All-In Accounting Solutions, LLC

Effective Date: September 1, 2026 | Last Revised: September 1, 2026

This Privacy Policy (this “Policy”) describes how All-In Accounting Solutions, LLC, a Missouri limited liability company (the “Firm,” “we,” “us,” or “our”), collects, uses, stores, discloses, and protects information in connection with:

• Professional services. The bookkeeping, month-end close, account reconciliation, financial reporting, payroll processing, tax preparation and advisory, CFO advisory, and related professional services the Firm provides to clients under written engagement agreements (collectively, the “Services”), regardless of how client information reaches the Firm, whether through software integrations, client uploads, email, client portals, or paper records.
• Firm software integrations.Proprietary internal software tools (each, an “Application”) that connect to a client’s accounts on third-party accounting, payroll, or other financial platforms (each, a “Connected Platform”) through application programming interfaces authorized by the platform provider. Section 6 of this Policy addresses the Applications specifically.
• Our website. The Firm’s website at www.all-inaccounting.com (the “Website”) and the information collected from its visitors, as described in Sections 3.3 and 11.

The Applications are not public or consumer-facing products. They are operated exclusively by Authorized Personnel of the Firm for the sole purpose of providing the Services to clients that have expressly authorized access to their accounts on the applicable Connected Platform.

This Policy supplements, and does not supersede or modify, the terms of any engagement agreement between the Firm and a client; in the event of a conflict, the engagement agreement governs. By engaging the Firm, using the Website, or completing a Connected Platform’s authorization flow to connect an account to an Application, you acknowledge this Policy.

For purposes of this Policy:

“Client Data” means all information the Firm receives, accesses, or processes in connection with providing the Services to a client, including accounting records, financial information, payroll and personnel information, Tax Return Information, supporting documents, and business contact information, whether obtained through an Application, uploaded or transmitted by the client, or otherwise provided in the course of an engagement.

“Personal Information” means information that identifies, relates to, or could reasonably be linked with a particular individual or household.

“Tax Return Information” means any information, including Personal Information, that is furnished in any form or manner for, or in connection with, the preparation of a tax return, within the meaning of Section 7216 of the Internal Revenue Code and the regulations thereunder.

“Authorized Personnel” means employees and contractors of the Firm who are bound by confidentiality obligations and who require access to Client Data to perform Services for the applicable client.

“Authorization Credentials” means the OAuth 2.0 access and refresh tokens, API keys, and similar authentication materials issued by a Connected Platform that permit an Application to connect to a client’s account on that platform.

In the course of an engagement, the Firm may receive, access, and process the following categories of Client Data, depending on the Services the client has engaged the Firm to provide:

• Accounting and financial data, including the chart of accounts, transactions, invoices, bills, journal entries, account balances, bank and credit card statements, loan documents, and financial reports.
• Payroll and personnel information, where the Firm provides payroll-related Services, including employee and contractor names, home addresses, dates of birth, Social Security numbers or other taxpayer identification numbers, compensation and withholding information, benefits elections, and bank account details used for direct deposit.
• Tax Return Information, where the Firm provides tax preparation or advisory Services, including the information contained in or used to prepare federal, state, and local tax filings.
• Business contact information, such as customer and vendor names, addresses, email addresses, and phone numbers contained in a client’s books and records.
• Engagement and account information, such as the names, titles, and contact details of client personnel, engagement correspondence, and billing records.

Through the Applications, the Firm accesses and processes only the following: accounting data from a client’s records on a Connected Platform (including the chart of accounts, transactions, invoices, bills, journal entries, account balances, and financial reports); business contact information contained within that data; and Authorization Credentials issued through the Connected Platform’s authorization service. The Firm never receives, requests, or stores a client’s username or password for any Connected Platform. The Applications access only the accounts of clients that have completed the applicable Connected Platform’s authorization flow and expressly consented to the connection. The Applications do not employ cookies, advertising identifiers, or tracking technologies.

When you visit the Website, the Firm may collect:

• Information you provide, such as your name, email address, phone number, company name, and the contents of your message when you submit a contact form, request a consultation, or sign up for Firm communications.
• Information collected automatically, through cookies and similar technologies, such as your IP address, browser and device type, pages viewed, referring pages, and the dates and times of visits. Section 11 describes the Website’s use of cookies and analytics and the choices available to you.

The Firm collects the information described above directly from clients and their authorized representatives, through software integrations the client has authorized (such as the Applications), from Website visitors, and, at a client’s direction, from third parties such as financial institutions, payroll providers, or a client’s prior accountant.

The Firm uses Client Data solely to perform the professional Services each client has engaged the Firm to provide, including preparing financial statements and workpapers, reconciling accounts, closing accounting periods, processing payroll, preparing tax returns and related filings, providing advisory analyses, maintaining accounting records, and responding to client inquiries regarding their books and records. The Firm also uses information for related administrative purposes, such as engagement management, billing, quality control, and compliance with legal and professional obligations, and to operate, secure, and improve the Firm’s own systems and Applications used to deliver the Services. Client Data is used for the improvement of Firm systems only in aggregated or de-identified form that does not identify, and cannot reasonably be used to identify, any client or individual. Tax Return Information is never used for that purpose.

Tax Return Information. The Firm uses and discloses Tax Return Information only as permitted by Sections 7216 and 6713 of the Internal Revenue Code and the regulations thereunder: generally, only to prepare the client’s return and for purposes the client has authorized through a compliant written consent, or as otherwise expressly permitted by law.

Website information. The Firm uses information collected through the Website to respond to inquiries, provide requested information, send communications the visitor has requested, and understand and improve how the Website is used.

Without limiting the foregoing, the Firm does not:

• Use Client Data for advertising, marketing to third parties, or profiling;
• Sell, rent, lease, or trade Client Data or Personal Information to any third party;
• Permit Client Data to be used to train, fine-tune, or improve any machine-learning or artificial-intelligence model, whether by the Firm or by any technology provider (see Section 5); or
• Use Client Data for any purpose unrelated to the client’s engagement, except as described in this Section 4 or as required by law.

The Firm operates its practice using firm-controlled devices together with reputable, widely used third-party technology services, including cloud-based productivity, email, file storage, and accounting and workflow platforms. These providers process information only on the Firm’s behalf and under commercial terms that require confidentiality, restrict use of the data to the services provided to the Firm, and prohibit use of the data for the providers’ own purposes.

AI-assisted tools. The Firm uses artificial-intelligence assistants (such as enterprise AI productivity tools) to help Authorized Personnel perform the Services, for example, to assist in preparing workpapers, reconciliations, analyses, and drafts. When Client Data is processed by such tools, it is processed under commercial terms that require confidentiality, limit use of the data to providing the service to the Firm, and prohibit the provider from using Client Data to train or improve its models. All AI-assisted work product is reviewed by Authorized Personnel before it is relied upon or delivered to a client. The Firm remains responsible for the Services regardless of the tools used to perform them.

This Section applies specifically to the Applications, in addition to the rest of this Policy.

• Authorization. An Application connects to a client’s account on a Connected Platform only after the client completes that platform’s authorization flow (such as an OAuth 2.0 consent process). The Firm never receives, requests, or stores a client’s username or password for any Connected Platform.
• Credential protection. Authorization Credentials are stored in encrypted form on Firm-controlled systems and are never written to logs, source code, or version control systems. Credentials issued to the Firm by a Connected Platform (such as a client ID and client secret) are stored securely and are accessible only to Authorized Personnel.
• Limited access and use. The Applications access only the accounts of consenting clients and are used solely to perform the Services described in Section 1.
• Revoking access. A client may revoke an Application’s access to its account at any time, either by contacting the Firm as set forth in Section 15 or directly through the connected-application or authorized-application settings the Connected Platform provides. Upon revocation, the Application can no longer access that account’s data. Revocation does not affect data lawfully retained by the Firm prior to revocation, which remains subject to this Policy. When a client disconnects an Application or the engagement ends, the Firm deactivates and deletes the stored Authorization Credentials for that connection.

Each Connected Platform is a product of its respective provider, and a client’s use of a Connected Platform is governed by that provider’s own terms of service and privacy statement.

The Firm maintains administrative, technical, and physical safeguards designed to protect Client Data, Personal Information, and Authorization Credentials against unauthorized access, use, alteration, and disclosure. The Firm’s information security program is designed to be consistent with its obligations as a provider of financial services, including the safeguards contemplated by the Gramm-Leach-Bliley Act and the FTC Safeguards Rule, and includes the following measures:

• Encryption in transit. Communications between the Firm’s systems (including the Applications) and third-party services occur over encrypted HTTPS connections using TLS 1.2 or higher.
• Encryption at rest. Authorization Credentials and sensitive files are stored in encrypted form, and Firm devices are protected by full-disk encryption.
• Access controls. Access to Client Data is restricted to Authorized Personnel on a need-to-know basis. Firm systems and devices are protected by authentication controls, including multi-factor authentication where supported.
• Personnel safeguards. Authorized Personnel are bound by confidentiality obligations and receive guidance on the proper handling of Client Data.
• Vendor oversight. Third-party service providers are selected with reasonable diligence and engaged under terms addressing confidentiality and data protection, as described in Section 5.
• Incident response. In the event of a security incident affecting Client Data or Personal Information, the Firm will investigate, take appropriate remedial action, and notify affected clients, individuals, and regulators as required by applicable law.

While the Firm employs commercially reasonable safeguards consistent with applicable law and professional standards, no method of transmission or storage is completely secure, and the Firm cannot guarantee absolute security.

The Firm does not disclose Client Data or Personal Information to third parties, except in the following limited circumstances:

• Service providers. The Firm engages the technology providers described in Section 5 to operate its practice. These providers process data only on the Firm’s behalf and under commercial terms that require confidentiality, restrict use of the data to the services provided to the Firm, and prohibit use of the data for their own purposes, including the training of machine-learning models.
• Legal and professional requirements. The Firm may disclose information where required by applicable law, regulation, subpoena, court order, or other valid legal process, or as required or permitted by applicable professional and ethical standards governing accountants. Where lawfully permitted, the Firm will notify the affected client before making such a disclosure. Tax Return Information is disclosed only as permitted by Sections 7216 and 6713 of the Internal Revenue Code.
• Client instruction. The Firm shares a client’s information with parties the client directs the Firm to share it with (for example, the client’s tax preparer, auditor, or lender), and the client is responsible for such directions.
• Corporate transactions. If the Firm is involved in a merger, acquisition, reorganization, or sale of all or substantially all of its assets, Client Data may be transferred to the successor entity, subject to confidentiality obligations at least as protective as those in this Policy and to the terms of the applicable engagement agreement.

The Firm does not sell Personal Information and does not share Personal Information for cross-context behavioral advertising.

The Firm retains client accounting records, payroll records, tax records, and workpapers for the periods required by applicable law, regulatory requirements (including IRS recordkeeping requirements), and professional recordkeeping standards, and for so long as reasonably necessary to support the Services provided and to defend the Firm’s legal rights. Website inquiry information is retained only as long as needed to respond to the inquiry and maintain the relationship.

Clients and individuals may request deletion of information the Firm holds by contacting the Firm as set forth in Section 15; the Firm will honor such requests except to the extent retention is required by law, regulation, professional standards, or the Firm’s legitimate legal interests. Data retained in routine backups is deleted in accordance with the Firm’s scheduled backup-rotation practices.

Subject to applicable law, you may request access to, correction of, or deletion of Personal Information the Firm holds about you by contacting the Firm as set forth in Section 15. The Firm will verify your identity before acting on a request and will respond within the time required by applicable law. You may opt out of Firm marketing communications at any time by using the unsubscribe mechanism in the communication or by contacting the Firm; the Firm may still send transactional or engagement-related communications.

A note on data we process for clients. Much of the Personal Information the Firm holds (for example, information about a client’s customers, vendors, or employees) is processed on behalf of the Firm’s clients in order to provide the Services. If you are an employee, customer, or vendor of a Firm client, your relationship is with that client, and requests concerning your information may need to be directed to, or coordinated with, that client.

Much of the information the Firm processes is nonpublic personal information collected in connection with providing financial services and is therefore subject to the Gramm-Leach-Bliley Act rather than the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the “CCPA”). To the extent the CCPA applies to Personal Information the Firm holds about a California resident, that resident has the right to know the categories and specific pieces of Personal Information the Firm has collected, the right to correct inaccurate Personal Information, the right to delete Personal Information (subject to legal exceptions), and the right to opt out of the sale or sharing of Personal Information. The Firm does not sell Personal Information, does not share Personal Information for cross-context behavioral advertising, and does not use or disclose sensitive Personal Information for purposes other than providing the Services. The Firm will not discriminate against anyone for exercising privacy rights. California residents may submit requests using the contact information in Section 15, and may designate an authorized agent to submit requests on their behalf.

The Website uses cookies and similar technologies for two purposes: essential cookies that make the Website function, and analytics cookies that help the Firm understand how visitors use the Website (for example, which pages are visited and for how long). Analytics information is collected in aggregate form and is not used to identify individual visitors or to serve targeted advertising.

You can control cookies through your browser settings, including blocking or deleting them; doing so may affect some Website features. If the Website’s analytics provider offers an opt-out mechanism (such as a browser add-on), you may also use that mechanism. Because the Firm does not sell or share Personal Information, the Website does not respond differently to browser “Global Privacy Control” or “Do Not Track” signals, though the Firm honors the underlying choices those signals represent by not engaging in the data sales or sharing they are designed to prevent.

The Website may contain links to third-party websites, and the Services rely on third-party products, including the Connected Platforms. The Firm is not responsible for the privacy practices, security measures, or content of any third party, and this Policy does not apply to information collected by third parties through their own products and services. The Firm encourages you to review the privacy policies of any third-party services you use.

The Website and the Services are business offerings and are not directed to, or intended for use by, anyone under the age of 18, and the Firm does not knowingly collect Personal Information directly from children. If the Firm learns that it has inadvertently received Personal Information directly from a child, it will delete that information promptly. Note that, in providing payroll or similar Services, the Firm may process records that a client maintains about its own workforce, which are handled solely on the client’s behalf as described in this Policy.

The Firm may update this Policy from time to time to reflect changes in its practices, technology, or legal requirements. The Effective Date above reflects the most recent revision. The current version will be posted on the Website, and material changes will be communicated to affected clients. A client’s continued use of the Services or authorization of an Application after such notice constitutes acceptance of the revised Policy.

Questions, concerns, or requests regarding this Policy or the Firm’s data practices (including privacy rights requests under Section 10) may be directed to:

All-In Accounting Solutions, LLC

10964 Lin Valle Dr

St. Louis, MO 63123

Phone: (314) 375-3378

Email: angelina@all-inaccounting.com

Web: www.all-inaccounting.com

This Policy is governed by the laws of the State of Missouri, without regard to its conflict-of-laws principles. Any dispute arising out of or relating to this Policy shall be brought exclusively in the state or federal courts located in the State of Missouri.

If any provision of this Policy is held to be invalid or unenforceable, the remaining provisions will continue in full force and effect. This Policy does not create and shall not be construed to create any rights enforceable by third parties, and no person other than the Firm and its clients is an intended beneficiary of this Policy. Section headings are for convenience only and do not affect interpretation.