Privacy Policy

Effective August 12, 2026

Firmly, operated by THETAXCO INC. (“Firmly”, “we”, “us”), provides a practice-management platform for accounting and bookkeeping firms, including a secure client portal on the web and the Firmly Client Portal app for iPhone. This policy explains what personal information we handle, why, and the choices you have. It applies to the client portal on the web and to the Firmly Client Portal app for iPhone; the firm-facing Firmly application has its own policy.

The short version

• We collect only what the service needs to work: your name, email, the documents and messages you exchange with your firm, and billing records.
• We never sell personal information, and we show no advertising.
• We do not track you across other apps or websites.
• Your data is stored in Canada and encrypted in transit and at rest.
• Card numbers never touch our servers — payments are handled by Stripe.

Your firm and Firmly

If you use the client portal or the iOS app, it is because an accounting or bookkeeping firm you work with invited you. That firm decides what information to request from you and how long to keep it; Firmly processes that information on the firm’s behalf to deliver the service. For questions about the content of your records — or to have them corrected or removed — your firm is the right first contact.

Information we collect

• Account and contact details. Your name and email address, used to sign you in and to route notifications.
• Content you exchange with your firm. Documents and photos you upload, forms you fill out, messages you send, and signatures you apply. This content is visible only to you and your firm.
• Billing records. Invoices, proposals, and payment status. Payments are processed by Stripe; Firmly never receives or stores your card number.
• Technical information. Session tokens (kept in cookies on the web and in the device keychain in the iOS app), a push-notification token if you enable notifications, sign-in timestamps, and standard server logs including IP addresses, kept for security.

We use only the cookies the service needs to keep you signed in — there are no advertising or third-party analytics cookies.

How we use information

• To operate the service: showing your firm’s requests, delivering your uploads, tracking filings, and processing invoices.
• To notify you — by email and, if you opt in, push notifications — when your firm needs something from you.
• To keep the service secure: verifying sign-ins, rate-limiting abuse, and scanning uploaded files before they can be shared.
• To provide support when you or your firm ask us for help.

We do not sell personal information, rent it, use it for advertising, or use it to track you across other companies’ apps and websites. We do not use your content to train AI models.

Where your data lives

Firmly’s database and file storage are hosted in Canada, and the application runs from Canadian infrastructure. A small number of service providers process specific data on our behalf:

When we share information

Your information is shared with your firm (that is the product), with the service providers above strictly to run the service, and with authorities only if the law requires it. That’s the whole list — there are no data partnerships, brokers, or advertisers.

Security

All traffic is encrypted in transit (TLS) and data is encrypted at rest. Each firm’s data is isolated by tenant-level access controls enforced in the database. Files are shared through short-lived signed links rather than public URLs, and uploads are scanned before they become available. Sign-in to the portal and the iOS app is passwordless: a one-time code or link sent to your email, with aggressive rate limiting.

Retention and deletion

Because your firm is responsible for its client records (which often carry legal retention requirements — tax filings, for example), we keep portal content for as long as your firm keeps it in Firmly. If you ask your firm to remove something, or the firm deletes it, it is removed from the live service. When a firm closes its Firmly account, its data is deleted from our systems. Security logs are kept only as long as needed for their purpose.

Your choices and rights

• You can turn push notifications off at any time in iOS Settings; email notifications about your firm’s requests are part of the service.
• You can sign out everywhere; signing out of the iOS app also revokes its push token.
• Subject to the laws that apply to you — including PIPEDA in Canada and state privacy laws in the United States — you can ask for access to, correction of, or deletion of your personal information. Start with your firm for the content of your records, or contact us directly and we will help, coordinating with your firm where they control the data.

The iOS app

The Firmly Client Portal app collects nothing beyond what this policy describes. It asks for camera or photo access only when you choose to attach a photo or scan a document, and that access is used solely to send the file you picked to your firm. The app contains no advertising and no third-party analytics or tracking SDKs.

Children

Firmly is a business service and is not directed to children under 13, and we do not knowingly collect information from them.

Changes to this policy

If we make material changes, we will update this page and adjust the effective date above; for significant changes we will notify firms directly.

Contact

Questions about privacy? Email hello@firmlyhq.com and we’ll get back to you promptly.