Tax Practice Portal Privacy Policy

This Privacy Policy describes how Escochecks Inc., doing business through Tax Practice Portal ("TPP," "we," "us," or "our"), collects, uses, and shares information in connection with the Service, as defined in TPP's Terms & Conditions.

This Policy covers two categories of information, using the definitions in the Terms: "Customer Data" (information about a firm's account, users, configuration, and Service usage) and "Client Data" (information a Customer firm or its taxpayer clients submit to or exchange through the Service, which may include Tax Return Information).

For Customer Data, TPP generally acts as the party that determines how that information is used to operate and improve the Service. For Client Data, TPP generally acts as a service provider, contractor, or processor acting on a Customer firm's instructions — the firm, not TPP, controls what Client Data it submits and why. Where California's service-provider/contractor framework or a similar processor framework applies, TPP does not use Client Data for its own independent purposes beyond providing and supporting the Service.

This Policy applies to Authorized Users (firm staff) and Client Portal Users (a firm's taxpayer clients) alike, except where a section says otherwise.

Account and firm information: name, email address, phone number, role, firm name, firm address, and similar registration details, provided when a firm or user signs up or is invited.

Client Data: documents, tax return information, client contact details, communications, e-signature records, and related information that a firm or its taxpayer clients submit to or exchange through the Service in the course of preparing or managing a tax engagement.

Billing information: subscription plan, billing address, and transaction history. Full payment card details are collected and stored by our payment processor (Stripe), not by TPP directly — see Section 5.

Usage and device information: pages and features accessed, actions taken in the Service, IP address, browser and device type, and similar technical data, collected automatically through standard web-server and application logging.

Communications: messages sent through the Service's internal messaging, portal messaging, or support channels, and correspondence sent to us directly (for example, to the contact address in Section 12).

Authentication data: information needed to verify identity and secure an account, such as a hashed credential, multi-factor authentication status, and sign-in activity. TPP's identity provider (Clerk) manages primary credential storage — see Section 5.

Cookies and similar technologies: see Section 6.

Directly from you or your firm: account registration, profile information, uploaded documents, and messages entered into the Service.

From your firm's clients: a taxpayer client may submit documents, answers, or communications directly through the Client Portal at the invitation of their firm.

Automatically: usage and device information generated by using the Service.

From integrated third-party services: where a firm chooses to connect a real, functioning integration (currently email and calendar providers, and e-signature, as described on TPP's Integrations page and Security Center), information may flow from that provider to TPP to operate the connected feature. TPP's Integrations page and Security Center label each integration's actual functional status; connecting an integration that is not yet functional does not transmit any data.

From our payment processor: Stripe provides TPP with limited billing-relevant information (for example, subscription status and the last four digits of a payment card) — not full card numbers.

To provide, operate, secure, and support the Service, including authenticating users, enforcing firm and role-based access boundaries, and displaying a firm's own data back to it.

To process billing and manage subscriptions, trials, and plan entitlements.

To communicate with you about the Service, including transactional messages, security notices, and — where you have not opted out and applicable law permits — product updates.

To maintain security, investigate suspected unauthorized access or abuse, and enforce the Terms & Conditions.

To diagnose technical problems and improve the Service's reliability and features.

To comply with legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims.

TPP does not use Client Data to train shared or generally-available machine-learning models, and does not sell Client Data or Customer Data. See Section 8 for California-specific "sale" and "share" disclosures.

We do not sell personal information, and we do not share Client Data with third parties for their own independent marketing purposes.

We share information with service providers who process it on our behalf, strictly to operate the Service, including:

• Clerk (identity and authentication infrastructure) — to manage sign-in, sessions, and account security;

• Stripe (payment processing) — to process subscription payments; TPP does not receive or store full payment card numbers;

• a cloud hosting and storage provider (Amazon Web Services), where a firm's document storage is configured to use durable cloud storage rather than local storage — documents are encrypted at rest in that configuration;

• Google or Microsoft, only where an Authorized User has affirmatively connected their own Google or Microsoft account for email or calendar functionality — TPP accesses only what that connection's scope permits, and only for that user;

• SignNow, only where a firm has affirmatively connected e-signature functionality — to route documents for electronic signature.

We may disclose information where required by law, regulation, legal process, or governmental request, or where reasonably necessary to protect the rights, property, or safety of TPP, our customers, or others, consistent with Terms §46 (Government and Legal Requests).

If TPP is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to confidentiality obligations at least as protective as this Policy.

TPP uses cookies and similar technologies that are strictly necessary to sign in, maintain a session, remember a selected firm or role, and protect against cross-site request forgery.

TPP does not currently use third-party advertising or cross-site tracking cookies.

Where TPP later introduces optional analytics or preference cookies, this Policy will be updated to describe them and, where required by law, a consent mechanism will be provided before they are set.

TPP retains Customer Data and Client Data for as long as a firm's account is active, and, following termination, for a reasonable period consistent with Terms §35 (Data Retention, Backups, and Export) and applicable law, after which it may be deleted.

TPP may retain limited information beyond that period where reasonably necessary for legal compliance, security, fraud prevention, dispute resolution, accounting, or legitimate recordkeeping purposes.

A firm remains responsible for its own recordkeeping obligations, including any applicable tax-preparer retention requirements; TPP's retention practices are not a substitute for a firm's own compliance program.

TPP maintains administrative, technical, and physical safeguards designed to protect the information described in this Policy, consistent with Terms §25 (Information Security) — including, as applicable, encryption in transit, encryption at rest for cloud-stored documents, access controls, multi-factor authentication, role-based authorization, tenant isolation, and audit logging.

TPP's Security Center (see the Security page) describes the actual current status of specific security capabilities, including which are implemented today versus in development, so a firm can evaluate TPP's controls against its own obligations rather than relying on this Policy's general description alone.

No method of transmission or storage is completely secure, and TPP cannot guarantee absolute security. A firm should use appropriate internal security practices, including prompt removal of departing users' access and prompt reporting of suspected unauthorized access.

Depending on your location and the applicable law, you may have rights to request access to, correction of, or deletion of your personal information, or to receive a copy of it in a portable format.

For an Authorized User: many of these can be exercised directly in the Service (for example, updating your own profile). Where the Service does not yet offer a self-service option for a particular request, contact us at the address in Section 12 and we will respond consistent with applicable law and any firm-level authorization requirements.

For a Client Portal User: because a firm — not TPP — controls the Client Data submitted about you, TPP will generally direct a data-subject request to the firm that submitted it, unless applicable law requires TPP to respond directly.

A firm terminating its account can export available Customer Data and Client Data during the periods described in Terms §35, before that information is eventually deleted.

This section supplements the rest of this Policy for California residents, consistent with the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA").

TPP does not sell personal information and does not share personal information for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA.

Subject to applicable exceptions, California residents may have the right to know/access, delete, correct, and limit the use of certain sensitive personal information TPP holds about them, and the right not to receive discriminatory treatment for exercising these rights.

Where TPP processes personal information on behalf of a Customer firm as a service provider or contractor under the CCPA/CPRA, TPP processes that information only for the limited and specified business purposes described in the Terms, this Policy, and the firm's documented instructions, and does not retain, use, or disclose it outside those purposes.

A California resident may submit a request using the contact information in Section 12. TPP will verify the request consistent with applicable law before acting on it.

Some Client Data submitted through the Service is Tax Return Information, as defined in the Terms, subject to Internal Revenue Code Section 7216 and related Treasury regulations governing a tax-return preparer's use or disclosure of taxpayer information.

TPP processes Tax Return Information solely to provide the Service to the firm that submitted it — for example, storing, displaying, and routing that information within the firm's own tenant — and not for TPP's own independent use, consistent with Section 1's description of TPP's role for Client Data.

A firm remains responsible for obtaining any taxpayer consents required under Section 7216 or applicable state law before using a service such as TPP to handle Tax Return Information.

The Service is intended for use by tax professionals, accounting firms, and their adult clients. Consistent with Terms §1's eligibility requirement, the Service is not directed to, and TPP does not knowingly collect personal information from, individuals under 18 years of age.

If we learn that we have collected personal information from someone under 18 without appropriate authorization, we will take steps to delete that information.

TPP is a U.S. company, and the infrastructure and service providers described in Section 5 currently operate in the United States. Information collected through the Service is processed and stored in the United States.

If TPP's infrastructure footprint changes to include processing outside the United States, this Policy will be updated to describe the applicable safeguards.

TPP may update this Policy from time to time. The "Last Updated" date at the top of this page reflects the most recent revision.

For a material change to how TPP handles Client Data or Customer Data, TPP will provide notice consistent with Terms §44 (Changes to Terms) before the change takes effect.

Continued use of the Service after a revised Policy takes effect constitutes acceptance of the revised Policy, to the same extent described in the Terms for changes to the Terms themselves.

Questions about this Privacy Policy, or requests relating to personal information described in Section 9 or Section 10, can be directed to Escochecks Inc. at legal@taxpracticeportal.com.

Mail: 2190 Burbank Blvd., Suite 300, Woodland Hills, CA 91367.