Privacy Policy

Journey.tax, operated by Secord Fintech Inc. ("we," "our," or "us"), respects your privacy. This Policy explains how we handle information in connection with the Service.

1. Our Two Roles

• Controller: for information about firm users and accounts (e.g., name, email, company, billing, usage), we are the controller and use it to provide and operate the Service.
• Processor / service provider: for client data that firms submit (including tax return information), we act on the firm's behalf. The firm is the controller of that data, and our handling of it is governed by the Data Processing Addendum.

2. Information We Collect

Account information (name, email, company, billing); usage and device/log data; and client data entered by firms, which we process on their behalf.

3. How We Use Information

To provide, secure, and improve the Service; process transactions; communicate with users; and meet legal obligations. We do not use client data submitted by firms for our own purposes, and we do not use it to train third-party AI models (see the Data Processing Addendum).

4. GLBA / Safeguards

Many of our firm customers are "financial institutions" under the Gramm-Leach-Bliley Act, which makes us their service provider under the FTC Safeguards Rule. We maintain safeguards consistent with that role and with IRS Publication 4557, and we support firms' oversight obligations (see the Data Processing Addendum).

5. Data Sharing

We do not sell personal information. We share data only with subprocessors that help us operate the Service (listed in the Data Processing Addendum), and with legal authorities where required by law.

6. Data Retention

We retain data as needed to provide the Service and meet legal obligations; client data is retained and deleted per the firm's instructions and the Data Processing Addendum.

7. Security

We implement administrative, technical, and physical safeguards to protect data, including encryption in transit and at rest, role-based access controls, multi-factor authentication for administrative access, time-limited signed URLs for document access, and monitoring.

8. Your Rights

Depending on jurisdiction, users may have rights to access, correct, or request deletion of their information. Client-data rights are exercised through the relevant firm as controller. Contact us to make a request.

9. Third-Party Services

We are not responsible for external services you link to through the platform.

10. Text Messaging (SMS)

The Service can send text messages to a firm's clients on the firm's behalf, where the firm enables it and the client opts in through the client portal. Secord Fintech Inc. operates the messaging platform and is the registrant of the sending number; client mobile numbers and opt-in status are processed as client data on the firm's behalf. We do not sell or share mobile opt-in information or phone numbers with third parties for their own marketing purposes. The client-facing terms of this messaging program are published in our SMS / Text Messaging Terms at journey.tax/legal/sms.

11. Changes and Contact

We may update this Policy and will post the updated version with a new effective date.