Privacy Policy
How Faspro, LLC collects, uses, shares, and retains information — including the bank data you connect through Plaid.
Effective October 8, 2026. Applies to faspro.ai and the Faspro application.
Who we are
Faspro, LLC (“Faspro”, “we”, “us”) provides bookkeeping, sales-tax, payroll, and tax-filing software to small businesses, delivered together with independent CPA partner firms. This policy covers the faspro.ai website and the Faspro application.
Faspro is the controller of the information described here. Our CPA partner firms access client information as our service providers, under contract with us and bound by this policy and by their own professional confidentiality obligations.
Whose information this covers
Most of our customers are businesses. But delivering the service means we process information about individuals — business owners and managers who use the product, and employees of our business customers whose payroll we run. This policy applies to all of them. If you are an employee of a Faspro customer, your employer decides what we process on their behalf; we handle it under this policy and under our agreement with them.
What we collect, and why
| Category | Examples | Why we need it |
|---|---|---|
| Account information | Name, work email, phone, role, password credentials | To create and secure your account and determine what you can see |
| Business and tax information | Legal entity names, EIN, addresses, ownership, filing registrations | To keep your books and prepare and file your returns |
| Payroll information | Employee names, addresses, SSN, wages, hours, withholding elections, direct-deposit bank details | To calculate pay and taxes, produce pay statements, and file payroll tax returns |
| Bank and card information | Account and routing numbers, balances, transaction history, account holder name and institution — obtained from your financial institution through Plaid, or entered by you | To reconcile your books, support payment of our fees, and verify the account belongs to you |
| Store operations data | Sales totals, department and fuel-grade summaries, shift and day-close data from your point-of-sale system | To produce your books and tax filings from actual store activity |
| Usage and device data | IP address, browser and device type, pages viewed, timestamps, error reports | To operate, secure, and troubleshoot the service |
We do not receive or store payment-card numbers, security codes, or magnetic-stripe data from your point-of-sale system. Our integration reads sales totals and transaction metadata only; cardholder data stays within your payment processor's environment and never enters Faspro.
Bank connections through Plaid
When you connect a bank or credit-card account, we use Plaid Inc. to establish and maintain that connection. You enter your banking credentials directly with Plaid — Faspro never sees or stores them. Plaid's handling of the information you give it is governed by Plaid's own privacy policy, available at plaid.com/legal.
From Plaid we receive the account and institution details, balances, and transaction history for the accounts you choose to share, and, where you use it to set up payment of our fees, the account and routing numbers needed to verify and debit that account. We request only the data types needed for the services you have subscribed to.
You can disconnect a linked account at any time from within the application. Disconnecting stops any further data from flowing to us. It does not delete records already used to produce your books and filings — see Retention below, and note that we are legally required to keep financial records we relied on.
How we use information
- To provide the service — keep your books, reconcile accounts, run payroll, and prepare and file returns
- To make your information available to the CPA partner firm assigned to your account, so they can do the professional work you engaged them for
- To bill you, collect fees by ACH debit or card, and manage past-due accounts
- To secure the service — authenticate users, detect and investigate fraud and abuse, and maintain audit records of who changed what
- To support you, respond to requests, and send service and compliance notices
- To meet our legal obligations, including tax filing, records retention, and responding to lawful requests
We do not sell your information
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use your financial data to build or train products for anyone other than you, and we do not provide it to data brokers.
Who we share it with
| Recipient | What they receive | Why |
|---|---|---|
| Your assigned CPA partner firm | Your business, financial, and payroll data | To deliver the accounting, payroll, and tax services you engaged them for. They act as our service provider and are bound by contract and by professional confidentiality rules. |
| Plaid Inc. | The identifiers needed to maintain your bank connections | To establish and refresh the bank connections you authorize |
| Hosting and infrastructure providers | Data stored and processed on our behalf | To run the service. They are contractually restricted to processing on our instructions. |
| Payment processors | The details needed to collect your subscription fees | To process your payment to us |
| Tax authorities and government agencies | The returns and filings we prepare for you | To file your returns, at your direction and on your behalf |
| Legal and professional advisors, or as required by law | Only what is necessary | To comply with legal obligations, enforce our agreements, or protect rights and safety |
The sub-processors we use
The categories above name what kinds of recipient receive data. This is the list of the specific companies that process it on our behalf today. We publish it by name because a category like “hosting provider” tells you nothing you can check, and because you are entitled to know which companies hold your financial records. We will update this list before adding a sub-processor that handles your data.
| Sub-processor | What it does for us | What it holds |
|---|---|---|
| Supabase, Inc. (United States) | Our database, authentication, and file storage | All account and financial data you enter or we import, including identifiers we hold encrypted |
| Plaid Inc. (United States) | Bank connections and the transaction feed you authorize | The bank accounts you select and their transaction history. Plaid holds your bank credentials; we never receive them. |
| Cloudflare, Inc. (United States) | Object storage for uploaded documents, plus content delivery and DNS for our website | Documents you or your CPA upload, and the ordinary network data any website receives |
| Sentry (Functional Software, Inc., United States) | Error monitoring, so a failure is seen and fixed rather than silently dropped | Technical error detail. It is configured not to send personal information, and it is only enabled where our error reporting is switched on. |
Our application servers run on hardware we own and operate ourselves rather than in a third-party cloud, so running the service does not itself place your data with an additional provider.
Some features we have built are not yet connected to a live provider — payroll tax e-filing and ACH payment origination among them. No data reaches those providers today, so they are deliberately absent from this list; they will be added here before they begin processing anything of yours.
How long we keep it
We keep financial records — including bank and card transaction data obtained through Plaid, payroll records, and the returns and filings we prepare — for at least seven years after the end of the tax year to which they relate. This matches the retention period required of tax records and lets a return be substantiated or amended years later.
Financial records in Faspro are append-only. Corrections are recorded as new entries that supersede earlier ones rather than by overwriting history, and every change is logged with who made it and when. Account and usage data not forming part of a financial record is kept only as long as needed for the purposes described above.
How we protect it
- Encryption in transit using TLS 1.3
- Encryption at rest using AES-256
- Additional field-level encryption for the most sensitive identifiers — Social Security numbers, employer identification numbers, and bank account and routing numbers — using keys held in a separate key-management service
- Tenant isolation enforced in the database itself, so one customer's records cannot be read through another customer's session
- Role-based access control, with access limited to what a person's role requires
- Audit logging of changes to financial records
No system is perfectly secure, and we do not claim otherwise. If a breach affects your information, we will notify you as required by applicable law.
Your choices and rights
- Access and correction — you can view and correct most of your information in the application, or ask us for a copy
- Disconnecting a bank account — you can revoke a bank connection at any time from within the application
- Deletion — you can ask us to delete your information. We will do so except where we are required to retain it, which for financial and tax records means the seven-year period described above
- Marketing — you can opt out of marketing email at any time using the link in any such message. Service, billing, and compliance notices are not optional while your account is active
If you are an employee of a Faspro customer, please direct requests about your payroll information to your employer, who determines what we hold about you. We will support them in responding.
Depending on where you live, you may have additional rights under state privacy law, including the right to know what we collect, to request deletion, to correct inaccuracies, and not to be discriminated against for exercising those rights. Contact us at the address below to exercise them.
Children
Faspro is a business service and is not directed at children. We do not knowingly collect information from anyone under 16 except as part of payroll records an employer provides about a lawfully employed minor.
Changes to this policy
We will update this policy when our practices change. The effective date above always reflects the current version. If a change materially affects how we use information you have already given us, we will notify account holders before it takes effect.
Contact us
Questions about this policy, or to exercise a right described above: [email protected]. To report a security concern: [email protected].