This Privacy Policy explains how FirmSuit (“FirmSuit,” “we,” “us”) collects, uses, stores, and protects information when a tax or accounting agency (“Agency,” “you”) uses our document intelligence platform, and when an Agency’s own clients’ information is processed on the Agency’s behalf.
FirmSuit is operated by EnDevSols (Pvt) Ltd, registered at [Registered Address].
1. What we collect
Account & Agency information
- Staff account details: name, email address, hashed password, role (Admin, Manager, Reviewer).
- Agency profile details: agency name, country, billing email, and (optionally) invoicing details such as bank name and account number for generating client invoices.
Client documents you upload
The core of the service is processing documents your Agency uploads on behalf of your own clients: bank statements, land/property records, and tax withholding certificates. These documents typically contain personal and financial information about your clients (e.g. names, national ID / CNIC numbers, account numbers, transaction amounts, property details). FirmSuit processes this information solely to provide the extraction, verification, and search features of the platform.
Usage & security information
- Audit log entries recording who took which action, when, and from what IP address (uploads, edits, verifications, exports, and account changes).
- Processing metadata (document volume and processing timestamps): used for plan quota tracking and platform reliability monitoring, not for building a profile of your clients.
2. How we use it
- To provide the service: structuring client records from uploaded documents, powering search and client intelligence briefs, and generating reports you request.
- To secure your account: authentication, fraud/abuse prevention, and audit logging.
- To operate and maintain the platform: diagnosing errors and ensuring system reliability.
We do not use your documents or your clients’ data to train shared or foundation AI models, ours or any third party’s. Documents are processed solely to return structured intelligence to your Agency.
3. Who processes it on our behalf (sub-processors)
We use a small number of infrastructure providers to operate the service. The full list, including their role and location, is published on our Subprocessors page. In summary: cloud infrastructure, data storage, and managed AI processing run on Amazon Web Services (AWS) in the United States, and service communications are delivered via Google Workspace.
4. Where data is stored, and international transfers
All data is currently hosted on secure cloud infrastructure in the United States, regardless of which country your Agency operates in. For Agencies in the United Kingdom or European Economic Area, this means your data (and your clients’ data) is transferred to the United States. We safeguard this transfer through:
- AWS’s own Data Processing Addendum and its certification under the EU-US Data Privacy Framework / UK extension for the services we use;
- Our own Data Processing Addendum with Agencies, incorporating the UK International Data Transfer Agreement and/or EU Standard Contractual Clauses (see our DPA); and
- A documented Transfer Impact Assessment reviewed periodically.
5. Data retention
We retain Agency and document data for as long as your Agency’s account is active. If an Agency account is closed or deleted, associated records and uploaded documents (including their copies in cloud storage) are deleted as part of that process. We do not currently offer automatic time-based deletion of individual documents while an account remains active. If your Agency needs specific documents removed sooner, contact us using the details below.
6. Security
Documents and client records are encrypted in transit and at rest. Each Agency’s data is kept separate through multi-tenant access controls, ensuring that one firm cannot access another firm’s information. Staff accounts can enable two-factor authentication, and every sensitive action is recorded in an audit log. No security measure is perfect, and we cannot guarantee absolute security.
7. Your rights
Depending on where you or your clients are located, you may have rights to access, correct, delete, or receive a copy of personal data we hold, or to object to or restrict certain processing (for example, under UK/EU GDPR or, for California residents, the CCPA/CPRA). Because FirmSuit acts as a processor on behalf of Agencies for client data, requests about a specific client’s data should generally go to the Agency that submitted it; we will assist that Agency in responding. To make a request directly to us, contact support@firmsuit.com.
8. Children
FirmSuit is a business tool for tax and accounting professionals and is not directed at children.
9. Changes to this policy
We may update this policy as the product or our practices change. Material changes will be reflected by updating the “Last updated” date above.
10. Contact
Questions about this policy or how your data is handled: support@firmsuit.com, [Registered Address].