1. Introduction
AiroTax ("we," "our," or "us") is an accounting collaboration platform operated by Amal & Company. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you:
- Use our web application at app.airotax.com (the "Service"). By creating an account, you agree to this policy as part of our Terms of Service.
- Visit our marketing website at airotax.com. Browsing the marketing site does not create an account or require agreement to this policy beyond the cookie notice displayed on first visit.
If you do not agree with any part of this policy, you should not create an account or continue using the Service.
2. Information We Collect
2.1 Account Information
When you create an account, we collect:
- Identity data: Name, email address, firm name, and role (e.g., accountant, firm owner, staff).
- Authentication data: Encrypted password and session tokens. We never store plaintext passwords.
- Subscription data: Plan tier, billing information, and usage records. Payment card details are processed by our payment processor and are never stored on our servers.
2.2 Client and Financial Data
When you use the Service to manage clients and connect financial accounts, we process:
- Client records: Client names, contact details, owner information, assigned team members, and enabled modules — as entered by your firm.
- QuickBooks data: Financial transactions, profit and loss statements, balance sheets, customer lists, vendor lists, and employee lists — accessed through your authorized QuickBooks Online or QuickBooks Desktop connection. This data is synced from Intuit's servers or your local QuickBooks Desktop company file and stored in your AiroTax workspace.
- Task data: Task names, descriptions, due dates, assignments, chat messages, and completion status — created by your firm and shared with clients through the portal.
- W9 form data: Taxpayer identification numbers (TINs/SSNs), business names, addresses, signatures, and certification details — submitted by clients through W9 form requests.
W9 forms contain sensitive tax identification information. See Section 6 for our data security practices.
2.3 Usage and Technical Data
We automatically collect the following through server logs and essential session storage:
- Log data: IP address, browser type, operating system, referring URLs, pages visited, and timestamps.
- Usage metrics: Features accessed, QuickBooks sync events, form submissions, and error events.
- Device data: Screen resolution and language preferences for responsive layout and localization.
We use authentication tokens (JWTs) stored in your browser's local storage to keep you logged in. These are strictly necessary for the Service to function and are deleted when you log out or your session expires. We do not use third-party advertising cookies, tracking pixels, or cross-site trackers. If we introduce analytics cookies in the future, we will notify you and obtain consent where required by law.
3. How We Use Your Information
We use collected information for the following purposes, with the corresponding legal basis under applicable data protection laws:
- Service delivery (Contractual necessity): Providing the core AiroTax platform — client management, task tracking, QuickBooks data sync and display, W9 form request and submission workflows, and client portal access. This is necessary to fulfill our contract with you.
- Account management (Contractual necessity): Creating and maintaining your account, processing subscription payments, and enforcing usage limits per your plan tier.
- Communication (Legitimate interest): Sending service-related emails (account verification, password resets, billing notices, product updates). You may opt out of non-essential communications at any time. We do not send marketing emails without your explicit opt-in consent.
- Improvement and analytics (Legitimate interest): Analyzing aggregated, de-identified usage patterns to improve the Service, fix bugs, and develop new features. This processing uses anonymized data that cannot be linked back to individual users or firms.
- Legal compliance (Legal obligation): Complying with applicable laws, regulations, legal processes, or enforceable governmental requests.
4. How We Share Your Information
4.1 Service Providers
We share data with third-party service providers who perform services on our behalf:
- Cloud Infrastructure: Application hosting, database storage, and file storage on our hosting provider.
- Payment Processing: Payment card transactions are processed by our payment processor. We do not store full payment card numbers.
- Email Delivery: Transactional emails are sent through our email service provider.
- QuickBooks: Financial data is accessed from Intuit's QuickBooks API when you authorize a connection. We do not share your data with Intuit beyond what is necessary to sync your QuickBooks data.
4.2 Legal Disclosures
We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court order, subpoena, or government investigation).
4.3 Business Transfers
If Amal & Company is involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction. We will notify you before your information is transferred and becomes subject to a different privacy policy.
4.4 What We Do NOT Do
- We do not sell your personal data or client data to third parties.
- We do not share your QuickBooks financial data outside of your authorized workspace.
- We do not share your data with advertisers or data brokers.
- We do not use your data for any purpose not described in this policy.
5. Data Retention
- Account data: Retained while your account is active. Upon account deletion, personal data is removed within 30 days.
- Client records and task data: Retained while your account is active. You may delete individual records at any time through the dashboard. Deleted data is purged from active storage within 30 days and from backups within 90 days.
- QuickBooks financial data: Retained while your QuickBooks connection is active. If you disconnect a QuickBooks company, its synced financial data is removed within 30 days.
- W9 form data: Retained while the associated client record is active. Deleted when the client record is deleted or upon your request.
- Usage logs and analytics: Retained for up to 24 months in aggregated, de-identified form.
- Backups: Encrypted backups are retained for up to 90 days for disaster recovery purposes.
6. Data Security
AiroTax handles sensitive financial and tax identification data. We implement industry-standard security measures:
- Encryption: TLS 1.2+ for data in transit. AES-256 for data at rest. Encrypted backups.
- Authentication: JWT-based authentication with token expiry. API key authentication for service-to-service communication. Multi-factor authentication support.
- Access controls: Role-based access control (RBAC) with granular permissions — firm owners, accountants, staff, and client users. Each client sees only their own data. QuickBooks financial data is access-controlled per client.
- Infrastructure: Hosted on secure cloud infrastructure with firewall protection. Services communicate over private networks where possible. Regular security patches and dependency updates.
- Monitoring: Real-time error tracking, anomaly detection, and access pattern monitoring.
- W9 form handling: Tax identification numbers (TINs/SSNs) in W9 forms are stored encrypted. Access to completed W9 forms is restricted to authorized firm personnel.
However, no method of electronic storage or transmission is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
7. QuickBooks Data Handling
AiroTax connects to your QuickBooks Online and QuickBooks Desktop accounts to sync financial data. Here is how that data is handled:
- Authorization: You control which QuickBooks companies are connected and which clients can access them. Connections are established through Intuit's OAuth 2.0 authorization flow or QuickBooks Web Connector (for Desktop).
- Data accessed: We sync the financial data necessary to provide the Service — transactions, chart of accounts, profit and loss data, balance sheet data, customer/vendor/employee lists, and company information. We only access data for companies you explicitly connect.
- Data storage: Synced QuickBooks data is stored in your AiroTax workspace and access-controlled per your configuration. Client users see only the data for companies you grant them access to.
- Revocation: You may disconnect any QuickBooks company at any time through the AiroTax dashboard or through your Intuit account settings. Disconnected company data is removed from AiroTax within 30 days.
- No data sharing: Your QuickBooks data is never shared with other AiroTax firms, clients outside your workspace, or third parties beyond what is necessary to provide the Service.
8. Your Rights and Choices
Depending on your jurisdiction, you may have the following rights:
- Access: Request a copy of the personal data we hold about you.
- Correction: Request correction of inaccurate or incomplete data.
- Deletion: Request deletion of your account and associated data (subject to legal retention requirements).
- Portability: Request export of your data in a structured, machine-readable format.
- Restriction: Request restriction of processing under certain circumstances.
- Objection: Object to processing based on legitimate interests.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days (or the timeframe required by applicable law). We may need to verify your identity before processing your request. You will not be discriminated against for exercising any of these rights.
8.1 California Privacy Rights
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you additional rights:
- Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you in the preceding 12 months.
- Right to delete: Request deletion of personal information we have collected from you, subject to certain exceptions.
- Right to opt out of sale/sharing: We do not sell or share personal information as defined by the CCPA. No opt-out is necessary.
- Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.
To exercise your California privacy rights, contact us at [email protected]. We will verify your identity before processing your request. You may also designate an authorized agent to make a request on your behalf.
8.2 Do Not Track
Some browsers include a "Do Not Track" (DNT) setting. AiroTax does not respond to DNT signals because there is no established industry standard for how to interpret them. However, as stated in Section 2.3, we do not use third-party tracking cookies or cross-site trackers on our Service.
9. International Data Transfers
AiroTax is hosted on servers in the United States. If you access the Service from outside the US, your data will be transferred to and processed in the US. Where required by applicable law (such as the GDPR for EU/EEA residents), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission as the legal mechanism for such transfers. By using the Service, you acknowledge that your data will be processed in the United States under the safeguards described in this policy.
10. Children's Privacy
The Service is a business-to-business accounting platform and is not intended for individuals under the age of 18. We do not knowingly collect personal information from anyone under 13 (the age threshold under the Children's Online Privacy Protection Act, or COPPA) without verified parental consent. If we learn that we have collected personal data from a child under 13 without such consent, we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email (to the address associated with your account) or through a prominent notice on the Service prior to the change becoming effective. The "Last updated" date at the top of this page indicates when this policy was last revised. Your continued use of the Service after any changes constitutes acceptance of the updated policy.
12. Contact Us
If you have questions about this Privacy Policy or our data practices, contact us:
- Email: [email protected]
- Mail: Amal & Company — Data Protection, 8 The Green, Suite A, Dover, DE 19901, United States
- Website: amalandcompany.com