Privacy Policy — Profit Maker App (DRAFT)

Effective date: [DATE — set on the day this policy is published]
Operator: Legacy Tax & Strategy Inc ("Legacy", "we", "us")
Contact: cesar@intolegacy.com · 895 Dove St. Ste. 300, Newport Beach, CA 92660 · (714) 305-6622
App URL: https://profit-maker.app

1. Who this policy applies to

This policy explains how we collect, use, and protect information in Profit Maker App (the "App"), a private financial portal available only to clients of Legacy and to authorized Legacy staff. Access is by invitation only.

2. Information we collect

a. Account information: name, email address, company you are associated with, and login activity (e.g., sign-in times). Passwords are handled by our authentication provider and are never stored in readable form.

b. Financial information from QuickBooks Online: with authorization from an administrator of the relevant QuickBooks Online company, we access accounting data such as profit and loss, balance sheet, account balances, and transaction details. We request read access only to accounting data.

c. Information you enter in the App: business goals (e.g., target margins, target cash reserve) and compliance checklist statuses and notes.

d. Technical information: basic device and browser data and logs needed to operate and secure the App.

We do not knowingly collect information from children under 13 and the App is not directed to them.

3. How we use information

To display your company's financial dashboard, reports, goals, and alerts.
To calculate key performance indicators and rule-based alerts for your company.
To notify you when a new monthly report is available.
To provide accounting and advisory services you have engaged Legacy to perform.
To secure the App, prevent unauthorized access, and keep audit records.

We do not sell your information, and we do not use your financial data for advertising.

4. How information is shared

We share information only:

With authorized users of your company that you or Legacy have invited.
With Legacy staff who provide services to your company.
With service providers that host and operate the App on our behalf under confidentiality obligations, currently: [Supabase (database and authentication), Vercel (hosting), Intuit (QuickBooks Online API), EMAIL PROVIDER (transactional email)].
When required by law, or to protect the rights, property, or safety of Legacy, our clients, or others.
In connection with a merger, acquisition, or sale of assets, subject to this policy.

5. QuickBooks Online data

Connections to QuickBooks are made through Intuit's official OAuth authorization. We never see or store your QuickBooks password.
Access tokens are stored encrypted on our servers and are never exposed to the browser.
An administrator can disconnect the App at any time from within QuickBooks Online or by contacting us. After disconnection we stop retrieving new data.
Monthly financial snapshots already published remain part of your client records unless deletion is requested (see Section 7), subject to our professional record-keeping obligations.

6. Data security

We use industry-standard safeguards, including encryption in transit (HTTPS/TLS), encryption of stored credentials, access controls that limit each user to their own company's data, multi-factor authentication for staff, and audit logging. No system is 100% secure; we will notify affected users of a security incident as required by law.

7. Data retention and your choices

We keep account and financial data while you are a client and for seven (7) years afterward, or as required for professional and legal record-keeping.
You may request access to, correction of, or deletion of your personal information by contacting cesar@intolegacy.com. We will respond within forty-five (45) days, subject to legal retention requirements.
California residents: depending on whether the California Consumer Privacy Act (CCPA/CPRA) applies to us, you may have the right to know, delete, and correct personal information, and to not be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising. [ATTORNEY: confirm CCPA applicability and required disclosures.]

8. Cookies

The App uses only cookies and similar storage necessary for sign-in and security. We do not use advertising cookies.

9. International users

The App is hosted in the United States. Some authorized Legacy staff who provide accounting services work from Mexico and may access client information from there, subject to the same confidentiality obligations, access controls, and security safeguards described in this policy.

10. Changes to this policy

We may update this policy. We will post the new version in the App and update the effective date; material changes will be communicated by email or in-app notice.

11. Contact

Legacy Tax & Strategy Inc · cesar@intolegacy.com · 895 Dove St. Ste. 300, Newport Beach, CA 92660 · (714) 305-6622