Privacy Policy

Journey.tax, a platform operated by Journey Tax Inc. ("we," "our," or "us"), respects your privacy. This Policy explains how we handle information in connection with the Service.

1. Our Two Roles

• Controller: for information about firm users and accounts (e.g., name, email, company, billing, usage), we are the controller and use it to provide and operate the Service.
• Processor / service provider: for client data that firms submit (including tax return information), we act on the firm's behalf. The firm is the controller of that data, and our handling of it is governed by the Data Processing Addendum.

2. Information We Collect

Account information (name, email, company, billing); usage and device/log data; and client data entered by firms, which we process on their behalf. When you complete or attempt multi-factor authentication, or use related account security features such as recovery codes, we record the IP address and browser of that request to protect accounts and investigate suspicious activity. Where a client authorizes a bank connection for a firm's bookkeeping, that client data also includes bank and card account information (account name, mask, type and balance) and the date, description and amount of each transaction, received from the client's financial institution through Plaid. We never receive the client's banking credentials.

3. How We Use Information

To provide, secure, and improve the Service; process transactions; communicate with users; and meet legal obligations. We do not use client data submitted by firms for our own purposes, and we do not use it to train third-party AI models (see the Data Processing Addendum).

4. GLBA / Safeguards

Many of our firm customers are "financial institutions" under the Gramm-Leach-Bliley Act, which makes us their service provider under the FTC Safeguards Rule. We maintain safeguards consistent with that role and with IRS Publication 4557, and we support firms' oversight obligations (see the Data Processing Addendum).

5. Data Sharing

We do not sell personal information. We share data only with subprocessors that help us operate the Service (listed in the Data Processing Addendum), and with legal authorities where required by law. Where a firm uses the bookkeeping features, we send the date, description and amount of a bank transaction, and the account names in that client's chart of accounts, to our AI subprocessor to suggest a category. We do not send the client's name, address, email address or telephone number with it, and that data is not used to train the provider's models.

6. Data Retention

We retain data as needed to provide the Service and meet legal obligations; client data is retained and deleted per the firm's instructions and the Data Processing Addendum. Records of multi-factor authentication and account security activity, including the IP address and browser recorded with them, are kept for one year and then deleted. A bank connection is kept until the client disconnects it, at which point we instruct Plaid to remove the connection and delete the stored access token. Transactions already recorded in a firm's ledger stay in the firm's books, because they are the firm's accounting records, and are retained and deleted with the rest of the firm's data.

7. Security

We implement administrative, technical, and physical safeguards to protect data, including encryption in transit and at rest, role-based access controls, multi-factor authentication for administrative access, time-limited signed URLs for document access, and monitoring.

8. Your Rights

Depending on jurisdiction, users may have rights to access, correct, or request deletion of their information. Client-data rights are exercised through the relevant firm as controller. Contact us to make a request.

9. Third-Party Services

We are not responsible for external services you link to through the platform.

Bank connections. We obtain bank and card account and transaction data through Plaid Inc. ("Plaid"). By connecting an account, a client also agrees to Plaid's handling of their data, which is described in Plaid's end user privacy policy. The connection is read only: neither the firm nor Journey Tax Inc. can move money through it.

10. Cookies and Local Storage

We use only what the Service needs in order to work. We do not use advertising cookies, analytics cookies, or any third-party tracking, and we do not load third-party trackers into the Service.

What we store on your device:

• One cookie, recording whether the navigation sidebar is expanded or collapsed.
• Browser local storage, holding your sign-in session and functional state: which firm you are working in, when you were last active (used to end idle sessions), when you last completed multi-factor verification, recently viewed items, and in-progress form state so you do not lose work.

None of this is used to profile you, to build an advertising audience, or to follow you across other websites. Because each item is either strictly necessary to provide the Service or a preference you set yourself, we do not display a cookie consent banner. You can clear this data at any time in your browser, which will sign you out and reset your preferences.

11. Text Messaging (SMS)

The Service can send text messages to a firm's clients on the firm's behalf, where the firm enables it and the client opts in through the client portal. Journey Tax Inc. operates the messaging platform and is the registrant of the sending number; client mobile numbers and opt-in status are processed as client data on the firm's behalf. We do not sell or share mobile opt-in information or phone numbers with third parties for their own marketing purposes. The client-facing terms of this messaging program are published in our SMS / Text Messaging Terms at journey.tax/legal/sms.

12. Changes and Contact

We may update this Policy and will post the updated version with a new effective date.