Privacy Policy

1. Introduction

PORTL ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website at portl.tax and our services (collectively, the "Services"). Please read this policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access the Services.

2. Information We Collect

We may collect information about you in a variety of ways, including:

Personal Data

When you register for an account, we collect personally identifiable information such as your name, email address, phone number, business name, and payment information. This information is necessary to provide our Services to you.

Client Data

Tax professionals using PORTL may upload client information, tax documents, and other sensitive data through our platform. We treat all client data as confidential and process it solely on behalf of the tax professional.

Usage Data

We automatically collect certain information when you visit or use our Services, including your IP address, browser type, operating system, access times, pages viewed, and referring website addresses. This data helps us improve our Services and user experience.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our Services
• Process payments and prevent fraudulent transactions
• Send administrative information, such as updates and security alerts
• Respond to your comments, questions, and customer service requests
• Improve our website and Services based on usage patterns
• Send marketing and promotional communications (with your consent)
• Monitor and analyze usage and trends to improve user experience
• Comply with legal obligations and protect our rights

4. How We Share Your Information

We do not sell, trade, or otherwise transfer your personally identifiable information to outside parties except as described below:

Service Providers

We may share your information with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf, such as payment processing (Stripe), email delivery, hosting, and analytics.

Legal Requirements

We may disclose your information where required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).

Business Transfers

If we are involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction.

5. Connecting your Google account

If you choose to connect a Google account to PORTL, we use Google's secure sign-in (OAuth) to request limited permissions. You decide whether to connect, and you can disconnect at any time.

What we request and why

When you connect, Google shows you the permissions PORTL is asking for:

• Basic profile and email (openid, email, profile): To identify which Google account is connected and show it in your settings.
• Calendar events (calendar.events): To create, update, and cancel the events you schedule through PORTL, such as client appointments and onboarding calls, with a Google Meet link attached. Invitations go to the attendees of those events.
• calendar.readonly: when clients book an appointment, PORTL reads only busy and free times on the connected calendar. For PORTL's own sales and admin dashboards, it also reads event titles, guests and Google Meet links on the connected calendar, from about one year back to 60 days ahead, to match onboarding and webinar calls.
• Google Drive files created by PORTL (drive.file): To keep a copy of your clients' Document Vault files in a PORTL folder in your Google Drive. This permission only covers files and folders PORTL creates. We cannot see or change any other files in your Drive.

We use this access only to provide the scheduling, video meeting, and document features you turn on. We do not use it for anything else.

What we store

We store the following:

• The access and refresh tokens Google issues to PORTL.
• When those tokens expire, and which permissions you granted.
• The email address of the connected Google account.
• The IDs and Google Meet links of events PORTL created.
• The IDs of files and folders PORTL created in your Drive.

The tokens are stored on our servers and encrypted at rest and in transit. They are never sent to your browser or exposed to other users. Only PORTL's server functions use them, and only to carry out the actions above. We do not store the contents of your calendar or your Drive.

Google API Services User Data Policy

PORTL's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This means:

• No selling: We do not sell Google user data.
• No advertising: We do not use or transfer Google user data for advertising, including retargeting or personalized ads.
• No AI training: We do not use Google user data to develop, improve, or train artificial intelligence or machine learning models.
• Limited transfers: We share Google user data only as needed to provide or improve the features you use, to comply with the law, for security, or as part of a merger or acquisition, as described in this policy.
• Limited human access: Our team does not read Google user data unless one of these applies:
  • You give us permission, for example to help with a support request.
  • It is needed for security or to comply with the law.
  • It is aggregated and anonymized for internal operations.

How to disconnect

You can disconnect your Google account at any time in either of these ways:

• Ask us: Email support@portl.tax. We will disconnect your Google account and delete the stored tokens and connection details.
• In your Google account: Visit myaccount.google.com/permissions, select PORTL, and remove its access. Once you do this, PORTL can no longer reach your Google account. To also have the stored tokens and connection details deleted, email support@portl.tax.

We delete your stored Google connection data when you disconnect through us or ask us to delete it. We also delete it if you delete your PORTL account.

After you disconnect, PORTL stops creating calendar events and stops syncing files to your Drive. Events and files that were already created belong to you, so they stay in your Google account until you remove them.

Questions

For questions about how PORTL uses your Google data, or to ask us to delete it, contact us at support@portl.tax.

6. Data Security

We implement appropriate technical and organizational security measures to protect your information. This includes encryption of data in transit and at rest, access controls, and regular security assessments. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. You may request deletion of your account and associated data by contacting us.

8. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you
• Correction — Request that we correct inaccurate or incomplete data
• Deletion — Request that we delete your personal data
• Restriction — Request that we restrict the processing of your data
• Portability — Request a transfer of your data to another service
• Objection — Object to our processing of your personal data

To exercise these rights, please contact us using the information below.

9. Cookies and Tracking Technologies

We may use cookies and similar tracking technologies to track activity on our Services and hold certain information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, some features of our Services may not function properly without cookies.

10. Children's Privacy

Our Services are not intended for use by children under the age of 18. We do not knowingly collect personal information from children under 18. If we learn that we have collected personal information from a child under 18, we will delete that information promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Last updated" date. We encourage you to review this Privacy Policy periodically to stay informed about our practices.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

support@portl.tax

PORTL, Inc.