLC
149 Commonwealth Drive #1090, Menlo Park, CA 94025
hello@tallyquarter.com
415-799-8971

If you are not satisfied with how we have handled a privacy question, tell us and we will escalate it internally. You also have the right to contact your state attorney general or the Federal Trade Commission.