Privacy Policy

1. Introduction

Assure Pro ("we," "our," or "us") provides practice management software for accounting firms. This Privacy Policy describes how we collect, use, and protect information when you use our platform at pro.assureone.ai and related services.

2. Information We Collect

Account Information

When you create an account, we collect your name, email address, firm name, and role. For client records, your firm stores client names, contact information, government or tax identifiers, and engagement details within the platform.

Email Data (Google and Microsoft Integration)

When you connect your Gmail or Outlook account, we access your email messages and attachments solely to display them within the Assure Pro communications hub and to enable you to save attachments to your document management system. We access:

• Email message content, headers, and metadata
• Email attachments (when you choose to save them)
• Email labels and folder structure

We do not use email data for advertising, market research, or any purpose unrelated to providing the Assure Pro service. We do not sell, share, or transfer email data to third parties except as required to operate the service (e.g., cloud infrastructure providers bound by data processing agreements).

Cloud Storage Data (Google Drive, Dropbox, and OneDrive)

When you connect a cloud storage account, we request read-only access so that your firm can bring client documents into Assure Pro without downloading and re-uploading them. For Google Drive this is the drive.readonly scope. We access:

• File and folder names, types, sizes, and modification times, for the folders you browse or select
• File content, only for files you choose to import and for files that appear in a folder you have explicitly linked to a client
• An account-level signal from your provider telling us that something in your drive has changed, so we know when to re-check a linked folder. We read file names and content only within the folders you have selected

Google Docs, Sheets, and Slides have no downloadable file of their own, so when you import one we ask Google to export a copy (as .docx, .xlsx, or .pdf) and store that copy.

We never create, modify, move, or delete anything in your cloud storage. The connection is one-way: files come in, nothing goes out. We do not scan or index your drive as a whole, and we do not use cloud storage data for advertising, market research, or any purpose unrelated to providing the Assure Pro service.

Calendar Data (Google and Microsoft)

When you connect a calendar, we read events from your primary calendar to display them in Assure Pro, and we create, update, or cancel events on that calendar when you do so from within Assure Pro. Unlike the email and cloud storage integrations, this one writes back, and only in response to an action you take. We do not access other calendars in your account.

Documents

Files you upload, save from email attachments, or import from cloud storage are stored securely in our document management system. Documents are encrypted at rest and in transit. For imported files we also record where the file came from (the provider, the provider's file identifier, and a revision marker) so that the same file is not imported twice.

Usage Data

We collect anonymized usage analytics (page views, feature usage) to improve the product. We do not track individual user behavior for advertising purposes.

3. How We Use Information

• Provide, maintain, and improve the Assure Pro platform
• Display your email communications within the platform
• Enable document storage and retrieval
• Import documents from a cloud storage account you connect, and keep a folder you have linked to a client up to date
• Display your calendar and write back events you create or change in the platform
• Send transactional notifications (engagement updates, task reminders)
• Provide AI-assisted features (thread summaries, message drafting) using your data only within the platform context
• Respond to support requests

4. Google API Services User Data Policy

Assure Pro's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

This applies to every Google integration we offer: Gmail, Google Calendar, and Google Drive. Specifically:

• We only use Google user data to provide the feature you connected it for: Gmail data for the email integration, Google Calendar data for the calendar integration, and Google Drive data for importing documents into your firm's vault
• We do not use Google user data for advertising or marketing purposes
• We do not use Google user data to train, retrain, or improve any generalized or artificial intelligence or machine learning model
• We do not allow humans to read your Google user data except with your explicit consent for support purposes, to comply with applicable law, or where required for security (such as investigating abuse)
• We do not sell Google user data, and we do not transfer it to third parties except as necessary to provide the service, comply with law, or as part of a merger or acquisition with equivalent privacy protections
• AI features process content only within the platform session and do not store AI-generated outputs as training data

Google Drive access is read-only. Assure Pro cannot create, modify, or delete anything in your Drive, and requests no scope that would allow it to.

5. Data Storage and Security

• All data is stored in encrypted databases hosted on secure cloud infrastructure (AWS)
• Data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Authentication uses industry-standard JWT tokens stored in httpOnly cookies
• Passwords are hashed using bcrypt
• Sensitive credentials (government portals, filing systems, banking, or other client-authorized credentials) are encrypted using AES-256-GCM with firm-specific keys
• Access is controlled through role-based permissions (owner, admin, staff roles with granular permissions)

6. Data Retention

We retain your data for as long as your account is active. Email data synced from Gmail or Outlook is cached to provide the communications feature and is refreshed periodically. When you disconnect an email integration, cached email data is deleted within 30 days. When you delete your account, all associated data is permanently deleted within 30 days.

Cloud storage works differently, because an imported document becomes your firm's own record. Disconnecting a Google Drive, Dropbox, or OneDrive account revokes our access to that drive and stops any further import immediately, but documents already imported stay in your firm's vault, where you can delete them individually or by deleting the account. Disconnecting a calendar stops syncing and removes the stored connection; events already written to your calendar remain on your calendar, which is yours to manage.

7. Data Sharing

We do not sell your data. We share data only with:

• Infrastructure providers (AWS, database hosting) bound by data processing agreements
• AI service providers (for thread summaries and message drafting) with data processed in-session only, not retained for training
• Law enforcement only when required by valid legal process

8. Your Rights

You can:

• Access and export your data at any time
• Disconnect email integrations (removes cached email data)
• Disconnect a cloud storage or calendar integration at any time from Settings → Integrations, which revokes our access with the provider
• Delete documents imported from cloud storage, individually or by deleting the account
• Delete your account and all associated data
• Revoke Google or Microsoft OAuth access from your provider's security settings. For Google this is the Google Account permissions page

9. Client Portal Users

If you access Assure Pro through a firm's client portal, your firm is the data controller. Your data (documents, messages, intake responses) is managed by your firm. Contact your firm directly for data access or deletion requests.

10. Changes to This Policy

We may update this policy periodically. We will notify active users via email for material changes. Continued use of the platform after changes constitutes acceptance.

11. Contact

For privacy-related questions or data requests, contact us at admin@assureone.ai.