Privacy Policy

PracticeWings LLC (“PracticeWings,” “we,” “us,” or “our”) operates the PracticeWings practice management platform (the “Service”). This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our Service, visit our website at www.practicewings.com, or interact with us in any way.

By using the Service, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree with the practices described here, please do not use the Service.

1. Information We Collect

1.1 Account Information

When you register for PracticeWings, we collect:

• Name, email address, and phone number
• Firm or organization name and address
• Job title and role within your organization
• Login credentials (passwords are stored using one-way hashing and are never stored in plain text)
• Multi-factor authentication enrollment data

1.2 Client Data You Store in the Service

As a practice management platform for accounting and tax firms, you may store sensitive client information within the Service, including:

• Client names, contact information, and identification numbers
• Financial records, tax documents, and engagement information
• Documents uploaded to the document management system
• Communications and notes related to client engagements
• Time entries, invoices, and billing records

Important: You are the data controller for client data stored in the Service. PracticeWings processes this data solely on your behalf and according to your instructions. We do not access, use, sell, or share your client data for any purpose other than providing and maintaining the Service, unless required by law.

1.3 Usage and Analytics Data

We automatically collect certain information when you use the Service:

• Pages viewed, features used, and actions taken within the Service
• Browser type, operating system, and device information
• IP address and general geographic location (city/region level)
• Date, time, and duration of sessions
• Referring URL and search terms used to find our website
• Error logs and performance data to maintain service quality

1.4 Payment Information

When you subscribe to a paid plan, payment information (credit card numbers, bank account details) is collected and processed directly by our payment processor, Stripe. PracticeWings does not store full credit card numbers or bank account details on our servers. We receive and store only:

• Last four digits of the payment method
• Payment method type and expiration date
• Billing address
• Transaction history and invoice records

1.5 Communications

We collect information when you communicate with us, including:

• Support requests and correspondence
• Beta feedback and feature requests
• Survey responses

2. How We Use Your Information

We use the information we collect for the following purposes:

3. How We Share Your Information

We do not sell your personal information or your clients’ data. We share information only in the following circumstances:

3.1 Service Providers

We use third-party service providers to operate the Service. These providers access data only as needed to perform their services and are contractually obligated to protect it:

3.2 Legal Requirements

We may disclose your information if required to do so by law, court order, or governmental regulation, or if we believe in good faith that disclosure is necessary to:

• Comply with a legal obligation
• Protect and defend our rights or property
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of users of the Service or the public

3.3 Business Transfers

If PracticeWings is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information is transferred and becomes subject to a different privacy policy.

3.4 With Your Consent

We may share your information for any other purpose with your explicit consent.

4. Data Retention

We retain your information for as long as your account is active or as needed to provide you the Service. Specifically:

• Active accounts: All data is retained for the duration of your subscription.
• Cancelled accounts: We retain your data for 30 days after account cancellation to allow for reactivation. After 30 days, account data is scheduled for deletion.
• Client data: Upon account cancellation, you may export all client data before the 30-day retention period expires. We provide full data export and portability tools.
• Billing records: Transaction and billing records may be retained for up to 7 years to comply with tax and accounting obligations.
• Audit logs: System audit logs may be retained for up to 3 years for security and compliance purposes.
• Aggregated analytics: De-identified, aggregated analytics data may be retained indefinitely as it cannot be linked to any individual.

5. Your Rights

Depending on your location and applicable law, you may have the following rights regarding your personal information:

• Access: You may request a copy of the personal information we hold about you.
• Correction: You may request that we correct inaccurate or incomplete personal information.
• Deletion: You may request that we delete your personal information, subject to certain exceptions (such as legal retention requirements).
• Export / Portability: You may request your data in a structured, commonly used, machine-readable format. PracticeWings provides built-in data export tools for this purpose.
• Opt-out of marketing: You may opt out of marketing communications at any time by clicking the “unsubscribe” link in any marketing email or contacting us.
• Restrict processing: You may request that we limit how we use your personal information in certain circumstances.

To exercise any of these rights, contact us at [email protected]. We will respond to your request within 30 days (or sooner if required by applicable law).

6. California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

• Right to Know: You may request the categories and specific pieces of personal information we have collected about you, the sources of that information, our business purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
• No Sale of Personal Information: PracticeWings does not sell personal information as defined by the CCPA. We do not and will not sell your personal information to third parties.

To submit a CCPA request, email [email protected] with the subject line “CCPA Request.” We will verify your identity before processing your request.

7. International Users (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) provides additional protections:

• We process your data based on the legal bases described in Section 2 (contract performance, legitimate interest, consent, or legal obligation).
• Your data is stored on servers located in the United States. By using the Service, you consent to the transfer of your data to the United States.
• You have the right to lodge a complaint with your local data protection authority.
• You may request restriction of processing, object to processing based on legitimate interest, and withdraw consent at any time.

For GDPR-related inquiries, contact [email protected].

8. Cookies and Tracking Technologies

8.1 Cookies We Use

8.2 Managing Cookies

Most web browsers allow you to control cookies through their settings. You can typically set your browser to refuse cookies, delete cookies, or alert you when a cookie is being set. Note that disabling essential cookies may prevent you from using the Service.

8.3 Do Not Track

PracticeWings does not currently respond to “Do Not Track” browser signals. We will update this policy if we adopt a Do Not Track standard in the future.

9. Data Security

We take the security of your data seriously and implement multiple layers of protection:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS/SSL.
• Encryption at rest: Data stored on our servers and in our databases is encrypted at rest.
• Access controls: Role-based access controls limit who can access data within both our organization and the Service.
• Organization isolation: Each organization’s data is logically isolated at the application level. No organization can access another organization’s data.
• Audit trails: Comprehensive logging of data access and changes.
• Infrastructure security: US-based cloud hosting with enterprise-grade providers, web application firewalls, DDoS protection, and automated daily backups.
• Authentication security: Token-based authentication with automatic rotation, multi-factor authentication support, and bot verification on login.

While we implement commercially reasonable security measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to protecting your data using industry best practices.

10. Children’s Privacy

PracticeWings is not intended for use by anyone under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us at [email protected].

11. Third-Party Links

The Service may contain links to third-party websites or services that are not operated by PracticeWings. This Privacy Policy does not apply to third-party sites. We encourage you to review the privacy policies of any third-party sites you visit.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the “Last Updated” date at the top of this page
• Notify you by email (for material changes affecting your rights)
• Post a notice within the Service

Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this page periodically.

13. Contact Us

If you have questions about this Privacy Policy, your data, or your rights, please contact us:

• Email: [email protected]
• Web: www.practicewings.com/contact
• Mail: PracticeWings LLC, Tucson, Arizona, United States