Who this policy is for
FirmBoard is practice-management software for small accounting, bookkeeping, and tax firms in Canada. This policy explains what information we collect when you visit the marketing site, create an account, or store client work on the board. It is written for the person who runs the practice and for the staff who sign in. It is also written so a client of that practice can understand, in plain language, that their accountant remains responsible for the file they keep.
We collect only what we need to run the product, to bill the subscription, to answer a message you send us, and to keep the service reliable. We do not sell personal information. We do not use the contents of a client file to advertise to that client. If a sentence in this policy is unclear, write to info@firmboard.app and we will answer in ordinary language before we hide behind a defined term.
Information you give us directly
When you ask for a demo or use the contact form, we receive the name, email, phone number, and message you type. When you join the newsletter, we receive the work email you submit. When you create a firm account, we receive the business name, the address you want on documents, the email of the person who administers the account, and the login each staff member uses. Payment details for a paid plan are handled by our payment provider. We store the fact of the subscription, the plan, and the invoices we issue to your firm. We do not need your clients banking passwords, and the product is not built to collect them.
If you upload a logo, a service catalog, document terms, or bank-account labels for use on quotes and invoices, we store those so the documents you send look like your firm. Those records belong to the account. They are not used to build a public directory of practices.
Client records you choose to store
The purpose of FirmBoard is to hold the operational record of a client engagement: the client, the service card, the quote, the invoice, and the payment receipt. That record can include names, emails, descriptions of work, fees, and notes your staff type. You decide what goes on a card. We process that information so your firm can open it, filter it, and produce the document. We do not read client files in order to sell anything to those clients. Access by our staff is limited to support you request, to investigating abuse, or to keeping the service secure.
Your firm is the organization that decides why a client record exists and what should be in it. FirmBoard is the service that stores and displays it on your instructions. That is why a client who wants a copy of their own return, or who wants a record corrected, should start with the practice. We will help the practice export or delete what the product allows us to reach. We will not quietly edit a client file because someone outside the firm asked us to.
Information collected while you use the site
Like most websites, our servers record a limited technical log: the address of the page, the time, a coarse location derived from the network address, the browser type, and a cookie that keeps you signed in. The marketing site may also record whether a page loaded and whether a form was submitted, so we can see that the site works. Details of cookies are in the cookie policy. The application itself records actions that the product needs in order to be useful, such as who created a quote and when a status changed. Those entries exist so a practice can trust the board, not so we can profile the private lives of clients.
How we use information
We use account information to provide the service you subscribed to, to apply the limits of your plan, to send operational email about invoices and security, and to respond when you write to us. We use contact-form messages to answer the question you asked, including a request for a live demonstration. We use newsletter addresses only to send the notes you asked for, and you can stop those notes from any message. We use technical logs to detect misuse, to fix errors, and to understand which parts of the marketing site are failing.
We do not use client-file contents to train a public model, and we do not allow a third party to mine those files for their own products. If that position ever changes, it will change in this policy first, and it will not be buried in a settings screen.
Who we share information with
We share information with the companies that host the application, send email, and process subscription payments. They receive only what they need to perform that job, and they are not permitted to use firm or client records for their own marketing. We share information if the law requires it, or if a court or a regulator with proper authority compels it. If we receive a request that concerns a client file, we will tell the practice unless the law forbids that notice. We may also share information if we sell or reorganize the business, and the buyer will be bound by this policy for the records they receive.
We do not sell, rent, or trade personal information. A partner logo on the marketing site is not a data partnership. Being listed as a partner does not give that organization access to your clients.
Where information is kept, and for how long
FirmBoard is built for Canadian practices, and we aim to keep production records in Canada. If a particular tool we use processes a message outside Canada, such as an email delivery service, we say so when you ask, and we choose providers that contract to protect the information. Account records are kept for the life of the subscription and for a limited period afterwards so we can resolve a billing question or restore a file you deleted by mistake. Technical logs are kept for a shorter period. Contact-form messages are kept long enough to finish the conversation and to keep a record that we replied. You may ask us to delete a marketing contact earlier, and we will, unless we still need it for a legal claim.
Your choices
You may ask what account information we hold, ask for a correction, or ask us to delete a marketing contact. Staff inside a firm can correct most client records themselves, which is the faster path. If you want an export of the operational data your firm stored, contact us from the administrator email and we will explain the export the product can produce. You may close the account. Closing the account stops new use. We then delete or de-identify the records on the timetable above, except for the billing records we must keep.
We do not knowingly collect information from children. The product is a business tool for accounting practices. If you believe a child record was submitted, tell us and we will remove it.
Security and changes
We protect accounts with access controls, encrypted connections, and a rule that staff see a client file only for a reason tied to support or security. No service can promise that a break-in is impossible. If we learn of a breach that creates a real risk to your firm or to the people in your files, we will tell the administrator of the account without delay and we will tell any regulator the law requires us to tell.
We will update this policy when the product changes in a way that changes the information we hold. The date at the top of the page is the date of the current version. Continued use of the service after that date means the firm has the current policy. Questions go to info@firmboard.app, or by post to FirmBoard, 40 Wynford Drive, Toronto, ON, Canada.