Privacy Policy

What we collect

Account information (name, email), the client, engagement, document, and billing data your firm enters, and connection tokens for integrations you explicitly enable (QuickBooks Online, Xero, SmartVault, Stripe, firm email). SMS follow-ups and AI drafting need no connection token from you — they run through FirmLync's own Twilio and Anthropic accounts once you turn them on.

How data is isolated

Every firm's data is scoped by row-level security policies enforced in the database itself — not just application code — so one firm can never query another firm's records, and a client portal login can only ever see that one client's own record, never another client's or the firm's other clients.

Subprocessors — who else touches your data

Used for every firm, by default:

• Supabase — database, authentication, file storage
• Resend — transactional email delivery
• Stripe — payment processing (invoices, subscription billing)
• Vercel — application hosting

Used only if your firm turns the feature on:

• Intuit QuickBooks Online, Xero, SmartVault — accounting/document sync
• Twilio — SMS follow-ups, included with your plan (FirmLync's own account)
• Your firm's own SMTP provider — if connected instead of our default sender
• Anthropic — AI-drafted follow-ups and workflow import, included with your plan (FirmLync's own key)

We don't sell data or share it for advertising, and don't use your data to train AI models.

Data retention

Data is retained for as long as your firm's account is active. On cancellation, data remains available for 30 days for export or reactivation, after which it's deleted. You can request earlier deletion at any time by contacting us.

Your choices

You can export your client list at any time, disconnect any integration or cancel your subscription from Settings, and request full account deletion by contacting us. If your firm needs a signed Data Processing Agreement, email us before signing up.