EazeAccounts Privacy Policy

To the maximum extent permitted by applicable law, any dispute, claim, or controversy arising out of or relating to this policy, agreement, addendum, disclosure, or your use of the Services will be resolved under the arbitration agreement, class action waiver, limitation of liability, and exclusive remedy provisions in the EazeAccounts Terms & Conditions or other governing customer agreement. Nothing in this section limits rights that cannot be waived under applicable law, including rights to submit complaints to regulators or rights that must remain available under state or federal law.

This Privacy Policy explains how EazeAccounts collects, uses, discloses, stores, protects, and otherwise processes personal information in connection with our websites, applications, mobile experiences, platform, AI features, accounting tools, bookkeeping workflows, payroll facilitation, tax-support workflows, entity-formation support, payment integrations, bank-connectivity features, customer support, marketing, and related services (collectively, the "Services").

This Policy applies to business customers, account owners, administrators, employees, contractors, invited users, accountants, bookkeepers, CPAs, vendors, customers of our customers, website visitors, job or partner applicants, and other individuals whose personal information we process. It should be read together with the Terms & Conditions, Subscription Agreement, Data Processing Addendum, EazeAI Use and Disclosure Policy, Cookie Policy, and any order form or statement of work.

EazeAccounts intends to serve customers across the United States. Because U.S. privacy, security, tax, payroll, consumer protection, professional-services, and breach-notification requirements vary by state and can change frequently, this document is structured as a nationwide framework. Where a state, federal, or local law gives you additional rights or requires different procedures, EazeAccounts will apply the rights and procedures required by that law to eligible individuals and covered processing activities. If there is a conflict between this policy and a mandatory legal requirement, the mandatory legal requirement controls.

Depending on the context, EazeAccounts may act as a controller/business that decides why and how personal information is processed, or as a processor/service provider that processes personal information on behalf of a customer. For example, we generally act as a controller for account registration, billing, platform security, marketing, support, fraud prevention, and product analytics. We generally act as a processor or service provider when we process end-user, payroll, accounting, vendor, customer, or transaction data submitted by a business customer for use within the Services.

Unless separately agreed in writing, EazeAccounts is not acting as a HIPAA business associate and the Services are not intended to store protected health information. Customers should not upload health data, government identifiers, children’s data, biometric data, or other highly sensitive data unless necessary for the specific Service and permitted by the applicable agreement and law.

Category

Examples

Primary Purposes

Identifiers and contact data

Name, email, phone number, business address, mailing address, login ID, account ID, signature, IP address, and related identifiers.

Create and manage accounts, authenticate users, provide support, billing, security, compliance, communications.

Business profile and professional data

Company name, entity type, EIN or tax ID when required, industry, role, job title, CPA/bookkeeper relationship, business licenses, ownership or officer information.

Customer onboarding, entity-support workflows, accounting/payroll/tax support, compliance, partner matching, account administration.

Financial, accounting, and transaction data

Bank transactions, chart of accounts, invoices, bills, receipts, statements, journal entries, reports, payment status, customer/vendor balances, tax schedules, reconciliation data.

Deliver accounting, bookkeeping, reporting, reconciliation, payment, and advisory-support workflows.

Banking and payment data

Tokenized bank-connection data, payment identifiers, partial account details, payment method metadata, Stripe/Plaid/bank integration status, ACH or card payment status.

Payment processing, bank connectivity, fraud prevention, reconciliation, invoicing, subscription billing.

Payroll and workforce data

Employee names, addresses, compensation, payroll elections, tax withholding details, time/payroll records, benefit-related data if enabled, payroll partner IDs.

Payroll setup, payroll processing facilitation, compliance support, employer reporting, employee access.

Tax and compliance data

Tax forms, filing status, estimated tax information, federal/state/local filing data, tax-payment confirmations, occupancy tax, sales tax, 1099, W-2, and other compliance records.

Tax-support workflows, compliance reminders, preparation support, audit trail, customer recordkeeping.

Device, log, and usage data

Device type, operating system, browser, language, access time, pages visited, clickstream, error logs, session activity, API usage, security telemetry.

Security, debugging, analytics, performance, fraud detection, compliance, product improvement.

Cookies and tracking data

Cookie IDs, advertising IDs, analytics identifiers, browser settings, consent choices, referral URLs, campaign attribution.

Authentication, preferences, analytics, marketing measurement, consent management.

Support and communications

Emails, chats, calls, tickets, feedback, survey responses, attachments, screen recordings or screenshots submitted by users.

Support, training, dispute resolution, quality assurance, product improvement.

EazeAI prompts and outputs

Prompts, questions, uploaded context, generated suggestions, AI interaction logs, feedback, corrections, and workflow actions.

Operate EazeAI, improve workflows, detect errors, support customers, maintain safety and quality controls.

Sensitive personal information

Government identifiers, financial account details, credentials or tokens, precise geolocation if enabled, tax information, payroll information, and other legally sensitive data.

Only as necessary to provide requested Services, secure accounts, comply with law, or with consent where required.

• Directly from you or your organization when you create an account, configure the platform, upload files, submit forms, invite users, or contact support.
• From connected third-party services that you authorize, such as banks, Plaid, Stripe, payroll providers, payment processors, email/SMS providers, cloud hosting providers, analytics providers, or other integrations.
• From accountants, bookkeepers, CPAs, payroll administrators, business owners, employees, vendors, customers, and other authorized users who interact with your account.
• Automatically through cookies, server logs, analytics tools, security tools, and usage tracking technologies.
• From public records, government agencies, professional advisors, identity verification providers, and compliance vendors where required for lawful business purposes.

• Provide, operate, maintain, improve, personalize, and secure the Services.
• Create and manage accounts, subscriptions, user permissions, roles, and authentication.
• Process payments, invoices, refunds where applicable, chargebacks, account credits, and subscription billing.
• Facilitate bank connectivity, transaction categorization, accounting, reconciliation, payroll, tax-support, compliance, reporting, and document-management workflows.
• Provide customer support, troubleshoot problems, monitor uptime, investigate errors, and respond to inquiries.
• Operate EazeAI and related automation features, including suggestions, categorization, insights, anomaly detection, and conversational assistance.
• Prevent fraud, abuse, unauthorized access, money laundering, security incidents, and violations of our Terms.
• Comply with legal, tax, regulatory, subpoena, law-enforcement, audit, and recordkeeping obligations.
• Send administrative notices, service updates, billing communications, security alerts, policy updates, and support messages.
• Send marketing communications where permitted, and honor opt-out or consent choices.
• Develop new features, improve system reliability, enhance code architecture, optimize algorithms, conduct internal testing, and generate aggregated or de-identified analytics.
• Protect the rights, safety, property, and legal interests of EazeAccounts, our customers, users, partners, and the public.

Where laws such as GDPR, UK GDPR, or similar frameworks apply, we process personal information based on one or more legal bases: performance of a contract; legitimate interests in operating, improving, securing, and supporting the Services; compliance with legal obligations; consent where required; and protection of vital interests or public-interest obligations in limited circumstances.

Recipient Category

Examples

Purpose

Service providers and subprocessors

Cloud hosting, security, analytics, customer support, email/SMS, storage, logging, AI infrastructure, payment processors, payroll partners, accounting integrations, and data processing vendors.

Operate and support the Services under contractual obligations.

Payment, banking, and financial partners

Stripe, Plaid, banks, card networks, ACH processors, payroll companies, tax-payment or compliance partners, and similar providers.

Bank connections, payment processing, payroll, tax-support, compliance, fraud prevention.

Authorized users and customer-designated parties

Account owners, admins, employees, accountants, bookkeepers, CPAs, advisors, vendors, or other users authorized by the customer.

Collaboration, delegated access, service delivery, customer instructions.

Professional advisors

Attorneys, auditors, accountants, insurers, consultants, and compliance advisors.

Legal, audit, financial, insurance, compliance, and risk-management purposes.

Government, regulators, and law enforcement

Tax authorities, courts, regulators, law enforcement, or government agencies.

Compliance with legal obligations and lawful requests.

Business transfers

Potential or actual acquirers, investors, lenders, or successors.

Merger, acquisition, financing, reorganization, bankruptcy, or transfer of assets.

Aggregated or de-identified data recipients

Partners, analytics providers, research, benchmarking, or product-performance recipients.

Product analytics, benchmarking, market insights, and platform improvement where individuals are not reasonably identifiable.

This section explains how EazeAccounts handles Google user data when you choose to sign in with Google.

What we receive

When you sign in with Google, we receive your name, email address, profile picture, and Google account ID. Sign in with Google asks only for your basic profile and email address.

How we use it

We use this information only to create your EazeAccounts account, sign you in, and keep your account secure.

What we do not do

• We do not use Google user data for advertising.
• We do not sell Google user data.
• We do not use Google user data to train AI models.

Who we share it with

We share Google user data only with service providers who help us run sign-in and host the Services, under the disclosure terms in section 7 (How We Disclose Personal Information).

How we store, protect, and keep it

We store and protect Google user data in the same way as other account information, as described in section 14 (Financial, Taxpayer, and Professional Data Safeguarding) and section 17 (Security Incidents and Breach Notification), and we keep it as described in section 16 (Retention).

Disconnecting Google and deleting your data

You can remove EazeAccounts' access to your Google account at any time at myaccount.google.com/permissions. To ask us to delete your account or the Google user data we hold, contact us using the details in section 20 (Contact).

Google API Services User Data Policy

EazeAccounts' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

EazeAccounts does not sell personal information for money. We do not knowingly sell or share personal information of minors. If we use advertising or analytics technologies that are considered a “sale,” “sharing,” targeted advertising, or cross-context behavioral advertising under applicable law, we will provide required notices and opt-out controls, including cookie controls and applicable browser-based opt-out signals where required.

Marketing emails may be opted out of at any time using the unsubscribe link or by contacting us. Transactional, security, billing, legal, and service-related notices may still be sent as permitted by law.

If you give us a mobile number on our website and tick the text-message consent box, we use that number to send automated text messages about your demo booking (reminders and requests to confirm or cancel) and to answer texts you send us. Consent is not required to book a demo or to make a purchase, and the box is never pre-selected.

• Message frequency: up to 3 messages per demo booking, plus replies to messages you send us.
• Message and data rates may apply.
• You can opt out at any time by replying STOP; reply HELP for help or email support@eazeaccounts.com.
• We do not sell mobile numbers or text-message opt-in data, and we do not share them with third parties or affiliates for their own marketing purposes. Mobile numbers and consent records are shared only with the messaging provider that delivers our texts (Twilio) and as otherwise described in section 7.
• We keep the wording you agreed to, the time of consent, the page it was given on, and a log of messages sent and received, so that we can honor opt-outs and demonstrate consent.

Residents of certain U.S. states may have rights regarding personal information, depending on the law that applies and the context in which we process the information. These rights may include:

• Right to know or confirm whether we process personal information.
• Right to access categories or specific pieces of personal information, where applicable.
• Right to correct inaccurate personal information.
• Right to delete personal information, subject to exceptions.
• Right to obtain a portable copy of personal information.
• Right to opt out of sale, sharing, targeted advertising, profiling, or automated decision-making where applicable.
• Right to limit use or disclosure of sensitive personal information where applicable.
• Right to consent before sensitive personal information is processed where required.
• Right to appeal a denial of a privacy request in certain states.
• Right not to be discriminated against for exercising privacy rights.

To submit a request, contact us at info@eazeaccounts.com or use any privacy request form made available through the Services. We may verify your identity and authority before responding. Authorized agents may submit requests where permitted by law, but we may require proof of authorization and verification of the consumer. Response times, appeal rights, and verification standards vary by state.

For U.S. residents in states not listed above, EazeAccounts will comply with applicable state privacy, consumer protection, data security, electronic communications, biometric, children’s privacy, and breach-notification requirements as they apply to the Services. State-specific laws may include narrower requirements for particular data types, such as biometric data, health data, education data, children’s data, employee data, social security numbers, driver’s license numbers, or breach notices.

This section supplements the rest of the Privacy Policy for California residents. The categories of personal information we may collect are described in Section 3. The categories of sources are described in Section 4. The purposes for collection, use, and disclosure are described in Sections 5 and 7. Retention periods are described in Section 16.

California residents may request to know, access, delete, correct, opt out of sale or sharing, limit the use and disclosure of sensitive personal information, and exercise the right to non-discrimination. Where legally required, EazeAccounts will honor Global Privacy Control signals for browsers or devices used to access our websites or services. If a “Do Not Sell or Share My Personal Information” or “Limit the Use of My Sensitive Personal Information” link is required for a particular service or website, EazeAccounts will provide such a link or a compliant alternative opt-out mechanism.

CA Category

Collected?

Disclosed To

Sold/Shared?

Identifiers

Yes

Service providers; authorized users; financial/payment partners; regulators where required

No monetary sale; possible sharing for analytics/ads only if enabled and legally disclosed

Customer records and financial data

Yes

Service providers; authorized users; payment/banking/payroll partners; advisors; regulators

No

Commercial information

Yes

Service providers; analytics; payment partners; authorized users

No monetary sale; possible advertising attribution if enabled

Internet or network activity

Yes

Security, analytics, hosting, support, advertising tools if enabled

Possible sharing/targeted advertising only if enabled and opt-out controls provided

Geolocation

Approximate from IP; precise only if feature-enabled

Service providers and security tools

No

Professional or employment-related information

Yes, if submitted for payroll or account management

Payroll partners, service providers, authorized users

No

Sensitive personal information

Yes, where necessary for tax, payroll, payments, security, or account services

Service providers, partners, regulators, authorized users

No

Inferences

Limited, for analytics, fraud, categorization, and product features

Service providers and authorized users where feature-enabled

No monetary sale; targeted advertising only if enabled

For residents of states with comprehensive consumer privacy laws, EazeAccounts provides rights consistent with the law applicable to the individual and processing activity. Where EazeAccounts acts as a processor/service provider for a customer, we may direct the individual to the customer/controller or assist the customer in responding as required by the Data Processing Addendum. Where EazeAccounts acts as controller, we will respond directly to eligible requests.

If your state grants appeal rights and we deny your request, you may appeal by replying to our decision email or by contacting info@eazeaccounts.com with the subject “Privacy Appeal.” We will respond within the timeframe required by applicable law. If your appeal is denied, we will provide information required by law, which may include how to contact the relevant attorney general or regulator.

Nevada residents may have the right to opt out of certain sales of covered information under Nevada law. EazeAccounts does not currently sell covered information as defined by Nevada law. Nevada residents may still submit an opt-out request to info@eazeaccounts.com.

The Services are intended for business use and are not directed to children under 18. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us without appropriate consent, contact us and we will take appropriate steps to delete or restrict the information.

Because EazeAccounts may process financial, payroll, accounting, tax, and business records, we maintain administrative, technical, and physical safeguards designed to protect customer information. Safeguards may include encryption in transit and at rest, access controls, least-privilege permissions, audit logging, vulnerability management, backups, monitoring, vendor due diligence, employee confidentiality obligations, and incident-response procedures. Customers and professionals using EazeAccounts remain responsible for their own compliance obligations, including any written information security plans, tax-professional obligations, and professional standards applicable to their business.

EazeAccounts is based in the United States. We and our vendors may process personal information in the United States and other countries where we or they operate. Where required, we use appropriate transfer safeguards such as Standard Contractual Clauses, data-processing terms, consent, adequacy decisions, or other lawful transfer mechanisms.

Record Type

Retention Approach

Account and profile records

For the life of the account plus a reasonable period for audit, legal, fraud-prevention, and business continuity purposes.

Financial, accounting, tax, and payroll records

As instructed by the customer, as required by law, or as reasonably needed for accounting, tax, audit, dispute, and compliance purposes.

Payment and billing records

As required for tax, accounting, chargeback, anti-fraud, and payment-processing obligations.

Support tickets and communications

As needed for support history, training, dispute resolution, security, and legal compliance.

Security logs and telemetry

For a reasonable period based on security, fraud-prevention, incident-response, and compliance needs.

Marketing records

Until opt-out, deletion, or no longer needed for lawful marketing and analytics purposes.

De-identified or aggregated data

May be retained without time limit where individuals are not reasonably identifiable and legal requirements are met.

If we become aware of a security incident involving personal information, we will investigate, take appropriate containment and remediation steps, and provide notifications required by applicable federal, state, and international laws. U.S. breach notification laws vary by state and may require notices to affected individuals, attorneys general, consumer reporting agencies, financial institutions, regulators, or other parties depending on the facts. Customer contracts may include additional notice obligations.

• Customers are responsible for the accuracy, legality, and completeness of data submitted to the Services.
• Customers must configure user permissions carefully and remove access for employees, contractors, accountants, or advisors when access is no longer needed.
• Customers must not upload data they are not legally authorized to process.
• Customers must maintain their own tax, payroll, accounting, employment, and state-specific compliance obligations unless a separate written service engagement says otherwise.

We may update this Privacy Policy from time to time. If changes are material, we will provide notice by posting an updated policy, sending email notice, providing in-product notice, or using another legally appropriate method. Continued use of the Services after the effective date of an updated policy means you accept the updated policy to the extent permitted by law.

Erihaan Business Services Inc. dba EazeAccounts 1717 E Cary St, Richmond, VA 23223 Email: info@eazeaccounts.com Privacy requests and appeals: info@eazeaccounts.com