Privacy Policy

Introduction

Timothy LeGendre CPA LLC ("we," "our," or "us") is committed to protecting your privacy and the security of your financial information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (timcpa.com), use our client portal, or engage our professional services.

As a licensed CPA firm handling financial data subject to regulatory requirements, we maintain security controls that meet or exceed industry standards for the protection of your personal and financial information.

Information We Collect

Information You Provide Directly

• Contact information, name, email address, phone number
• Business information, entity name, entity type, EIN, NAICS code, revenue, transaction volume
• Financial documents, tax records, receipts, and other documents uploaded through our secure client portal
• Communication preferences, service selections and scheduling preferences
• Secure messages, communications sent through our encrypted portal messaging system

Information Collected Through QuickBooks Online

For clients whose books live in QuickBooks Online, we connect to your QuickBooks file with your authorization, through Intuit's consent screen. We access chart of accounts, transaction, and report data, and we post the bookkeeping entries we prepare on your behalf. Intuit's handling of your data is governed by the Intuit Privacy Statement. You can revoke this authorization at any time, in your Intuit account, or by asking us to disconnect.

Information Collected Automatically

• Server and security logs, our infrastructure providers (Railway hosting, Cloudflare CDN) automatically log standard request metadata such as IP address, timestamp, and pages requested, for security, reliability, and abuse prevention. Our main website does not use third-party web analytics.
• Device and browser information, browser type, operating system, and screen resolution
• Cookies, session management and user preference cookies (see Cookies section below)

We do not use third-party advertising or analytics tags anywhere on this website or in your client portal. No advertising pixels, tag managers, or behavioral analytics scripts are loaded on any page.

How We Use Your Information

We use the information we collect to:

• Provide full-cycle bookkeeping, accounting, and tax preparation services
• Import and categorize bank and credit card transactions for general ledger management
• Generate financial statements (Trial Balance, Income Statement, Balance Sheet) for your review
• Reconcile bank account balances
• Communicate with you about our services and your financial records
• Send service quotes and pricing estimates
• Schedule consultations and appointments
• Comply with legal, regulatory, and IRS record retention requirements
• Improve our website, client portal, and services
• Maintain audit trails for security and regulatory compliance

Your Client Portal

Clients receive access to a secure portal where they can:

• Upload and download encrypted documents
• Send and receive encrypted secure messages
• Complete their tax organizer, answer document requests, and sign documents electronically
• Keep record-keeping logs and Schedule C and Schedule E worksheets
• Manage their profile and account settings

Portal access is available through free self-registration or a secure invitation from our firm. Free accounts include the record-keeping logs, worksheets, and document storage with usage limits, while full-service client accounts are individually provisioned.

Data Security

We implement comprehensive technical and organizational security measures to protect your information:

• Encryption in transit, all data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher, enforced via HSTS headers
• Encryption at rest, client documents are encrypted using AES-256-GCM before storage; secure messages use hybrid RSA-OAEP + AES-256-GCM encryption
• Financial connection security, QuickBooks Online access tokens are encrypted using AES-256-GCM and stored exclusively on our servers; they are never exposed to your browser or included in any client-facing response
• Access controls, role-based access control with Row Level Security enforced at the database level ensures clients can only access their own data
• Session security, client portal sessions enforce a 30-minute inactivity timeout with automatic sign-out
• Audit logging, all administrative actions on client data are logged for security monitoring
• Infrastructure security, our application infrastructure is hosted on SOC 2 compliant platforms (Supabase, Railway) with managed security patching and monitoring

While we implement industry-leading security controls, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your information using best practices appropriate for CPA financial data.

Information Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• Intuit QuickBooks Online, when you authorize a QuickBooks connection, your accounting data is exchanged with Intuit on our behalf, governed by the Intuit Privacy Statement linked in the Information We Collect section above.
• Billing and payments (Anchor). We use Anchor (sayanchor.com) to send engagement agreements and collect payment for our services. Your name, email, and business name are shared with Anchor to administer billing; payment details you enter when paying an invoice are collected directly by Anchor under its Privacy Policy.
• Infrastructure providers. We use trusted service providers for application hosting (Railway), database and authentication (Supabase), email delivery (Resend), and appointment scheduling and firm email (Google Workspace APIs, consultation bookings create a calendar event containing your name, email, and meeting details). These providers process data on our behalf and do not have independent access to your information.
• AI assistants. I use AI assistants, under my direction, to help manage my client records: Claude (Anthropic) and Grok Bot (run by Cursor, using xAI's Grok models). When I use one, it can read the contact and business details in my client management system: your name, email, phone, business name and entity type, the services and fees I have quoted you, my notes, and the documents and questions I have requested from you. It cannot read your Social Security number, your encrypted tax profile, your answers to my questions, or the documents you upload. I use these services with model training turned off, so your information is not used to train their AI models. A request or tax organizer is sent to you only after I approve it.
• Legal compliance, when required by law, court order, government regulation, or IRS inquiry
• Business transfers, in connection with a merger, sale, or transfer of business assets
• With your consent, when you explicitly authorize us to share your information

We do not use your data for advertising, marketing profiling, or any AI/machine learning training. No automated system makes decisions about your finances; every bookkeeping and tax decision is made by a licensed CPA.

Data Retention and Deletion

We retain your data according to the following schedule:

• Financial records and transaction data 3 years from the end of the applicable tax year, matching the 3-year record requirement the IRS places on prepared returns
• Client documents 3 years from the end of the applicable tax year, and in practice kept up to 6 years so your records stay available for as long as a return can still be examined
• Client PII (contact and business information), duration of our professional engagement plus 3 years
• Secure messages, automatically deleted 7 days after being read (the message and its record are removed together)
• Financial connection credentials, QuickBooks Online access tokens are deleted when the connection is removed
• Portal invitation tokens, expire after 7 days
• Audit and activity logs, retained for 1–3 years for security monitoring

When a client engagement ends:

• Portal access is revoked
• An active QuickBooks Online connection is disconnected and its stored access credentials are deleted
• Financial data is retained for the periods listed above
• You may request deletion of your data at any time, subject to legal retention obligations

Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies:

• Essential cookies, required for website functionality and security

You can control cookie preferences through your browser settings. Disabling cookies may affect certain website functionality but will not impact your client portal experience.

Our client portal does not store any personal or financial data in browser cookies, localStorage, or sessionStorage. Only non-sensitive UI preferences (layout settings, theme) are stored locally.

Your Rights

You have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Delete your personal information (subject to IRS legal retention requirements)
• Disconnect a QuickBooks Online connection at any time, which ends our access to that file's data, stored credentials are deleted when the connection is removed, and you can also revoke authorization directly in your Intuit account
• Opt-out of marketing communications
• Request a copy of your financial records and statements
• Revoke portal access at any time by contacting us

To exercise any of these rights, contact us at [email protected].

Client-Accountant Privilege

As a licensed CPA, communications between us and our clients may be protected by client-accountant privilege under applicable Florida state laws. We maintain strict confidentiality in accordance with AICPA professional standards and ethical requirements.

Florida Information Protection Act

As a Florida-based business, we comply with the Florida Information Protection Act of 2014 (FIPA). In the event of a data breach affecting your personal information, we will notify affected individuals within 30 days as required by Florida law.

Third-Party Links

Our website may contain links to third-party websites, including our financial connection and billing providers, financial institutions, and professional organizations. We are not responsible for the privacy practices or content of these external sites. We encourage you to review their privacy policies.

Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top of this page indicates when the policy was last revised. Material changes will be communicated to active portal clients via secure message or email. We encourage you to review this policy periodically.

Contact Us

If you have questions or concerns about this Privacy Policy, our data practices, or wish to exercise your data rights, please contact us: