Privacy Policy

Last updated: September 23, 2026

CPA Connect, Inc. ("CPA Connect", "we", "us"), a Tennessee corporation based in Franklin, Tennessee, provides practice management software for accounting firms. This policy explains what information we collect, how we use it, who we share it with, and the choices you have. It applies to our website at mycpaconnect.com, our web application, our API, and our integrations (together, the "Service").

If you have questions, or want to exercise any of the rights described below, contact us at support@mycpaconnect.com or through our contact page.

1. Who this policy covers

We handle information about three groups of people:

• Visitors to our public website.
• Users: people at accounting firms who create accounts and use the Service. The firm that invited you is our customer.
• Firm clients: individuals and businesses whose information a firm enters into the Service to manage its engagements, time, and billing. We call this information "Client Data". When a firm invites a client to review and accept an engagement, we create a sign-in for that client tied to the firm's invitation.

For Client Data, the accounting firm decides what to collect and why. CPA Connect processes Client Data only on the firm's instructions, as a service provider to that firm. If you are a firm's client and want to access, correct, or delete information about you, contact your accounting firm first. We will help the firm respond, and we will respond directly where the law requires us to.

2. Information we collect

Information you give us

• Account information: name, email address, password (stored only as a one-way hash), time zone, profile photo, and two-factor authentication settings.
• Firm information: firm name, address, phone number, website, administrator email address, staff list, and billing settings.
• Client Data: information a firm enters about its clients, such as names, contact details, Social Security numbers, employer identification numbers, dates of birth and death, relationships between clients, entity type, fiscal year end, engagement details, questionnaire answers, notes, invoices, payments, and time entries.
• Payment information: when a firm's client pays through the Service, the card or bank details go directly to Stripe, our payment processor. We keep a Stripe payment reference, the amount, and the payment status. We never receive or store full card or bank account numbers.
• Communications: messages you send us through the contact form, email, or support calls.

Information collected automatically

• Usage and device data: pages viewed, actions taken, browser type, operating system, IP address, and timestamps. We use Fathom Analytics on the public website and inside the application. It does not use cookies and does not track you across sites.
• Log data: application and security logs, including sign-in events, API requests, and errors. We also record the IP address and browser of anyone who submits our contact form, and, for users, a history of sign-ins with the device, browser, IP address, and approximate location of each. We keep these to run the Service, investigate problems, and detect abuse.
• Cookies: the Service uses cookies that are required to keep you signed in and to protect against cross-site request forgery. When a firm's client accepts the firm's invitation, we set a signed cookie that remembers the invitation. On payment pages, Stripe.js sets its own cookies to help prevent fraud. We do not use advertising cookies.

Information from integrations

A firm can connect third-party tools to its account. When it does, we receive the data needed to make the integration work. Examples: Stripe Connect (payout account status), Postmark (email delivery events), Zapier (records the firm chooses to sync), and AI assistants such as Claude or ChatGPT (read-only access to the firm's records, only after the firm turns the integration on and a firm user grants access, and only within the scopes that user approves).

3. How we use information

• To provide, operate, and secure the Service.
• To set up accounts, authenticate users, and enforce firm permissions.
• To send invoices, reminders, announcements, and other messages that a firm asks us to send on its behalf.
• To process payments and keep the financial records the law requires.
• To respond to support requests, complaints, and data requests, and to keep a record of them.
• To monitor performance, fix errors, and improve the Service.
• To detect, prevent, and investigate fraud, abuse, and security incidents.
• To comply with legal obligations and enforce our Terms of Service.

We do not use Client Data to train machine learning models, and we do not use it for advertising.

4. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only in these cases:

• With your firm. Members of a firm can see the information that users and clients within that firm enter. Firm administrators manage who is a member.
• With service providers that host and run the Service for us, listed in the next section. Each is bound by contract to use the information only to provide its service to us.
• With integrations a firm connects, as described above and below, under the firm's control.
• For legal reasons, when required by law, subpoena, or court order, or to protect the rights, safety, or property of CPA Connect, our customers, or others.
• In a business transfer, such as a merger or acquisition. We will notify affected customers before their information becomes subject to a different privacy policy.

AI assistants. If a firm connects an AI assistant, such as Claude or ChatGPT, to CPA Connect through our MCP integration, we send that assistant the client information the firm chooses to share when its users ask the assistant about their records. We mask tax identifiers by default. If the firm turns on the option to share them, we send full Social Security numbers and employer identification numbers as well. Once information reaches the assistant, the assistant provider's own terms and privacy policy apply to it. Firms turn the integration on or off, and control the tax identifier option, in their firm settings.

API, Zapier, and exports. Our REST API and our Zapier integration return the same client data a firm member can see in the Service, including full tax identifiers, to whoever holds that member's access. Data exports, such as client lists and invoice reports, are delivered by email as attachments to the person who requested them.

5. Service providers we use

These companies process information on our behalf. All are located in the United States or store our data in United States regions.

We will update this list when we add or replace a provider that handles personal information.

6. How we protect information

• All traffic to and from the Service is encrypted in transit with TLS.
• Our hosting providers encrypt data at rest. We also encrypt these fields inside the database: Social Security numbers, employer identification numbers, contact names, dates of birth and death, email addresses, phone numbers, addresses, notes, questionnaire answers, and support request messages and notes.
• Users can turn on two-factor authentication for their accounts.
• We require staff to use multi-factor authentication on the hosting, database, and source code accounts that give access to production systems, and we limit that access to authorized staff.
• Every firm's data is isolated from every other firm's data by application-level permissions.
• We log staff access to our admin console and production console, and every request an AI assistant makes on a firm's behalf.
• Backups are taken daily and retained for ten days, with point-in-time recovery.
• We maintain an information security program and are pursuing a SOC 2 examination.

No system is perfectly secure. If we learn of a breach that affects your information, we will notify you and any regulator as the law requires.

7. How long we keep information

• Account and firm data: for as long as the firm's account is active. After termination we delete your data within 90 days.
• Client Data: for as long as the firm keeps it in the Service. Firms can delete client records at any time.
• Version history: when a client record is changed or deleted, we keep its version history for the same period as the record. Firms can ask us to purge it.
• Records we must keep by law: CPA Connect's own financial and tax records are kept for seven years.
• Backups: ten days.
• Logs: up to one year, unless needed longer for a security investigation.
• Support and data requests: for three years, so we can show how we handled them.

8. Your rights and choices

Depending on where you live, you may have the right to:

• Know what personal information we hold about you and receive a copy of it.
• Correct information that is inaccurate.
• Delete your personal information.
• Receive your information in a portable format.
• Object to or restrict certain processing.
• Not be discriminated against for exercising these rights.

Users can update their profile and account settings from inside the Service. Firm members can delete client records and export reports at any time. To close a firm's account or delete a user account, contact us.

Requesting deletion of your data

To ask us to delete personal information, use our data deletion request form, or email support@mycpaconnect.com with the subject "Data deletion request". Tell us your name, the email address on the account, and the firm you are associated with, if any.

We log every request, verify the identity of the person making it, and respond within 30 days. If you are a firm's client, we will forward the request to that firm, because the firm controls that data, and we will confirm to you when it is resolved. Some information cannot be deleted while a legal retention period applies. In that case we will tell you what we kept and why.

California residents

CPA Connect is currently below the thresholds at which the California Consumer Privacy Act applies to a business. We extend its rights to California residents anyway: the right to know the categories of personal information we collect (identifiers, commercial information, internet activity, professional information, and financial information), the sources, the business purposes, and the categories of third parties we share it with, all of which are described in this policy; the right to delete and to correct; and the right not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in California law. You may designate an authorized agent to make a request for you. We will need to verify your identity before we act on a request.

9. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children.

10. Where information is stored

We store and process information in the United States. If you use the Service from outside the United States, you consent to that transfer.

11. Changes to this policy

We may update this policy from time to time. We will post the new version here and change the date at the top. If a change materially reduces your rights, we will notify firm administrators by email before it takes effect.

12. Contact us

CPA Connect, Inc.
Franklin, Tennessee
Email: support@mycpaconnect.com
Web: mycpaconnect.com/contact