Privacy Policy

Effective date: October 16, 2026

Thomas E. Scott CPA PLLC ("the Firm," "we," "us") provides tax, accounting, bookkeeping and payroll services. This Privacy Policy explains how we collect, use, share, protect and delete personal information through our website, client portal and applications, including when you connect a bank or financial account through Plaid.

1. Information We Collect

• Information you give us: name, address, email, phone, Social Security or taxpayer identification numbers, date of birth, tax documents, income and payroll information, business financial records, and identity verification documents.
• Financial account information through Plaid: when you choose to connect an account, we receive, with your permission, information such as account and routing details, account names and types, balances, and transaction history.
• Information collected automatically: IP address, browser and device type, pages visited, and login times, used for security and to operate our services.

2. How We Use Your Information

We use your information only to:

• Prepare tax returns and provide accounting, bookkeeping, payroll and advisory services you engage us for
• Categorize transactions and reconcile your accounts
• Verify your identity and secure your account
• Communicate with you about your engagement
• Meet legal, regulatory and professional obligations

We do not sell your personal information, and we do not use it for advertising. We do not use or disclose tax return information for any purpose other than preparing your return without your written consent, as required by Internal Revenue Code §7216.

3. Bank Connections Through Plaid

We use Plaid Inc. ("Plaid") to connect your financial accounts. By connecting an account, you consent to Plaid collecting your financial data from your institution and sharing it with us, as described in the Plaid End User Privacy Policy. You can disconnect an account at any time by contacting us or through Plaid's consumer portal at my.plaid.com. When you disconnect, we stop retrieving data and delete stored account data under Section 8.

4. QuickBooks Online Integration and Intuit Data

If you connect your QuickBooks Online company to our integration (see our QuickBooks integration page), this section describes how we handle the data we access from Intuit. It supplements the rest of this policy.

• Authorization. We connect to QuickBooks Online only after you authorize us through Intuit's secure OAuth 2.0 flow. We receive an encrypted access token and refresh token — we never receive or store your Intuit username or password.
• What we access. With your authorization, we read accounting information from your QuickBooks Online company, which may include your company profile and settings; financial reports (profit & loss, balance sheet, cash flow); accounts receivable and payable; sales, customers, products, and services; and payroll summary information where applicable. We request only the access needed to provide the service.
• How we use it. We use QuickBooks data solely to provide the services you request — such as financial reporting, benchmarking, cash-flow analysis, and bookkeeping automation — and to support the accounting and advisory work we perform for you.
• Storage and security. Intuit tokens and any retrieved data are encrypted in transit and at rest and are accessible only to authorized personnel. We do not sell, rent, or share QuickBooks data with third parties for advertising or marketing, and we do not use it for any purpose other than providing the service to you.
• Retention and deletion. We retain QuickBooks data only as long as needed to provide the service and to meet our professional and legal record-retention obligations. When you disconnect (see our Disconnect page), your tokens are revoked and removed. You may request deletion of QuickBooks data we hold, subject to applicable legal and regulatory retention requirements, by contacting us.
• Intuit's role. Your QuickBooks Online account is provided by Intuit, Inc. and remains subject to Intuit's own privacy policy and terms. Our use of Intuit data complies with Intuit's developer and platform agreements.

5. Consent

We ask for your consent before we collect your information. You consent to bank connections through the Plaid Link screen, and to our services through your signed engagement letter, including any IRC §7216 consent forms. You may withdraw consent at any time; withdrawal does not affect processing already completed or records we must keep by law.

6. How We Share Information

We share information only:

• With service providers that help us deliver our services (for example, tax software, accounting and payroll platforms, secure cloud storage and Plaid), under contracts that require them to protect it and use it only for our services
• With taxing authorities and government agencies when filing on your behalf or as required by law
• With others you direct us to in writing (for example, your lender or attorney)
• When required by law, subpoena or professional standards

7. How We Protect Information

We maintain a written information security program under the FTC Safeguards Rule and IRS Publication 4557, including multi-factor authentication, encryption in transit and at rest, role-based access limited to staff who need it, staff training, vendor oversight, and incident response procedures. Client documents containing personal information are processed only in secured, Firm-controlled systems. See our Security page.

8. Retention and Deletion

We keep information only as long as needed to provide services or as required by law. Bank data obtained through Plaid is kept only while your connection and engagement are active and is deleted within 30 days after you disconnect, withdraw consent or the engagement ends. Tax returns and workpapers are kept for 7 years as required by professional standards and tax law. See our Data Retention page.

9. Your Choices and Rights

You may ask to access, correct or delete your personal information, or withdraw consent, by contacting us below. We verify your identity and respond within 30 days. Records we are legally required to keep will be retained for the required period and then deleted. Depending on your state of residence, you may have additional rights under state privacy laws. You may unsubscribe from our newsletter at any time using the link in any email.

10. Website Forms and Cookies

Information submitted through our website contact form is transmitted to us by email for the sole purpose of responding to your inquiry. Please do not submit Social Security numbers, account numbers, or other highly sensitive data through the website form — use our secure client portals instead. This website does not use advertising or analytics cookies. Your display preferences (light or dark theme, and whether you have dismissed the privacy notice) are saved in your browser's local storage; they stay on your device and are never sent to us. Embedded third-party content (such as Google Maps) may set its own cookies subject to that provider's privacy policy.

11. Children's Privacy

Our services are not directed to children under 13, and we do not knowingly collect information from them online. Information about dependents is collected only from a parent or guardian to prepare their tax return.

12. Changes to This Policy

We may update this Policy. The effective date above shows when it last changed, and material changes will be communicated to active clients.

13. Contact Us

Thomas E. Scott CPA PLLC
145 E. University Blvd., Tucson, AZ 85705
Email: tscott@tescottcpa.com · Phone: (520) 908-6180