Privacy policy

We determine the purposes of processing for our website, marketing, account administration, billing, security and legal compliance. For that information we act as the responsible business or controller, as applicable. When we process records solely on a business customer's documented instructions, we act as its service provider or processor, subject to the engagement and applicable data processing terms. A licensed professional may have independent recordkeeping and legal duties.

This policy covers Institution-controlled services. A connected bank, accounting provider, payment processor or external professional may also have its own policy. An employer or client that administers a workspace determines who can access its business records and may have its own employee or customer privacy notice. This policy does not give us permission to disregard those arrangements or applicable law.

Depending on your interactions and ordered services, we receive contact and account information such as name, business email, phone number, company name, role, login identifiers, account settings and team invitations. Sales and support inquiries may include messages, meeting details, attachments and service requirements.

Service records can include transaction histories, balances, invoices, bills, bookkeeping entries, receipts, financial reports, payroll and contractor records, tax returns, government notices, formation documents, ownership information and authorized identity information. Some records contain sensitive personal information, including tax identifiers, financial account details or identity documents. Submit these only through an approved secure channel when necessary for a service.

Billing information includes orders, plan and invoice details, payment status and transaction references. Payment providers handle the payment details entered into their payment forms. Do not send full card details, online banking passwords, recovery codes or private keys to support or legal email.

With your authorization, we receive information from QuickBooks Online and other supported accounting, banking, payroll or business systems within the permissions you grant. An authorized administrator, employee, accountant or professional may provide information for your workspace. We may receive payment confirmations and fulfillment details from checkout providers, and public business or filing information from public registries and reference-data providers.

Connection permissions determine what a provider supplies. Revoking a connection limits future access supported by that provider; it does not automatically delete information already received, cancel an engagement or change the provider's own retention practices. We use connected data for the authorized service and do not treat a connection as consent for unrelated advertising.

Operating the website and protecting the service involves technical information such as IP address, browser and device type, approximate location inferred from IP, requested page, time, referral URL, errors and security logs. Cookies and similar storage may support a session, remember preferences and protect forms.

Optional measurement and advertising tools can receive page views, browser identifiers, referral and campaign details and interaction events. Product analytics or session replay can receive activity such as clicks, navigation and rendered page content, depending on configuration. We do not authorize those tools to collect passwords, tax identifiers, financial documents or confidential client-record contents. See the Cookie policy for the tools configured for the public site and available controls.

A privacy or cookie notice is not a substitute for consent where consent is required. Our public-site privacy controls let you choose optional analytics and marketing. A supported Global Privacy Control signal disables optional marketing for that browser.

We use information to create and administer accounts; deliver purchased services; synchronize authorized records; prepare reports and draft work; coordinate professionals and government submissions you authorize; process orders and payments; communicate about requests and deadlines; answer support inquiries; maintain and secure systems; investigate misuse and errors; and meet applicable legal obligations.

We also use permitted website measurement to understand navigation and improve content and reliability. Marketing communications and advertising are subject to applicable consent and opt-out rules. We do not use confidential client financial records to build advertising audiences. Information is not used for a materially incompatible new purpose without an appropriate legal basis and any notice or consent required by law.

Max AI is optional across Institution services. If you use it, your prompt and the relevant records, documents or conversation context needed to answer it may be processed by the AI service and the providers supporting that request. Avoid entering unnecessary personal or sensitive information. Authorized team members may have access to conversations according to workspace permissions.

We never use client data, including business records, uploaded documents or Max AI conversations, to train our own or third-party AI models. Processing an authorized request to produce an answer is not model training. Opting out of Max AI does not by itself delete existing records or stop the processing needed to provide a separately requested service. Contact us or use an available setting if you want assistance opting out.

AI output may contain inferred or inaccurate information. Ask us to correct personal information where appropriate. We do not use Max AI output alone to make decisions producing legal or similarly significant effects about you without the safeguards required by applicable law.

We disclose information to authorized workspace users; personnel who need it for the engagement; hosting, database, storage, authentication, email, payment, support and security providers; and accounting or professional providers needed for the service. Their access must be limited to the relevant purpose and subject to appropriate contractual, professional or legal restrictions.

An authorized tax, formation or compliance service may require disclosure to a licensed professional, registered agent, state registry, tax authority or other government recipient. Some filings become public records. The service scope and your approvals determine what we submit. General acceptance of this policy does not supply a specific taxpayer consent required by tax confidentiality law.

We may disclose information to comply with a valid legal demand, investigate fraud or security incidents, protect legal rights or respond to an emergency as permitted by law. Where permitted, we will assess demands and limit disclosure to what is required. Information may be transferred in a genuine business transaction, subject to continued privacy protections and legally required notices.

Optional website vendors may independently process browsing identifiers and events when enabled. Such advertising disclosures may qualify as ‘sharing,’ ‘sale’ or targeted advertising under some privacy laws even when no money is paid. Confidential client financial records are not sold. The Cookie policy and privacy controls address optional website tracking separately.

We use sensitive financial, identification and tax information only as necessary for an authorized service, security, fraud prevention, legal compliance or another purpose specifically permitted by law. We do not use that information to infer unrelated personal characteristics for advertising. Do not upload information about health, biometrics or other highly sensitive matters unless it is necessary for the agreed service and we have approved a suitable channel.

Tax return information may be subject to special federal and state confidentiality rules. When a separate disclosure or use consent is legally required, it must be obtained in the required form. This Privacy policy and the Terms do not replace it. A general authorization to collaborate does not waive restrictions on tax return information.

Where a law requires a legal basis, we process information as necessary to perform a contract with you or take requested steps before a contract; comply with legal obligations; pursue legitimate interests in security, service administration, support and appropriate business communications where those interests are not overridden by your rights; or act on your consent for optional processing. A client instructing us as processor is responsible for its own lawful basis and notices.

Where consent is the basis, you may withdraw it at any time for future processing without affecting earlier lawful processing. Refusing optional tracking or marketing does not prevent ordinary website access. If information is necessary for an ordered filing or regulated service, failure to provide it may prevent that particular service.

We retain information for the period reasonably necessary for its purpose, the engagement, applicable legal or professional recordkeeping requirements, security, dispute resolution and enforcement of agreements. Retention depends on the record category, the filing or tax period, an active engagement, legal holds and the sensitivity of the information. A single fixed retention period would not accurately describe every record type.

Account and service records may need to remain after cancellation to meet tax, accounting, anti-fraud or legal obligations. Technical and support records are retained according to operational need. We delete or de-identify information when it is no longer needed, subject to lawful retention. Backup copies may persist through normal backup cycles and remain protected; they are not restored for unrelated ordinary use. Ask us for the retention criteria applicable to a particular record or engagement.

Disconnecting QuickBooks, canceling a paid service, closing an account and requesting deletion are different actions. Tell us which you intend. Before closing an account, export records you need and arrange required recordkeeping. We will explain a lawful reason when we cannot fulfill a deletion request in full.

We use reasonable administrative, technical and organizational measures appropriate to the information and service. Access restrictions, approved channels and review responsibilities are described on the Security page. No network or storage system is completely secure. We do not promise an unverified certification or an absolute security outcome.

Notify us promptly of suspected unauthorized access. We will assess incidents, take appropriate containment and remediation steps, and provide notices required by law or an applicable agreement. An initial email should describe the issue without including tax identifiers, passwords, tokens or full client records. We can arrange an appropriate channel for necessary evidence.

Institution is operated by a US company and serves business users, including international founders. Information may be processed in the United States and other countries where authorized personnel or service providers operate. Those countries may have different data protection laws.

Where a restricted international transfer requires safeguards, we will use a legally available mechanism, such as applicable standard contractual clauses and supplementary measures, or another valid basis. We do not claim that all providers participate in a particular certification framework. Contact our legal email for information about safeguards relevant to your data. Use of the service alone does not replace a transfer mechanism or explicit consent where one is legally required.

Depending on where you live, the law's applicability and our role, you may have rights to confirm processing; obtain access and a portable copy; correct inaccurate information; request deletion; restrict processing; object to processing based on legitimate interests; withdraw consent; and opt out of sale, sharing, targeted advertising or certain profiling. Applicable rights to limit sensitive-information use remain available. We will not unlawfully discriminate against you for exercising a right.

Send a request to institution.legal@premiergm.com or our postal address below. Describe the right and the relevant account or relationship. Do not send an identity document with your initial email. We may request proportionate verification through an appropriate channel and may verify an authorized agent's authority. Opting out of optional website marketing through our controls does not require account creation or identity-document upload.

We respond within applicable legal deadlines and explain an extension, denial or partial response where required. Some laws allow 45 days for an initial response with a permitted extension; EEA and UK requests ordinarily have a one-month deadline, subject to lawful extensions. Those examples do not reduce a shorter deadline that applies to your request. Requests are generally free, except where a law permits a reasonable charge for a manifestly unfounded or excessive request.

If we act on a customer's instructions, we may direct you to that customer and assist it with the request. Where an appeal right applies, reply to our decision with ‘Privacy appeal’ and the reason you disagree. We will review and explain the result and available complaint route within the period required by law. You may complain to your local data protection authority, attorney general or other competent regulator without first exhausting our process.

For US state laws that apply to us and your information, the categories described above include identifiers; customer and commercial records; internet and device activity; approximate location; professional and employment information; and sensitive financial, tax or identity information necessary for ordered services. Sources, purposes, recipient categories and retention criteria are set out in the preceding sections. We do not knowingly sell or share personal information of people under 16 for advertising.

Optional advertising may disclose identifiers, browser activity, approximate location and campaign information to advertising providers for measurement and targeting. Reject marketing in our privacy controls or use a supported Global Privacy Control signal to stop that optional processing in the browser. Clearing storage or changing browsers may require choosing again. An email request can address information linked to your account and questions about other applicable opt-outs.

For people covered by EEA, UK or Swiss law, the legal bases and international transfer information above apply where those laws govern our processing. You may object to direct marketing at any time and raise concerns with the relevant supervisory authority. We do not require you to waive local mandatory rights or transfer all privacy disputes to Delaware as a condition of making a request.

You can unsubscribe from promotional email using its unsubscribe mechanism or by contacting us. Account, billing, security and other necessary service messages may still be sent. You can manage connected-provider permissions through the dashboard and the provider's controls. Account administrators should remove access when an authorized user leaves.

Institution is intended for adults using business services and is not directed to children under 18. We do not knowingly create child accounts. If you believe a child has supplied personal information directly without appropriate authority, contact us so we can investigate and take appropriate action. Business records may include dependent information needed for a lawful tax engagement; those records require the same necessity and confidentiality safeguards as other sensitive tax information.

We update this policy when practices or legal requirements change and identify the effective date above. We provide additional notice of material changes when required and obtain consent before a new use where legally necessary. Posting a revised policy does not retroactively authorize an incompatible use of information already collected.

The responsible company is Premier Global Management, LLC, owner and operator of Institution. Contact institution.legal@premiergm.com or write to 16192 Coastal Highway, Lewes, DE 19958, United States, identifying the request as an Institution privacy matter.