Privacy Policy

1. Information we collect

• Account information — your name, email address, role, and the credentials (password and/or passkey) used to sign in.
• Information you enter into the Service — client, grant, and financial records, submissions and their attachments, tasks and notes, and personnel information. For some clients this includes sensitive personal data about their employees (for example, compensation and, in limited cases, Social Security numbers) that our staff enter to perform the engagement.
• Usage and device data — basic technical information such as IP address, browser type, and timestamps, and an append-only audit log of actions taken in the Service, kept for security and accountability.
• Cookies— see “Cookies and sessions” below.

2. How we use information

• to provide, operate, and secure the Service;
• to perform the bookkeeping, grant-tracking, and reporting work our clients engage us for;
• to authenticate users, prevent and investigate unauthorized access, and maintain an audit trail;
• to send transactional messages (for example, sign-in security codes, password resets, and task notifications); and
• to comply with legal, tax, and audit obligations.

3. Cookies and sessions

The Service uses a single, essential session cookie to keep you signed in securely. It is strictly necessary for the Service to function. We do not use advertising or third-party tracking cookies.

4. How we share information

We do not sell your information. We share it only as needed to run the Service and our business:

• Service providers we rely on to operate Umbrella HQ — for example, cloud application and database hosting, transactional email delivery, error monitoring, and, for optional assistive features, an AI provider — acting on our behalf and permitted to use the data only to provide their service to us.
• The relevant clientand its authorized representatives, with respect to that client’s own data.
• Legal and safety — when required by law, or to protect our rights, our clients, or the security of the Service.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

[Confirm the specific sub-processors and any data-processing terms with counsel].

5. How we protect information

We use role-based access controls so users see only the clients and data they are authorized for, encrypt data in transit, and keep an audit log of changes. Sensitive fields such as Social Security numbers are access- restricted within the Service. No system is perfectly secure, but we work to protect information using reasonable administrative and technical safeguards.

6. Data retention

We retain information for as long as needed to provide the Service and to meet our legal, tax, professional, and audit obligations, after which it is deleted or archived. [Set specific retention periods with counsel].

7. Your choices and rights

You can update your profile and account settings within the Service. If you are an individual whose personal information is held in Umbrella HQ and you would like to access, correct, or delete it, contact us using the details below; because much of the data is held on behalf of our clients, we may direct certain requests to the relevant client. [Add any state/federal privacy-law rights that apply].

8. Children’s privacy

The Service is a business tool and is not directed to children, and we do not knowingly collect personal information from children.

9. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the effective date above and, where appropriate, notify users within the Service.

10. Contact

Questions or requests about privacy? Contact Umbrella Bookkeeping at [contact email] or [mailing address].