Privacy Policy

EZDocPro, operated by ABCD Systems LLC ("we,""us," or"our"), provides cloud-based bookkeeping, tax categorization, payroll, and financial management services ("Services"). This Privacy Policy describes how we collect, use, store, share, and protect your personal and financial information when you use our website at ezdocpro.com and our Services.

By creating an account or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, please do not use our Services.

1 Information We Collect

1.1 Information You Provide

We collect information that you voluntarily provide to us when you register, use our Services, or contact us:

Category	Data Collected	Purpose
Account Information	Name, email address, company/firm name, phone number, password (stored as bcrypt hash only)	Account creation, authentication, communication
Billing Information	Payment method details (processed by Square — we never store full card numbers)	Subscription billing, payment processing
Client Data	Client names, business names, contact information you input into our system	Client management, document organization
Financial Documents	Uploaded bank statements, tax documents, receipts, invoices (PDFs)	Transaction extraction, categorization, tax preparation
Transaction Data	Dates, descriptions, amounts, categories, account identifiers (last 4 digits only)	Bookkeeping, reporting, Schedule C preparation
Bank Connection Data	Institution name, account type, last 4 digits (via Plaid)	Automated bank feeds, reconciliation
Payroll Data	Employee names, compensation, tax withholdings, state of employment	Payroll processing, tax compliance
Tax Identifiers	Last 4 digits of SSN or EIN only — we never store full tax identification numbers	Customer identification, tax document preparation
Communications	Any information you provide when contacting our support team	Customer support, service improvement

1.2 Information Collected Automatically

When you access our Services, we automatically collect certain information:

• Device Information: IP address, browser type, operating system, device identifiers, and mobile network information.
• Usage Data: Pages visited, features used, time spent on pages, click patterns, and referring URLs.
• Log Data: Server logs recording access times, actions taken, and error reports for security and troubleshooting.

2 How We Use Your Information

We use the information we collect for the following purposes:

• Provide Services: Process your documents, extract transaction data, categorize expenses, generate reports, and prepare tax documents (such as Schedule C).
• Account Management: Create and manage your account, process payments, and manage your subscription.
• Payroll Processing: Calculate wages, tax withholdings, and generate payroll records for your employees.
• Communications: Send service-related notifications, security alerts, billing receipts, and support messages.
• Security: Authenticate your identity, detect and prevent fraud, abuse, and unauthorized access.
• Service Improvement: Analyze usage patterns and improve our AI extraction and categorization accuracy using anonymized, aggregated data only.
• Legal Compliance: Comply with applicable laws, regulations, and tax reporting requirements.
• Marketing: With your consent, send promotional communications about our services. You can opt out at any time.

3 Financial Data & Bank Connections (Plaid)

When you choose to connect a bank account through our Services, we use Plaid Inc. ("Plaid") to establish a secure connection between your financial institution and EZDocPro. By connecting your bank account, you authorize Plaid to access your financial data on your behalf.

3.1 How Plaid Works with EZDocPro

• Plaid Link tokens are generated server-side and used for a single session only.
• Plaid access tokens are encrypted (AES-256) before storage in our database and are never exposed to the browser or client-side code.
• We retrieve transaction data (dates, amounts, merchant names, categories) and account metadata (institution name, account type, last 4 digits).
• We do not receive or store your bank login credentials — those are handled entirely by Plaid.
• Only users with Owner or CPA roles in your organization can initiate or manage bank connections.

Plaid's handling of your data is governed by Plaid's End User Privacy Policy. We encourage you to review it.

You may disconnect your bank account at any time from your EZDocPro dashboard. Upon disconnection, we revoke the Plaid access token and cease retrieving new data. Previously retrieved transaction data remains in your account unless you request deletion.

4 AI-Powered Data Processing

EZDocPro uses artificial intelligence to extract transaction data from uploaded bank statements and to automatically categorize transactions for tax compliance purposes.

4.1 Document Extraction

When you upload a bank statement PDF, the document text is sent to Google's Gemini AI API for structured data extraction. The API processes the text and returns structured transaction data. Google does not retain your data after processing under their API terms of service.

4.2 Auto-Categorization

Transactions are first categorized using our rules engine (pattern matching against known merchants and transaction types). Only uncategorized transactions may be sent to the AI API for classification suggestions.

4.3 No Training on Your Data

Your financial data is not used to train AI models. It is processed for extraction and categorization only, then the AI provider discards it per their API data processing agreements.

4.4 Human Review

All AI-generated categorizations are presented as suggestions. You or your bookkeeper/CPA retain full control to accept, modify, or reject any categorization before it is finalized.

5 How We Protect Your Data

We implement appropriate technical and organizational security measures to protect your personal and financial information:

Security Layer	Implementation
Encryption in Transit	All data encrypted using TLS 1.2 or higher. HTTPS enforced on all pages via server configuration.
Encryption at Rest	Sensitive data (Plaid tokens, API keys) encrypted using AES-256 before database storage.
Password Security	Passwords hashed using bcrypt (PHP PASSWORD_DEFAULT). Cannot be reversed or retrieved. We never store plaintext passwords.
Session Management	64-character cryptographically random session tokens with automatic expiration (30 days). Sessions regenerated on login to prevent fixation attacks.
Access Control	Role-based access with 10 permission levels and 60+ granular permissions. Every data request verifies ownership before returning results.
Bot & Brute Force Protection	Multi-layer protection: honeypot fields, timing analysis, behavioral scoring, and IP-based rate limiting on all login and registration forms.
Input Validation	All queries use parameterized prepared statements (PDO). All displayed content escaped to prevent cross-site scripting (XSS).
CSRF Protection	Cross-site request forgery tokens on all forms to prevent unauthorized actions.
Audit Trail	All logins, data modifications, permission changes, and administrative actions logged with timestamps and IP addresses.
Payment Security	Payment processing handled by Square (PCI DSS compliant). Credit card data transmitted directly to Square and never touches our servers.
File Upload Protection	Upload directories block PHP execution. Files validated by MIME type, extension, and size. Only PDF and ZIP formats accepted.

6 Data Sharing & Third Parties

We do not sell your personal information. We may share your information only in the following limited circumstances:

6.1 Service Providers

Third Party	Data Shared	Purpose
Square, Inc.	Billing information	Payment processing, subscription management
Plaid, Inc.	Bank connection authorization	Secure bank account linking, transaction retrieval
Google (Gemini AI)	Document text for extraction	AI-powered transaction extraction and categorization
Brevo (Sendinblue)	Email address, name	Transactional emails (password resets, invoices, notifications)

These providers are contractually obligated to protect your information and use it only for the specific services they provide to us.

6.2 Legal Requirements

We may disclose your information if required by law, subpoena, court order, or government request, or if we believe disclosure is necessary to protect our rights, prevent fraud, or ensure the safety of our users.

6.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website of any change in ownership or uses of your personal information, as well as any choices you may have regarding your personal information.

6.4 With Your Consent

We may share information for other purposes with your explicit consent.

We do not:

• Sell your personal information to any third party
• Share your financial data with advertisers
• Allow third-party tracking or advertising on our platform
• Use your data for purposes unrelated to providing our Services

7 Data Retention & Deletion

We retain your data only as long as necessary to provide our Services and comply with legal obligations:

Data Type	Retention Period	Deletion Method
Uploaded PDF bank statements	7 days (configurable by admin)	Automated purge via daily scheduled task
Session tokens	30 days from last activity	Automatic expiration
Password reset tokens	1 hour	Automatic expiration
Transaction & financial data	Duration of account + 7 years	Deleted upon account closure request (after retention period)
Payroll records	Duration of account + 7 years	Retained per IRS record-keeping requirements
Payment records	7 years	Required by tax and accounting regulations
Audit logs	7 years	Automated purge after retention period
Usage logs	90 days	Automated purge for security/troubleshooting
Account information	Duration of account + 2 years	Deleted within 30 days of request (after retention period)

The 7-year retention period for financial records aligns with IRS record-keeping requirements for tax-related documents. You may request early deletion of non-tax-critical data at any time by contacting us.

8 Your Rights & Choices

Depending on your location, you have the following rights regarding your personal information:

• Access: View all personal information we hold about you through your account settings, or request a copy by contacting us.
• Correction: Update your account information (name, email, company) directly through your settings page, or request correction of other data.
• Deletion: Request deletion of your account and associated data. We will process requests within 30 days, subject to legal retention requirements.
• Data Portability: Export your transaction data, reports, and categorizations in CSV format at any time from within the application, or request a portable copy of your data.
• Disconnect Bank Accounts: Disconnect any linked bank account at any time, immediately revoking the Plaid access token.
• Revoke Client Access: If you have shared data through our portal system, revoke access at any time.
• Opt Out of Marketing: Unsubscribe from promotional communications at any time. Transactional emails (security alerts, billing receipts) cannot be opted out of while your account is active.
• Withdraw Consent: Withdraw consent for processing where consent is the legal basis.

To exercise any of these rights, contact us at support@ezdocpro.com or use the controls available within your account dashboard.

9 Cookies & Tracking Technologies

EZDocPro uses a minimal set of cookies strictly necessary to operate the service:

Cookie	Type	Purpose	Duration
Session cookie	Essential	Maintains your authenticated login session	30 days
CSRF token	Essential	Prevents cross-site request forgery attacks	Session

We do not use: third-party analytics cookies, advertising cookies, social media tracking pixels, or any form of cross-site tracking. There are no Google Analytics, Facebook Pixel, or similar services on our platform. You can control cookies through your browser settings; however, disabling essential cookies may prevent the Services from functioning properly.

10 California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with specific rights regarding your personal information.

Your rights under CCPA/CPRA include:

• Right to Know: Request the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete: Request that we delete personal information we have collected, subject to legal exceptions (such as IRS record-keeping requirements).
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising. There is nothing to opt out of.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

Categories of personal information collected in the past 12 months:

CCPA Category	Collected	Sold	Shared for Advertising
Identifiers (name, email)	Yes	No	No
Financial information	Yes	No	No
Commercial information	Yes	No	No
Internet activity	Yes (login logs)	No	No
Professional information	Yes (company/firm)	No	No
Sensitive personal info	SSN/EIN last 4 only	No	No

To submit a CCPA/CPRA request, email support@ezdocpro.com with the subject line"CCPA Request." We will verify your identity and respond within 45 days as required by law.

11 Third-Party Links

Our Services may contain links to third-party websites or services that are not operated by us. If you click a third-party link, you will be directed to that third party's site. We are not responsible for the privacy practices or the content of these third-party websites or services.

We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

12 International Data Transfers

Our Services are hosted in the United States on servers managed by GoDaddy. If you access our Services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country of residence.

By using our Services, you consent to the transfer of your information to the United States and acknowledge that your data will be subject to United States laws. We take appropriate measures to ensure that your personal information remains protected in accordance with this Privacy Policy.

13 Children's Privacy

EZDocPro is a business financial management service and is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will promptly delete that information. If you believe a child has provided us with personal information, please contact us immediately.

14 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the"Last Updated" date at the top of this page
• Notify you by email if the changes materially affect how we handle your data
• Post a prominent notice on our website
• Provide a 30-day notice period before material changes take effect

Your continued use of the Services after any changes constitutes your acceptance of the updated Privacy Policy.

Lead Center Data

If you enable the optional Lead Center feature, we process publicly available business information (company names, addresses, websites, phone numbers from public directories and registries) to identify potential prospects. We do not purchase private personal data or scrape private social media accounts. Lead data is stored within your account, encrypted at rest, and permanently deleted within 30 days of disabling Lead Center or closing your account. Lead data is never sold to or shared with third parties.

CPA / Bookkeeper Seat Data

When you create a CPA or bookkeeper seat, we collect their name and email address for authentication purposes. CPA seat holders access your accounting data according to the permissions you configure. All CPA seat activity is logged in the audit trail with clear attribution ("CPA" vs"Owner" entries). CPA seat credentials are hashed using bcrypt and are not accessible to EZDocPro staff.

Timeclock & Employee Data

Timeclock records include clock-in/clock-out timestamps and, if enabled by the employer, GPS coordinates at the time of clocking in or out. This data is used solely for payroll calculation and is accessible only to the account owner and authorized CPA seat holders. GPS data is not shared with any third party. Employees may view their own timeclock records through the employee portal.

Third-Party Integration Data Sharing

When you connect optional third-party services, specific data is shared as follows:

• Track1099 (Avalara): Vendor names, tax IDs, and payment amounts are transmitted to Track1099 for IRS e-filing. This data is governed by Track1099/Avalara’s privacy policy.
• TaxJar (Stripe): Transaction amounts, jurisdictions, and tax calculations are transmitted for automated sales tax filing. This data is governed by TaxJar’s privacy policy.
• Plaid: Bank account credentials and transaction data are transmitted through Plaid’s secure API for bank synchronization. See our existing Plaid disclosure above.
• Square / Stripe: Payment card data is processed directly by Square or Stripe and never touches EZDocPro servers. See our existing payment processor disclosure above.

No third-party integration is enabled by default. You must explicitly connect each service. You may disconnect any integration at any time from Settings.

Data Import & Export

When you import data (QuickBooks IIF, Sage CSV, or generic CSV files), uploaded files are processed in memory and not stored on disk after parsing. Extracted data is stored in your encrypted database. When you export data, files are generated on-demand and transmitted over HTTPS. Export files are not cached or stored on the server after download.

15 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will respond to all privacy-related inquiries within 10 business days.