1. Data Controller
TM Advisors Group is the data controller for personal information collected through the Service.
For data protection inquiries, contact privacy@tmadvisorsgroup.com.
2. Information We Collect
Account information: name, email address, password (hashed), phone number, profile photo, preferred language.
Company information: company name, legal name, tax ID, country, business address, contact persons, industry, entity type.
Financial data: bank account connections (via Plaid — we never see your bank credentials), bank transactions, invoices, expenses, customers, projects, Chart of Accounts entries. This data belongs to you; we host it on your behalf.
Payment information: handled by Stripe. We receive a tokenized reference to your payment method but never the full card number.
Usage data: pages visited, features used, IP address, browser type, device type, timestamps. Collected via standard server logs and product analytics.
Communications: emails, support tickets, chat messages with us.
Cookies: see Section 7 for details.
3. How We Use Your Information
Provide and operate the Service: authenticate you, store and process your data, deliver features.
Billing: process subscription payments via Stripe, manage trials, send receipts.
AI processing: transaction categorization, project matching, tax strategy suggestions. Specific transaction descriptions and metadata may be sent to our AI provider (Anthropic) for processing. We do not allow your data to be used to train third-party models.
Support: respond to inquiries, troubleshoot issues, provide product onboarding.
Product improvement: aggregated and anonymized analytics to understand usage patterns.
Communications: account notifications, billing reminders, security alerts, and (with your consent) product updates and marketing.
Legal compliance: respond to lawful requests, enforce our Terms, prevent fraud and abuse.
5. Sub-processors
A current list of sub-processors is maintained at tmadvisorsgroup.com/legal/subprocessors (in preparation). We will provide at least 30 days' notice before adding a new sub-processor.
6. Data Retention
Active accounts: we retain your data for as long as your account is active.
After cancellation: we retain financial records for 7 years to comply with tax and accounting regulations, after which they are securely deleted. Other personal information is deleted within 90 days of account closure, unless we are required to retain it for legal compliance.
You may request earlier deletion via privacy@tmadvisorsgroup.com, subject to our legal retention obligations.
8. International Data Transfers
Your information may be processed in countries other than your country of residence, including the United States. We rely on Standard Contractual Clauses (SCCs) and other lawful mechanisms for international transfers.
By using the Service you consent to your information being processed in the United States and other jurisdictions where our service providers operate.
9. Your Rights
GDPR (EU/EEA): right to access, rectify, erase, restrict processing, object, data portability, withdraw consent, and lodge a complaint with a supervisory authority.
CCPA (California): right to know what personal information we collect, sell, or disclose; right to delete; right to opt out of sale (we do not sell); right to non-discrimination.
LGPD (Brazil): equivalent rights including access, rectification, anonymization, portability, and deletion.
To exercise any of these rights, contact privacy@tmadvisorsgroup.com. We will respond within 30 days or the timeline required by your jurisdiction.
10. Security
We implement industry-standard administrative, technical, and physical safeguards to protect personal information. These include TLS encryption in transit, encryption at rest, Row-Level Security in the database, role-based access controls, periodic security reviews, and incident response procedures.
No method of transmission over the Internet is 100% secure. We cannot guarantee absolute security but commit to notifying affected users and authorities of any breach as required by law (typically within 72 hours for GDPR).
11. Children's Privacy
The Service is not directed to individuals under 18. We do not knowingly collect personal information from children. If we learn we have collected information from a child, we will delete it.
12. AI Processing Disclosure
When you use AI features (transaction categorization, project matching, tax suggestions), relevant transaction data and context may be sent to Anthropic's API for processing.
We have a data processing agreement with Anthropic that prohibits the use of your data for training their models.
AI-generated outputs are suggestions only and require your review. They are not professional financial or legal advice.
13. Changes to This Policy
We may update this Policy from time to time. Material changes will be communicated via email and an in-app banner at least 30 days before they take effect.
The most current version is always available at /privacy.
14. Contact
Privacy inquiries: privacy@tmadvisorsgroup.com
Security issues: security@tmadvisorsgroup.com
General support: support@tmadvisorsgroup.com