Privacy Policy

PPTC Group ("we", "us") provides accounting and bookkeeping services to businesses through Backbone, a private web application used only by our staff and by our business clients' authorized users. This policy explains what information Backbone collects, how we use and protect it, and the choices you have.

Information we collect

• Account information: name, work email address, role, sign-in history (date, time, IP address, browser) and authenticator enrollment for each authorized user.
• Client business records: general ledger, vendor invoices and bills, journal entries, deposits, payroll reports and related documents our clients provide or authorize us to retrieve.
• Bank account information (through Plaid): when an authorized user connects a bank account, we receive account names, masked account numbers, balances and transactions for the accounts they choose to connect.

How we use it

• To provide the client's accounting services: bookkeeping, bank and deposit reconciliation, payables, payroll entries and financial reporting.
• To secure the platform: authenticate users, detect misuse, and keep an audit trail of activity.

We do not sell personal or financial information, and we do not use it for advertising or marketing.

Bank connections and Plaid

We use Plaid Inc. ("Plaid") to connect bank accounts. Before a connection is made, the user is shown what will be accessed and must agree. By connecting an account, you authorize PPTC Group and Plaid to retrieve the information described above, and you agree to Plaid's handling of your data under the Plaid End User Privacy Policy. You can disconnect an account at any time from within Backbone or by contacting us; we then stop retrieving data and delete the connection as described under Retention.

Sharing

We share information only as needed to provide the service, with:

• the client that the records belong to, and the users that client authorizes;
• service providers that host or process data for us under confidentiality and security obligations: Microsoft Azure (hosting, storage, email delivery), Plaid (bank connections), and Anthropic (reading the text of scanned vendor invoices; bank and payroll data are not sent);
• the client's own accounting, payroll and banking systems, when the client directs us to;
• authorities, when required by law or to protect against fraud or security threats.

Security

All connections use HTTPS (TLS 1.2 or higher). Data is encrypted at rest. Every user signs in with a password and an authenticator app; sessions end when the user's network changes. Access is limited by role and by client, credentials are kept in a dedicated key vault, and activity is recorded in a tamper-resistant audit log.

Retention and deletion

• Financial records are kept for 7 years after the end of the year they belong to, to meet tax and accounting record-keeping requirements, then deleted.
• Bank connection tokens and raw bank data from Plaid are deleted within 30 days after an account is disconnected, the client ends service, or we receive a verified deletion request. Transactions already recorded in a client's books are kept as financial records.
• Audit records are kept for 7 years.

Your choices and rights

You may ask to access, correct or delete your personal information, or to disconnect a bank account, by writing to us at the address below. We will verify the request and respond within 30 days. Some records must be kept for the periods above to meet legal obligations; where that applies we will tell you.

Changes

If we change this policy, we will update the effective date above and, for significant changes, notify our clients.

Contact

PPTC Group · ryan@pptcgroup.com