Privacy Policy

Isla Advisory and Trust LLC ("we," "us," or "our") operates the Isla Portal practice management platform (the "Service"). This Privacy Policy explains what personal and financial information we collect, how we use it, and the choices you have. By using the Service, you agree to the practices described below.

1. Information We Collect

Information you provide:

• Client financial data: tax returns, financial statements, bank and investment account details, payroll records, and supporting documents you upload or share with us.
• Personal identifiable information (PII): names, addresses, Social Security numbers, Employer Identification Numbers, dates of birth, and dependent information.
• Identity documents: driver's licenses, passports, and other government-issued IDs provided for verification.
• Business data: entity formation documents, ownership records, vendor and banking details, and partnership/equity allocations.
• Account credentials: email address, password (hashed), and role assignments for firm staff and clients.

Information collected automatically: IP address, device type, browser, usage logs, and interaction data when you access the Service.

2. How We Use Your Information

• Providing tax preparation, bookkeeping, payroll, advisory, and representation services.
• Generating engagement letters, invoices, and financial reports.
• Communicating with you about deadlines, document requests, and project status.
• Processing payments and reconciling billing.
• Complying with legal, regulatory, and professional standards (IRS, AICPA, Florida statutes).
• Maintaining audit logs and security monitoring.

3. Third-Party Integrations

The Service integrates with the following third-party providers. Each provider has its own privacy policy governing data they process. We share only the minimum data necessary to provide the integration:

• Google Workspace (Drive, Sheets, Calendar, Gmail, Meet) — document storage, spreadsheet exports, scheduling, and email delivery.
• QuickBooks Online — syncing clients, invoices, and payments.
• DocuSeal — electronic signature workflows for engagement letters and contracts.
• Stripe / CPACharge — processing client invoice payments.
• EasyPost — generating shipping labels for document delivery.
• Anthropic / OpenAI — AI-assisted features such as the Notice Response Center and document analysis.

When you connect your own Google account for exports, the OAuth connection is governed by Google's terms and your data is accessed using your own credentials. We do not store your Google password.

4. Data Security

We implement industry-standard safeguards including encryption in transit (TLS), role-based access controls, tenant-level data isolation, audit logging, session timeouts, and secure secret management. Access to sensitive data is restricted to authorized personnel based on role (admin, CPA, senior staff, staff). Despite these measures, no system can guarantee absolute security.

5. Data Retention

We retain client financial records and supporting documents in accordance with IRS recordkeeping requirements (generally three to seven years) and professional standards. You may request deletion of your data subject to legal retention obligations. Account data is removed upon account closure, except where retention is legally required.

6. Data Sharing

We do not sell your personal information. We share data only with: (a) the third-party providers listed above to deliver the Service; (b) government agencies when legally required (e.g., IRS filings you authorize); (c) professional advisors under confidentiality obligations; and (d) successors in the event of a merger or acquisition.

7. Your Rights

• Access, correct, or request deletion of your personal data.
• Withdraw consent for third-party integrations at any time by disconnecting your account.
• Object to or restrict certain processing of your data.
• Receive a portable copy of data you provided.

To exercise these rights, contact us using the details in Section 9.

8. Children's Privacy

The Service is not directed to children under 16, and we do not knowingly collect their data.

9. Contact Us

For privacy questions or requests, contact Isla Advisory and Trust LLC through the in-app support channel or by writing to your assigned accountant. We will respond within 30 days.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service. Continued use after changes constitutes acceptance of the updated policy.