Privacy Policy

What we collect

Account information (name, email), the client, engagement, document, and billing data your firm enters, and connection tokens for integrations you explicitly enable (QuickBooks Online, Xero, SmartVault, Stripe, firm email).

Website visitor data

firmlync.com uses Google Analytics to measure site traffic (pages viewed, referring source, approximate location from IP, device type) and Leadfeeder to identify the companies visiting the site for our own sales follow-up. Both use cookies and similar tracking technology. Neither tool identifies you personally unless you submit a form (like starting a trial). This applies to firmlync.com only, not the FirmLync application itself.

How data is isolated

Every firm's data is scoped by row-level security policies enforced in the database itself — not just application code — so one firm can never query another firm's records, and a client portal login can only ever see that one client's own record, never another client's or the firm's other clients.

Subprocessors — who else touches your data

Used for every firm, by default:

• Supabase — database, authentication, file storage
• Resend — transactional email delivery
• Stripe — payment processing (invoices, subscription billing)
• Vercel — application hosting

Used only if your firm turns the feature on:

• Intuit QuickBooks Online, Xero, SmartVault — accounting/document sync
• Your firm's own SMTP provider — if connected instead of our default sender
• Nylas — connects a staff member's own email/calendar for the shared Inbox and Calendar sync features, only if your firm turns this on

Twilio (SMS follow-ups) and Anthropic (AI-drafted follow-ups and workflow import) are not live yet — see our roadmap. This section will be updated the day either ships.

We don't sell data or share it for advertising, and don't use your data to train AI models.

Data retention

Data is retained for as long as your firm's account is active. On cancellation, data remains available for 30 days for export or reactivation, after which it's deleted. You can request earlier deletion at any time by contacting us.

Your choices

You can export your client list at any time, disconnect any integration or cancel your subscription from Settings, and request full account deletion by contacting us. If your firm needs a signed Data Processing Agreement, email us before signing up.