Privacy Policy

This Privacy Policy describes how Suncea, LLC (“Suncea”, “we”, “us”, or “our”) collects, uses, shares, and protects information in connection with the Suncea service (the “Service”). It is part of, and uses the defined terms in, our End-User License Agreement (the “Agreement”). “Effective Date” means the effective date shown at the top of this Privacy Policy.

The Service is a tool for accounting and bookkeeping practices (each a “Customer”) and the people they work with. Much of the information in the Service is put there by a Customer about its own clients. For that information, the Customer decides what is collected and why, and we process it on the Customer’s behalf and on its instructions, as described in the Agreement. Where a state privacy law distinguishes between the business that decides how personal information is used and the provider that processes it for them, the Customer is the former and we are the latter for everything in its Account. If you are a client of a Customer, your accountant’s own privacy practices also apply, and questions about your information should go to them first.

1. Information We Collect

Information you give us

• Account and profile information. When an Account is registered or you are invited into one: your name, email address, phone number, and, for a Customer, the practice’s name and billing details.
• Customer Data. Everything Authorized Users upload to, send through, or create in the Service: messages, uploaded files, documents sent for signature, client records, and the details in them. Because the Service is built for accounting work, this often includes sensitive information, such as tax returns, financial statements, bank details, and government identification numbers.
• Communications with us. What you send us when you contact support or otherwise correspond with us.
• Agreement records. When you accept the Agreement or this Privacy Policy, we record which version you accepted, when, and the IP address and browser it was accepted from.

Information collected automatically

• Usage and device information. When you use the Service, our servers record information such as your IP address, browser type and version, the pages and features you use, the time of your requests, and error information. Our hosting provider records similar information in its own logs.
• Cookies. The Service uses cookies that are necessary for it to work: a session cookie that keeps you signed in, and a cookie that protects forms against forgery. We do not use advertising or cross-site tracking cookies. If we use a tool to measure how the Service is used, it will be listed with our service providers in Section 3, and will be used only for that.

Information from others

• From the Customer that invited you. If you are a Client User, the Customer gives us your name and email address to invite you, and may add information about you to its records in the Service.
• From sign-in providers. If you sign in with Google, Google gives us the identifier for your Google account, your email address, and your name, so that we can match you to your Account. We do not receive your Google password.
• From electronic signature and identity verification. When a document is signed through the Service, BoldSign returns the signed document and a record of the signing to the Account. That record says who signed, when, from what internet address, and how they were verified. Where knowledge-based authentication is used, the identity verification is performed by BoldSign and its providers, and we receive only the result, not the questions or answers.

2. How We Use Information

We use information to:

• provide, operate, secure, maintain, and support the Service;
• create and manage Accounts, and authenticate Authorized Users;
• send transactional messages, such as sign-in links, password resets, notifications that a message or document is waiting, and invoices;
• bill Customers and process payments;
• respond to support requests, and communicate with you about the Service, including changes to it, new features, and matters affecting your Account (you may opt out of any such message that is not needed to run the Service, using the link in it or by contacting us);
• understand how the Service is used, and develop, test, and improve it, including new features and services;
• detect, investigate, and prevent fraud, abuse, security incidents, and other harmful activity;
• enforce the Agreement and protect our rights and the rights of others;
• comply with law, respond to legal process, and meet our regulatory obligations; and
• create aggregated or de-identified data that does not identify any person or Customer, which we may use for any lawful purpose, including analytics, benchmarking, product development, and business development.

We do not use Customer Data to train artificial intelligence models for use by anyone other than in providing the Service to the Customer whose data it is, unless the Customer has agreed to that in writing.

3. How We Share Information

We share information only as described here.

• With the Customer. Information about a Client User, and everything a Client User uploads or sends, is visible to the Customer that invited them, and to that Customer’s Admin Users, as part of the Customer’s Account.
• With service providers. We use other companies to provide parts of the Service. They may process information only for the purpose of providing their services to us, and are bound by contractual obligations of confidentiality and security. They are listed at the end of this Section.
• For legal reasons. We may disclose information if we believe in good faith that it is required by law, regulation, subpoena, court order, or other legal process; to protect the rights, property, or safety of Suncea, our users, or others; or to detect and address fraud, security, or technical issues. Where the law allows, we will try to tell the affected Customer before disclosing Customer Data in response to legal process, so that it can seek protection.
• In a corporate transaction. If we are involved in a merger, acquisition, financing, reorganization, or sale of all or part of our business or assets, information may be disclosed to the other party and its advisors during the process, and transferred as part of the transaction. Any successor will be bound by this Privacy Policy as to the information transferred, until it is changed as described in Section 10.
• With your direction or consent. We may share information in other ways when you ask us to or agree to it.

We do not sell personal information, and we do not share it with third parties for their own marketing purposes. We do not share personal information with data brokers.

Our service providers as of the Effective Date are:

We may add or replace service providers as the Service changes. We will update this list when we do.

A service provider holds its own copy of what we send it, under its own terms. Where a Customer asks us to close its Account, we instruct each of them to erase what they hold, as described in the Agreement.

4. Tax Return Information

Information that a Customer puts in the Service may be tax return information within the meaning of Section 7216 of the Internal Revenue Code. We act as a contractor to the Customer for that information, and use and disclose it only as needed to provide the Service to that Customer and as the Agreement and Treasury Regulation Section 301.7216-2 permit. We do not use tax return information for any purpose of our own beyond operating, securing, and supporting the Service. Any statistics we derive from it are anonymous and aggregated, as Treasury Regulation Section 301.7216-2(o) permits, and are never disclosed to anyone for marketing.

5. How We Protect Information

We use administrative, technical, and physical safeguards designed to protect information against unauthorized access, use, alteration, and disclosure. These include:

• encryption of data in transit, and encryption at rest of the database, of uploaded files, and of backups, using keys that we control;
• private storage for uploaded files, with access only through short-lived, signed links generated for an authenticated user;
• separate storage for each Customer’s files;
• access controls that limit who at Suncea can reach production systems and data, with audit logging of access;
• sign-in by emailed single-use link for Client Users, and by password or Google sign-in for Admin Users; and
• regular, encrypted backups.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential and for the security of the devices you use.

If we become aware of a breach of security involving personal information in our possession, we will notify the affected Customer without undue delay, and will notify individuals and authorities where the law requires us to do so directly.

6. How Long We Keep Information

• Customer Data. We keep Customer Data for as long as the Customer’s Account is open and the data has not been deleted by an Authorized User. When an Account closes, we may delete its Customer Data from the live Service after the export period described in the Agreement, which is currently 30 days.
• Closing an Account on request. Where a Customer asks us to close its Account, we confirm the request with the Account’s owner, and then erase what is in it - and instruct our service providers to erase the copies they hold - within 60 days of that confirmation. Copies in backups go when those backups expire.
• Deleted files. When an Authorized User deletes or replaces an uploaded file, the previous copy remains recoverable for a short time, so that a mistake can be undone, and is then removed. That window is measured in days or weeks, not months.
• Backups. We back up the Service on a rolling schedule, keeping recent copies for fine-grained recovery and older copies for longer, so that we can recover from errors, failures, and the loss of the database itself. Backups are encrypted, are stored in the United States, and are used only to restore the Service. Information deleted from the live Service remains in a backup until that backup expires, which takes no longer than about 14 months for the oldest copies. Deleting information from the live Service, or asking us to close an Account, does not remove it from an existing backup any sooner. Backups expire on their own schedule, and we do not edit, rebuild, or expire them early to remove individual records, because a backup that can be edited is not a reliable backup. If we ever restore the Service from a backup, we re-apply any deletion that had already been made. We may change the schedule from time to time, within that limit, as the Service’s needs change.
• Account, billing, and agreement records. We keep information about who used the Service, what they agreed to, and what they paid, for as long as needed to document our relationship with you, to resolve disputes, to enforce our agreements, and to meet legal and tax record-keeping requirements, which is generally at least 7 years after the Account closes.
• Logs. Server, access, and audit logs are kept for a limited period for security and troubleshooting, and then deleted or de-identified.
• Aggregated and de-identified data. We may keep this indefinitely. We commit to keeping it de-identified, not to try to re-identify it, and to require the same of anyone we share it with.

The Service is not a system of record for any retention obligation of a Customer or its clients. Accountants and tax return preparers are responsible for keeping their own copies of what they are required to keep.

7. Your Choices and Rights

• Access and correction. Admin Users can view and update their own profile in the Service’s settings. Client Users, and Customers’ clients, should ask the Customer that holds their records to view, correct, or delete them, since the Customer controls that information. We will help the Customer respond.
• Email. The emails the Service sends to run it (sign-in links, password resets, notifications, invoices, and notices about your Account) are part of the Service. You cannot opt out of them while you use the Service, but you can close your Account. You can opt out of any other email from us using the link in it or by contacting us.
• Google sign-in. An Admin User can connect or disconnect Google sign-in in the Service’s settings at any time.
• Closing an Account. A Customer may close its Account at any time as described in the Agreement. A Client User’s access can be ended by the Customer that invited them.
• State privacy rights. Depending on where you live, you may have rights under state privacy law, such as the right to know what personal information we hold about you, to correct or delete it, or to opt out of certain uses. Many of these laws may not apply to us at our current size, or may not apply to information we process on a Customer’s behalf, but we will honor any request the law requires us to honor, and we will not discriminate against you for making one. To make a request, contact us as described in Section 11. We may need to verify your identity, and we may refer a request about Customer Data to the Customer that controls it.
• Do Not Track. The Service does not track you across other websites or services, and does not respond to browser “Do Not Track” signals, because there is nothing to turn off.

8. Google Sign-In

If you sign in with Google, our use of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. We use that information only to sign you in and to show you which Google account is connected. We do not use it for advertising, and we do not share it with anyone else except as needed to provide the sign-in feature or as required by law.

9. Children and Location

The Service is not directed to children, and we do not knowingly collect personal information from anyone under 18 as a user of the Service. Customer Data may include information about minors, for example a dependent named on a tax return, which the Customer is responsible for. The Service is offered in the United States, and information is stored and processed in the United States. If you use the Service from elsewhere, you understand that your information will be transferred to and processed in the United States.

10. Changes to This Policy

We may change this Privacy Policy from time to time. Each version carries a version number and an effective date. When we make a change, we will post the new version in the Service, and we will ask you to accept it before you continue using the Service. Changes are not retroactive.

11. Contact Us

Questions, requests, and complaints about this Privacy Policy or about your information may be sent to the address below. Any dispute about this Privacy Policy is governed by Sections 18 and 19 of the Agreement.

Suncea, LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, or by email to privacy@suncea.com.

12. Notice to California Residents

California Civil Code Section 1798.83 permits California residents to request certain information about the disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.