Privacy / Security

Privacy Policy

HubSync Co. (collectively with its subsidiaries, “Company,” “the Company,” “we,” “us,” and “our,”) respects your privacy and is committed to protecting your privacy through our compliance with this Privacy Policy (the “Policy”). This Policy should be read in conjunction with our Terms of Use, into which this Policy is incorporated by reference.

This Policy is available in an accessible format upon request; if you need an alternative format, please contact us at privacy@hubsync.com

This Privacy Policy explains how HubSync processes personal information in two distinct capacities:

  • As a data processor — when processing personal data (including tax documents, financial records, and government identifiers) uploaded to the HubSync platform by or on behalf of a Client organization. In this capacity, HubSync acts solely on the Client’s instructions under the applicable agreement. The Client is the data controller responsible for the purposes and means of processing. End-users whose data is processed through a Client’s HubSync deployment should direct privacy rights requests to that Client organization in the first instance.
  • As an independent data controller — when collecting information directly from website visitors, prospective customers, and individuals who contact HubSync directly (e.g., demo requests, newsletter subscriptions). In this capacity, HubSync determines how and why your data is used, as described in this Policy.

This Policy describes:

  • The types of information we collect from you or that you may provide when you visit our website available at: https://hubsync.com/ as well as any websites and blogs directly owned by the Company (collectively, our “Website”), or any related application or software that is published, owned and operated by the company (the “Software”, and together with the Website, the “Platform”).
  • Our practices for collecting, using, maintaining, protecting, and disclosing that information.

This Policy applies to information we collect on the Platform or in emails and other electronic messages between you and the Platform, and information gathered when you interact with our advertising on third-party websites if such advertisements include links to this Policy.

This Policy does not apply to information collected by us offline or through any other means, including on any other website operated by any third party, or information collected by any third party through any application or content (including advertising) that may link to or be accessible from the Platform (for further information, see below, “Third-party Websites”).

Use of the Software and any user information associated with the Software may also be subject to the terms of separate written agreements between the Company and its contracted clients (“Clients”). When applicable, this Policy may be superseded by specific terms in the aforementioned written agreements between the Company and its Clients. If you use any materials from the Platform, you agree to be bound by the aforementioned written agreements as well as any posted guidelines and policies related to the materials you wish to use, as applicable. When applicable, if you do not agree to the terms of such applicable agreements, you will not be able to use the Software.

Please read this Policy carefully to understand our practices regarding your information and how we will treat it. If you do not agree with our policies and practices, then please do not use our Platform. By using our Platform, you agree to the terms of this Policy. This Policy may change from time to time (see below, “Changes to this Policy”). Your continued use of our Platform after we make changes is deemed to be acceptance of those changes, so please check the Policy periodically for updates.

What information does the Platform collect?

To ensure that we provide you with the best possible experience, we will store, use, and share information about you in accordance with this Policy.

We collect, use, retain, and share personal information only to the extent reasonably necessary and proportionate to the purposes described in this Policy.

If you are a HubSync employee or job applicant, please see our Notice at Collection for Employees and Job Applicants for how your personal information is collected and used.

Information You Provide to Us

HubSync processes personal information in two ways:

(a) Controller context (direct interactions with HubSync): When you visit hubsync.com, request a demo, subscribe to newsletters, register an account, or otherwise interact with HubSync directly, we collect personal information including name, email address, IP address, browser type, and other information you voluntarily provide. In this context HubSync is the data controller.

  • First and last name;
  • Email address;
  • Mailing address;
  • IP address
  • Browser type
  • Operating system

(b) Processor context (Client platform deployments): When personal information — including Financial Information (tax filings, financial documents), Social Security numbers, Taxpayer Identification Numbers, and other personal data — is uploaded to the HubSync platform by or on behalf of a Client organization, HubSync processes that data solely as a service provider acting on the Client’s instructions. If you are an end-user of a Client’s HubSync deployment, please refer to the Client’s own privacy policy for how your personal data is used.

  • Financial Information (e.g., tax filings and other personal financial documents);
  • Comments or messages provided in free text boxes; and
  • Other information you voluntarily provide.

You may provide us Personal Information when you:

  • Request information;
  • Schedule a demonstration;
  • Upload documents or other content on the Platform;
  • Subscribe to our emails or newsletters;
  • Visit our website and use our services;
  • Register for an account;
  • Contact us for support;
  • Use the Platform to message other users; and
  • Register yourself with the Platform.

The information that you provide in each case will vary. In some cases, you may be able to provide Personal Information via email, free text boxes or the Software messaging system, such as contacting the Company to request further information or messaging other users. When providing your Personal Information, please provide only relevant information and do not provide unnecessary sensitive information, such as Social Security numbers, credit card information or other sensitive personal data when it is not needed. Additionally, we may ask you to create a username and password that should only be known to you.

Moreover, as a user of the Software, you may have the opportunity to upload the documents and Personal Information of other users or individuals. When uploading such documents or Personal Information, you are solely responsible for obtaining the necessary consents and authorizations from any other users or individuals in accordance with applicable data security laws and regulations, and the Company shall not be responsible or held liable for your failure to obtain the necessary consents.

HubSync does not currently collect, store, or process biometric identifiers or biometric information, including but not limited to fingerprints, facial geometry, retinal scans, iris scans, voiceprints, or hand geometry. This applies to all users of the Platform regardless of state of residence. If this changes, we will update this Policy to describe the collection and use of biometric information before any such collection begins.

What Automated Tools Do We Use on our Website?

In addition to the information that you provide to us, we may also collect information about you during your visit to our Website. We collect this information using automated tools that are detailed below. These tools may collect information about your behavior and your computer system, such as your internet address (IP Address), the pages you have viewed, and the actions you have taken while using the Website. Some of the tools we use to automatically collect information about you may include:

  • Cookies. A “cookie” is a small data file transmitted from a website to your device’s hard drive. Cookies are usually defined in one of two ways, and we may use either (or both) of them:
    • (1) session cookies, which do not stay on your device after you close your browser, and (2) persistent cookies, which remain on your device until you delete them, or they expire.

Of course, if you do not wish to have cookies on your devices, you may turn them off at any time by modifying your internet browser’s settings. However, by disabling cookies on your device, you may be prohibited from full use of the Website’s features or lose access to some functionality.

  • Google Analytics. One of our trusted third parties is Google Analytics. The Website sends aggregated, non-Personal Information to Google Analytics for the purpose of providing us with the ability to conduct technical and statistical analysis on the Website’s performance. For more information on how Google Analytics supports the Website and uses information sent from the Website, please review Google’s privacy policy available at https://policies.google.com/technologies/partner-sites
  • Web Beacons. A Web Beacon is an electronic image. Web Beacons can track certain things from your computer and can report activity back to a web server allowing us to understand some of your behavior. If you choose to receive emails from us, we may use Web Beacons to track your reaction to our emails. We may also use them to track if you click on the links and at what time and date you do so. Some of the third-party marketers we engage with may use Web Beacons to track your interaction with online advertising banners on our Website. This information is only collected in aggregate form and will not be linked to your Personal Information. Please note that any image file on a webpage can act as a Web Beacon.
  • Embedded Web Links. Links provided in our emails and, in some cases, on third-party websites may include tracking technology embedded in the link. The tracking is accomplished through a redirection system. The redirection system allows us to understand how the link is being used by email recipients. Some of these links will enable us to identify that you have personally clicked on the link and this may be attached to the Personal Information that we hold about you. This data is used to improve our service to you and to help us understand the performance of our marketing campaigns.
  • Third-party Websites and Services. We work with a number of service providers of marketing communications technology. These service providers may use various data collection methods to improve the performance of the marketing campaigns we are contracting them to provide. The information collected can be gathered on our Website and also on the websites where our marketing communications are appearing. For example, we may collect data where our banner advertisements are displayed on third-party websites.
  • Inferred and Derived Data. Based on your interactions with our Platform, we may derive or infer information about your preferences, behavior, and usage patterns (for example, which features you use most, document processing activity, and access frequency). This derived data is used solely to improve our services and platform security, and is not used for targeted advertising.

Do I have any choices in selecting preferences for privacy?

Yes. We want to provide you with relevant information that you have requested.

If we provide subscription-based services, such as email newsletters, we will allow you to make choices about what information you provide at the point of information collection or at any time after you have received a communication from us while you are subscribed. Transactional or service-oriented messages are usually excluded from such preferences, as such messages are required to respond to your requests or to provide goods and services, and are not intended for the purposes of marketing.

We will not intentionally send you email newsletters and marketing emails unless you consent to receive such marketing information. After you request to receive these emails, you may opt out of them at any time by selecting the “unsubscribe” link at the bottom of each email. Please note that by opting out or unsubscribing you may affect other services you have requested we provide to you, in which email communication is a requirement of the service provided.

Any such communications you receive from us will be administered in accordance with your preferences and this Policy.

How can I make sure my Personal Information is accurate?

We strive to maintain and process your information accurately. We have processes in place to maintain all of our information in accordance with relevant data governance frameworks and legal requirements. We employ technologies designed to help us maintain information accuracy on input and processing.

Where we can provide you access to your Personal Information in our possession, we will always ask you for a username and password to help protect your privacy and security. We recommend that you keep your password safe, that you change it periodically, and that you do not disclose it to any other person or allow any other person to use it.

To view and change the Personal Information that you have provided to us, you can log in to your account and follow the instructions on that webpage, or contact us directly for assistance.

Does the Platform collect information about minors?

We do not intentionally seek to gather information from individuals under the age of eighteen (18). We do not target the Platform to minors, and would not expect them to be engaging with our Platform or services. We encourage parents and guardians to provide adequate protection measures to prevent minors from providing information unwillingly on the internet. If we are aware of any Personal Information that we have collected about minors, we will take steps to securely remove it from our systems.

We do not sell, use for targeted advertising, or engage in profiling of personal data of individuals we know to be under the age of eighteen (18), consistent with applicable state privacy laws including the Delaware Personal Data Privacy Act.

How does HubSync use my information?

The information we gather and that you provide is collected to provide you information and the services you request, in addition to various other purposes, including, but not limited to:

  • Assisting you with items such as personalized experiences, facilitation of product usage, and enforcement of the Terms of Use.
  • Preventing malicious activity and providing you with a secure experience.
  • Providing service and support for services you request.
  • Providing marketing communications that are effective and optimized for you.
  • Keeping you up-to-date with the latest benefits available from us.
  • Preventing unwanted messages or content.
  • Measuring the performance of our marketing programs.
  • Improve our website and services
  • Contacting you about services and offers that are relevant to you.

Automated Decision-Making Technology (ADMT)

HubSync does not currently use Automated Decision-Making Technology (“ADMT”) to make decisions that produce legal or similarly significant effects concerning consumers, such as decisions relating to employment, lending, housing, health care, or education.

If HubSync begins using ADMT for such purposes, before doing so we will:

  • Provide a Pre-use Notice describing the specific purpose of the ADMT, in plain language, before or at the point personal information is collected for that purpose;
  • Explain your right to opt out of the use of ADMT to make a significant decision about you, except where a recognized exception applies (for example, security, fraud prevention, or where a human appeal process is already available);
  • Explain your right to access information about how a specific ADMT decision about you was made, including its purpose, the output of the decision, and how you can seek human review;
  • Provide at least two methods for submitting an opt-out or access request, including at least one method that does not require you to create an account; and
  • Update this Policy to describe the ADMT’s purpose, logic, and your rights before the ADMT is used to make a significant decision about you.

We will update this section of the Policy before deploying any Automated Decision-Making Technology covered by the CCPA/CPRA, and no later than January 1, 2027, consistent with the California Privacy Protection Agency’s ADMT regulations.

How does HubSync share my information?

We will not share Personal Information with any third parties except as described in this Policy, including the following:

  • Clients. When HubSync acts as a data processor, personal data is processed on behalf of and under the instructions of the Client organization that has engaged HubSync’s services. HubSync’s data processing obligations to Clients are governed by the applicable agreement between HubSync and the Client, which includes data protection obligations consistent with applicable law. End-users whose data is processed through a Client’s deployment of HubSync should direct privacy rights requests to the Client organization in the first instance. HubSync will support Clients in responding to such requests as required by applicable law and the governing agreement.
  • Vendors and Sub-processors. We engage third-party vendors and sub-processors to assist in delivering our services. These currently include cloud infrastructure providers (Amazon Web Services), analytics providers (Google Analytics), payment processors, and email service providers. All sub-processors are contractually required to process personal data only for the purposes for which it was shared, to implement appropriate security measures, and to comply with applicable law.

Where HubSync acts as a data processor, our use of sub-processors is subject to the data protection obligations in our agreement with the applicable Client. We maintain a list of current sub-processors available upon request by contacting privacy@hubsync.com. Clients will be notified of material changes to sub-processor arrangements in accordance with the governing agreement.

  • Compliance with Laws. We may disclose your Personal Information to a third party if (1) we believe that disclosure is reasonably necessary to comply with any applicable law, regulation, subpoena, or court order: (2) to respond to duly authorized information requests from law enforcement or other governmental authorities: (3) to enforce our agreements, policies, or Terms and Conditions of Use: (4) to investigate and help prevent security threats, fraud, or other malicious activity; or (5) to respond to an emergency, which we believe in good faith requires us to disclose such information to assist in preventing the death or serious bodily injury of any person or Company employee.

There are circumstances where the Company may decide to buy, sell, or reorganize its business in selected countries. Under these circumstances, it may be necessary to share or receive Personal Information with prospective or actual partners or affiliates. In such circumstances, the Company will ensure your information is used in accordance with this Policy.

Are any of the websites linked to the Platform owned by HubSync?

No. This Policy does not apply to websites or other domains that are maintained or operated by third parties or our affiliates. Our Platform may link to third-party websites and services, but these links are not endorsements of these sites, and this Policy does not extend to them. Because this Policy is not enforced on these third-party websites, we encourage you to read any posted privacy policy of the third-party website before using the service or site and providing any information.

What if I use the Platform outside of the United States?

To provide you with our services, we store, process, and transmit information solely in the United States. We do not process or store your Personal Information in any other country. If you access or use the Platform from outside the United States, including from the European Economic Area, the United Kingdom, or Switzerland, your information will be transferred to and processed in the United States, which has not been recognized by the European Commission as providing an adequate level of data protection. For this transfer, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or other lawful transfer mechanisms. You may request a copy of the applicable transfer mechanism by contacting us at privacy@hubsync.com.

If you are a resident of a U.S. state with applicable privacy laws (including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, or Tennessee), your personal data is also subject to the rights and protections described in the ‘U.S. State Privacy Rights’ and ‘Additional Information for Residents of Specific States’ sections of this Policy.

Will this Policy change?

Possibly. If we make any changes to this Policy, a revised Policy will be posted on this webpage and the date of the change will be reported in the “Last Revised” block above. You can get to this page from any of our webpages by clicking on the “Privacy Policy” link (usually at the bottom of the screen).

How does HubSync safeguard my information?

We use reasonable technical, administrative, and physical safeguards in order to protect your Personal Information against accidental loss and from unauthorized access, use, alteration, and disclosure. However, we can never promise 100% security. You have a responsibility, as well, to safeguard your information through the proper use and security of any online credentials used to access your Personal Information, such as a username and password. If you believe your credentials have been compromised, please change your password. Please also notify us of any unauthorized use.

How long will data be retained?

We retain your personal information for as long as necessary to provide you with our services and comply with our legal obligations. We also retain your personal information for a reasonable period after you cease using our services in case you need to access or recover your account information. In determining how long to retain personal data, we consider: (1) the purpose for which the data was collected and whether that purpose has been fulfilled; (2) applicable legal, regulatory, tax, or contractual retention requirements; (3) the need to resolve disputes, enforce agreements, or maintain audit records; and (4) technical requirements related to system backups and security logs. For detailed retention periods applicable to California residents, see the ‘California Retention Periods’ section below. Where personal information — including tax and financial documents — was provided to HubSync by or on behalf of a Client organization, retention of that data is governed by the data processing agreement between HubSync and that Client; HubSync retains it for the period specified in that agreement rather than determining retention unilaterally.

Your rights under the GDPR

HubSync’s GDPR obligations differ depending on its role:

  • Where HubSync acts as a data processor (processing personal data on behalf of Client controllers), HubSync does not independently determine the lawful basis for processing — that responsibility rests with the Client as data controller, as acknowledged in the governing agreement between the parties. HubSync processes such data solely on the Client’s instructions.
  • Where HubSync acts as an independent data controller (website visitors, direct marketing contacts, prospective customers), HubSync relies on the following lawful bases under Article 6 GDPR: (1) Contractual necessity — to fulfill a request or agreement entered into directly with you; (2) Legitimate interests — platform security, fraud prevention, and direct marketing to business contacts, where those interests are not overridden by your rights; (3) Consent — for optional marketing communications, which you may withdraw at any time by contacting privacy@hubsync.com

Under the GDPR, you have the following rights:

  • The right to access your personal information
  • The right to rectify your personal information
  • The right to erase your personal information
  • The right to restrict processing of your personal information
  • The right to object to processing of your personal information
  • The right to data portability
  • The right to lodge a complaint with the data protection supervisory authority in your country of residence, place of work, or place of the alleged infringement if you believe your personal data has been processed in breach of the GDPR

To exercise any of these rights, please contact us at privacy@hubsync.com

Additional information for GDPR compliance

In addition to the above, we have implemented the following measures to comply with the GDPR:

  • We have appointed an EU Representative who serves as a contact point for supervisory authorities and data subjects in the European Union in matters relating to the processing of personal data, as required under Article 27 of the GDPR.
  • We have implemented a data breach response procedure. In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours where required by Article 33 of the GDPR. Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, as required by Article 34 of the GDPR.
  • We have provided our employees with training on the GDPR and their privacy obligations.

We are committed to protecting your privacy and complying with the GDPR. If you have any questions or concerns, please do not hesitate to contact us.

Your U.S. State Privacy Rights

In addition to the rights described above under the GDPR, if you are a resident of one of the following U.S. states, you have additional privacy rights under applicable state law. We describe these rights below and explain how to exercise them.

Important — processor context: If your personal data was provided to HubSync through a Client organization (such as your employer or an accounting firm using HubSync’s platform), HubSync processes that data as a service provider on the Client’s behalf. In that case, your privacy rights under state law run primarily against the Client (as the data controller / business), not HubSync. Please direct your request to the Client organization first. HubSync will cooperate with the Client to support fulfillment of your request as required by law and the governing agreement. If you are unsure who your data controller is, contact us at privacy@hubsync.com and we will help you identify the appropriate party.

GLBA-Covered Financial Data. Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, and Tennessee each exempt from their consumer privacy statutes personal data that is collected, processed, or disclosed in accordance with the federal Gramm-Leach-Bliley Act (“GLBA”) and its implementing regulations. Tax return documents, tax workpapers, Social Security numbers, and other financial information that HubSync processes on behalf of a Client organization in connection with that Client’s provision of tax preparation or accounting services is financial information subject to the GLBA. To the extent this data is GLBA-covered, the state consumer rights described in this section — including access, deletion, correction, and opt-out of sale, targeted advertising, or profiling — do not apply to that data under the applicable state statute. Most of the states listed above apply this exemption at the entity level for GLBA-covered financial institutions and their service providers. Oregon applies a narrower, data-level version of this exemption; see the ‘Oregon’ section below for how that difference affects your rights.

Rights Available to All U.S. Residents

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, or Tennessee, you have the right to:

  • Know / Access: Request that we confirm whether we process your personal data and obtain a copy of the personal data we hold about you.
  • Delete: Request that we delete personal data we have collected from you, subject to certain exceptions.
  • Portability: Receive a copy of your personal data in a portable, machine-readable format.
  • Opt-Out of Sale of Personal Data: Direct us not to sell your personal data to third parties. We do not sell personal data in the traditional sense; however, the sharing of certain data with advertising or analytics partners may constitute a ‘sale’ under some state laws. You may opt out using the link below.
  • Opt-Out of Targeted Advertising: Direct us not to use your personal data for targeted or cross-context behavioral advertising.
  • Opt-Out of Profiling: Direct us not to use your personal data for profiling in furtherance of decisions that produce legal or similarly significant effects. This right is available to residents of California, Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, and Tennessee. Utah and Iowa do not provide a statutory right to opt out of profiling; however, residents of those states may contact us at privacy@hubsync.com with any concerns.
  • Authorized Agent: Use an authorized agent to submit a privacy rights request on your behalf. This right is available to residents of all states listed in this Policy, not only California. See the ‘Authorized Agents’ section below for details on how HubSync verifies authorized agent requests.
  • Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights. We will not deny you goods or services, charge you different prices, or provide a lower quality of service because you exercised a privacy right.

HubSync does not currently offer any financial incentives, loyalty or rewards programs, or price or service differences in exchange for your personal information.

Additional Rights (Available in Most States — Not Iowa)

  • Correction / Rectification: Request that we correct inaccurate personal data we hold about you. (Utah residents: this right became available effective July 1, 2026 — see the Utah section below.)

How to Submit a U.S. Privacy Rights Request

To exercise any of the rights above, you may:

We will confirm receipt of your request within 10 business days, along with an explanation of our verification process and expected response timeframe. We will respond to your request within 45 days. If we need more time, we may extend this period by an additional 45 days and will notify you of the extension and the reason. Iowa residents: please see the Iowa section below — we will respond within 90 days as required by Iowa law.

To protect your privacy, we may need to verify your identity before processing your request. We will not require you to create an account with us solely to submit a privacy rights request.

Identity Verification

We do not charge a fee to verify your identity. Any additional information collected for verification purposes is used solely for that purpose and deleted promptly afterward. You do not need to verify your identity to submit an opt-out of sale/sharing request.

For requests to know or delete, we verify identity by matching at least two data points you provide against our records. For requests for specific pieces of personal information, we require a signed declaration under penalty of perjury and matching of three data points. We will deny requests we cannot verify and explain why.

If we are unable to verify your identity, we will notify you and explain the reason for denial. Verified personal information is transmitted to you using secure methods, such as an encrypted download link or your authenticated account portal.

Scope of Information for "Right to Know" Requests (California)

When you submit a verified request for the specific pieces of personal information we have collected about you, we will provide the information collected during the 12-month period preceding your request. You may ask us to provide information we collected further back, as early as January 1, 2022; we will provide it unless doing so proves impossible or would involve disproportionate effort, in which case we will give you a detailed explanation of why. We are not required to search for or provide information we collected before January 1, 2022. You may make this type of request up to twice in any 12-month period, free of charge.

How to Appeal a Denied Request

If we deny your privacy rights request, you may appeal our decision within 60 days by emailing privacy@hubsync.com with the subject line ‘Privacy Rights Appeal.’ We will respond to your appeal within 60 days. If your appeal is denied, you may submit a complaint to your state’s Attorney General or applicable data protection authority. Contact information for each state’s Attorney General is publicly available through your state government’s official website.

Note: Colorado residents have 45 days (not 60) from the date of denial to submit an appeal, and we will respond to that appeal within 45 days (not 60), as required by the Colorado Privacy Act.

Sensitive Personal Information We Collect

HubSync processes certain categories of personal information that are classified as “sensitive” under applicable U.S. state privacy laws. When sensitive personal information — including Social Security numbers, taxpayer identification numbers, and tax and financial documents — is processed through the HubSync platform, it is processed by HubSync in its capacity as a service provider / data processor acting on the instructions of the Client organization. HubSync does not use such sensitive personal information for its own independent purposes beyond providing, securing, and improving the contracted services.

The categories of sensitive personal information we collect include:

  • Government Identifiers: Social Security numbers (SSNs), taxpayer identification numbers (TINs), and other government-issued identification numbers, collected as part of tax return preparation and filing services.
  • Financial Data: Tax return documents, tax workpapers, income information, financial statements
  • Precise Geolocation: We may collect precise geolocation data (e.g., IP-based location) when you use our platform, for security and fraud prevention purposes.

We use sensitive personal information only for the following purposes:

  • Providing, operating, and improving our tax and financial document management services
  • Verifying your identity and preventing fraud
  • Complying with legal and regulatory obligations (e.g., IRS e-filing requirements)

We do not use sensitive personal information for targeted advertising or cross-context behavioral advertising. Where required by applicable law, you have the right to direct us to limit our use of sensitive personal information to purposes reasonably necessary to provide the services you requested. To exercise this right, please use the contact methods in the ‘How to Submit a U.S. Privacy Rights Request’ section.

California residents: If you wish to limit our use of your sensitive personal information beyond the purposes described above, please see the ‘California Residents’ section below or use the link: https://hubsync.com/privacy-choices

Do Not Sell or Share My Personal Information

We do not sell your personal information for money. However, the sharing of certain data with advertising technology partners (such as Google Analytics, web beacons, and embedded tracking links described in the ‘Automated Tools’ section above) may be considered a ‘sale’ or ‘sharing’ of personal information under California and other state privacy laws, to the extent that such sharing is used for cross-context behavioral advertising.

Your Opt-Out Rights

You have the right to opt out of:

  • The sale or sharing of your personal information for targeted advertising or cross-context behavioral advertising
  • The use of your personal information for targeted advertising
  • Profiling based on your personal information

Opting out of the sale or sharing of your personal information requires no more steps than opting in.

To opt out, you may use any of the following methods:

  • Click here to opt out: https://hubsync.com/privacy-choices
  • Email us at privacy@hubsync.com with the subject line ‘Opt-Out of Data Sale/Sharing’
  • Global Privacy Control (GPC): We automatically recognize and honor the Global Privacy Control (GPC) browser signal for residents of California, Colorado, Texas, Oregon, Montana, and Delaware, consistent with each state’s universal opt-out mechanism requirements. When we detect a GPC signal, we treat it as a valid opt-out request for the sale and sharing of personal information and for targeted advertising purposes, with no further action required from you, and we display an on-screen confirmation that your signal was received and applied. Residents of other states may exercise opt-out rights through the contact methods described above.

We will process your opt-out request as follows: for California residents, within 15 business days as required by the CPRA; for residents of all other applicable states, within 45 calendar days of receiving your request. For California residents, once you opt out, we will not request authorization to sell or share your personal information for at least 12 months, as required by the CPRA. For residents of other states, we will respect your opt-out preference for as long as it remains in effect.

Please note: Opting out of targeted advertising does not opt you out of all data collection. We will continue to collect data necessary to provide our services, comply with legal obligations, and ensure the security of our platform.

Additional Rights for California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

Categories of Personal Information Collected (Prior 12 Months)

We have collected the following categories of personal information from California residents in the preceding 12 months:

  • Identifiers: Name, email address, IP address, account username. Directly from you during registration or use.
  • Government Identifiers (Sensitive): Social Security numbers, taxpayer identification numbers. Directly from you or your employer/client organization.
  • Financial Information (Sensitive): Tax return documents, financial statements. Directly from you or your employer/client organization.
  • Commercial Information: Records of services purchased or obtained. Generated internally from service records.
  • Internet / Network Activity: Browsing behavior on our website, interactions with our platform, cookie data. Automatically collected via cookies and analytics tools.
  • Geolocation Data (Sensitive): Approximate location derived from IP address. Automatically collected via IP address.
  • Professional / Employment Information: Job title, employer name (if provided during registration). Directly from you during registration.

Business Purposes for Which We Use Personal Information

  • Providing, maintaining, and improving our tax and financial document management services
  • Verifying identity and preventing fraud and security threats
  • Processing transactions and sending related communications
  • Marketing and advertising our services to prospective clients (non-sensitive data only)
  • Complying with legal obligations and regulatory requirements
  • Analyzing website performance and usage (Google Analytics)

Third Parties We Share Personal Information With

  • Cloud infrastructure providers (e.g., Amazon Web Services) — for hosting and data storage
  • Analytics providers (e.g., Google Analytics) — for website performance analysis
  • Payment processors — for billing and payment processing
  • Email service providers — for transactional and marketing communications
  • Client organizations (accounting firms and tax professionals) — for service delivery

Your California Privacy Rights

In addition to the rights listed in the ‘U.S. State Privacy Rights’ section above, California residents also have:

  • Right to Know (Detailed): You may request a list of the specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business purposes for collecting or sharing it, and the categories of third parties with whom it was shared.
  • Right to Correct: Request correction of inaccurate personal information we hold about you.
  • Right to Limit Use of Sensitive Personal Information (SPI): You have the right to direct us to limit our use and disclosure of your sensitive personal information (SSNs, financial data, precise geolocation) to only what is necessary to provide the services you requested. To exercise this right, use the link below or contact us at privacy@hubsync.com.

Sensitive Personal Information — California Notice

We collect Social Security numbers, financial data (tax filings, payment information), and precise geolocation data as described in the ‘Sensitive Personal Information’ section above. We do not use this sensitive personal information for purposes other than providing our services, verifying identity, processing payments, and complying with legal obligations.

Minors’ Data (CCPA/CPRA)

In addition to the general protections described above in ‘Does the Platform collect information about minors?’, the CCPA/CPRA imposes specific consent requirements for California consumers we know to be minors:

  • Consumers age 13 to 15: We will not sell or share the personal information of a California consumer we know to be between the ages of 13 and 15 unless we have received affirmative opt-in (“opt-in”, not opt-out) consent to do so from the consumer.
  • Consumers under 13: We will not sell or share the personal information of a California consumer we know to be under the age of 13 unless we have received affirmative opt-in consent from the consumer’s parent or guardian, verified using a commercially reasonable method (such as a signed consent form or a live video call).

HubSync does not currently sell or share the personal information of any consumer we know to be under the age of 16. If this changes, we will implement the opt-in consent process described above before doing so, and will provide parents and guardians with clear instructions for exercising opt-out rights on behalf of their child.

If you are a parent or guardian and believe we have collected personal information from your child without the required consent, please contact us at privacy@hubsync.com and we will investigate and delete the information as appropriate.

Do Not Sell or Share — California

You have the right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising. To opt out:

We automatically recognize and honor Global Privacy Control (GPC) signals from California residents as a valid opt-out request.

Limit Use of Sensitive Personal Information — California

To limit our use of your sensitive personal information to core service delivery only:

  • Click the ‘Your Privacy Choices’ link in the footer of our website
  • Email: privacy@hubsync.com with subject ‘Limit SPI Request’

California Retention Periods

We retain personal information for the following periods:

  • Account and contact information: Duration of your account plus 30 days after account closure
  • Tax and financial documents: Where these documents were uploaded by or on behalf of a Client organization (e.g., an accounting or tax preparation firm) in connection with that Client’s engagement with you, retention is governed by the data processing agreement between HubSync and the Client — generally a minimum of 3 years and up to 7 years after account closure, consistent with applicable tax recordkeeping laws, regulations, or legal holds, but subject to the Client’s own retention policy and professional obligations, which control. If you are an end-user of a Client’s HubSync deployment, please direct retention questions to that Client organization in the first instance, consistent with the “Important — processor context” note above; HubSync will support the Client in responding as required by the governing agreement. If you interact with HubSync directly as a controller (e.g., as a prospective customer), you may contact us at privacy@hubsync.com to inquire about the specific retention period applicable to your information.
  • Website analytics data: 14 months per Google Analytics retention

Non-Discrimination

We will not discriminate against you for exercising any of your California privacy rights. We will not deny you goods or services, charge you different prices, provide a different quality of service, or suggest that you will receive a different price or quality of service because you exercised a privacy right.

HubSync does not currently offer any financial incentives, loyalty or rewards programs, or price or service differences in exchange for your personal information.

Authorized Agents

California residents may designate an authorized agent to make a privacy rights request on their behalf. To use an authorized agent, the agent must provide written permission signed by you, and we may verify your identity directly with you.

This right to use an authorized agent is available to residents of all states listed in this Policy, not only California, as described in the ‘Rights Available to All U.S. Residents’ section above.

Annual Review

We review this privacy policy periodically and will update it as required by applicable law or changes to our data practices. The date of the last revision is shown at the bottom of this page.

Additional Information for Residents of Specific States

The following provides supplemental information for residents of states with specific privacy law requirements. The rights and contact information in the ‘U.S. State Privacy Rights’ section above apply to all states listed below.

Virginia (VCDPA)

  • You have the rights described above, including access, correction, deletion, portability, and opt-out of sale, targeted advertising, and profiling.
  • If we deny your privacy rights request, you have 60 days from the date of our denial to submit an appeal by emailing privacy@hubsync.com with the subject line ‘Privacy Rights Appeal — Virginia.’ We will respond to your appeal within 60 days of receiving it. If your appeal is denied, you may submit a complaint to the Virginia Attorney General.

Colorado (CPA)

  • You have all rights described above. Colorado residents may also appeal a denied request within 45 days.
  • We automatically recognize and honor Global Privacy Control (GPC) signals from Colorado residents as a valid opt-out request.
  • You also have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you — including decisions related to creditworthiness, employment, housing, education, or insurance. To exercise this right, use the contact methods in the ‘How to Submit a U.S. Privacy Rights Request’ section above.

Connecticut (CTDPA)

  • You have all rights described above including the right to opt out of profiling for consequential decisions. Effective July 1, 2026, this opt-out right applies to profiling that produces a legal or similarly significant effect concerning you even where a human is involved in the final decision, not only where the decision is made solely by automated means. Following such profiling, you may ask us to explain the reasoning involved, review the personal data used, and, in certain housing-related decisions, request that the analysis be rerun after correcting the data.
  • Effective July 1, 2026, you also have the right to request: (i) a list of the specific third parties, if any, to which we have sold your personal data; and (ii) access to inferences we have derived from your personal data.
  • We do not sell sensitive personal data — including Social Security numbers, taxpayer identification numbers, and financial or health information — without your consent, consistent with Connecticut’s amended sensitive-data provisions.
  • In accordance with the Connecticut Data Privacy Act, as amended by SB 1295, we do not engage in targeted advertising to, or sell the personal data of, any consumer when we have actual knowledge or willfully disregard that the consumer is under the age of 18. This is a categorical prohibition that applies regardless of consent. If we become aware that we have processed a Connecticut resident's personal data in violation of this restriction, we will promptly stop and delete it.
  • In accordance with the Connecticut Data Privacy Act, HubSync conducts data protection assessments for processing activities that present a heightened risk of harm to consumers, including the processing of sensitive personal data, targeted advertising, sale of personal data, and profiling that produces legal or similarly significant effects. These assessments are available to the Connecticut Attorney General upon request. Beginning August 1, 2026, we also conduct a dedicated impact assessment before engaging in profiling of a Connecticut resident that produces a legal or similarly significant effect, as required by Connecticut’s amended law.

Utah (UCPA)

  • You have the rights to access, delete, portability, correction, and opt-out of sale and targeted advertising. Effective July 1, 2026, Utah added a right to correct inaccuracies in your personal data, taking into account the nature of the data and the purposes for which it is processed.
  • Note: Utah law does not require data protection impact assessments, does not provide a statutory right to opt out of profiling, and does not require businesses to honor universal opt-out signals such as Global Privacy Control.

Texas (TDPSA)

  • You have all rights described above. Texas law applies regardless of the volume of data processed.
  • HubSync processes the personal data of Texas residents as part of providing services to accounting firms and tax professionals operating in Texas.
  • We automatically recognize and honor Global Privacy Control (GPC) and other recognized universal opt-out signals as valid opt-out requests for the sale and sharing of personal information and targeted advertising, as required under the Texas Data Privacy and Security Act.
  • In accordance with the Texas Data Privacy and Security Act, HubSync conducts and documents data protection assessments for processing activities that present a heightened risk of harm to consumers, including targeted advertising, sale of personal data, profiling that produces significant effects, and processing of sensitive personal data. These assessments are available to the Texas Attorney General upon request.

We do not sell sensitive personal information — including Social Security numbers, taxpayer identification numbers, tax return documents, financial statements, and precise geolocation data — to any third party for any purpose. Processing of such data is limited to providing our services, verifying identity, and complying with applicable legal and regulatory obligations.

Oregon (OCPA)

  • Oregon’s privacy law has a broad definition of personal data, including data derived from your personal data (such as usage analytics or document processing scores).
  • GLBA exemption is narrower in Oregon. Unlike the entity-level exemption described above for other states, Oregon’s Consumer Privacy Act applies a data-level (not entity-level) GLBA exemption: only the specific data elements actually covered by the GLBA are exempt from your Oregon rights, even when HubSync is otherwise processing data in connection with a Client’s GLBA-covered engagement. Personal data that falls outside the GLBA’s coverage — for example, information collected from your direct interactions with HubSync’s website as a prospective customer — remains subject to your full Oregon privacy rights as described in this Policy. If you are an Oregon resident and have questions about whether specific data about you falls under the GLBA exemption, contact privacy@hubsync.com.
  • We automatically recognize and honor Global Privacy Control (GPC) and other recognized universal opt-out signals for Oregon residents, consistent with 2025 amendments to the Oregon Consumer Privacy Act.
  • We do not sell the personal data of any consumer we know to be under the age of 16 without first obtaining opt-in consent, consistent with Oregon’s 2025 amendments protecting minors’ data.
  • We do not sell precise geolocation data that would allow identification of a consumer’s presence at a specific location within a defined radius, consistent with Oregon’s geolocation-sale restrictions.
  • Oregon residents have the right to opt out of the sale of personal data derived or inferred from their use of the HubSync platform (such as usage analytics, processing patterns, or behavioral scores). If HubSync shares any such derived data with third parties, Oregon residents may exercise their opt-out right using the contact methods in the ‘How to Submit a U.S. Privacy Rights Request’ section.
  • In addition, Oregon residents have the right to obtain a list of specific third parties (by name, not merely by category) to whom HubSync has disclosed their personal data. To submit this request, contact privacy@hubsync.com with the subject line “Oregon Third-Party Disclosure List Request.” We will respond within 45 days.
  • Oregon residents have 45 days (not 60) from the date of denial to submit an appeal, and we will respond to that appeal within 45 days, consistent with the Oregon Consumer Privacy Act.

Montana (MTCDPA)

  • You have all rights described above. Montana’s Consumer Data Privacy Act took effect October 1, 2024. In accordance with the Montana Consumer Data Privacy Act, HubSync conducts data protection assessments for processing activities that present a heightened risk of harm to consumers, including targeted advertising, sale of personal data, profiling with legal or significant effects, and processing of sensitive personal data.
  • We automatically recognize and honor Global Privacy Control (GPC) and other recognized universal opt-out signals for Montana residents, consistent with Montana’s 2025 amendments to the Consumer Data Privacy Act.

Iowa (ICDPA)

  • You have the rights to access, delete, portability, and opt-out of sale and targeted advertising. We will respond to Iowa privacy rights requests within 90 days. Note: Iowa law does not require us to offer an appeal process for denied requests; however, as a courtesy we extend the appeal process described in the ‘How to Appeal a Denied Request’ section to Iowa residents.
  • Note: Iowa does not require a right to correction or data protection impact assessments.

Delaware (DPDPA)

  • HubSync does not knowingly collect or process personal data from individuals under the age of 18. If we become aware that we have inadvertently collected personal data from a minor, we will take prompt steps to delete it. Delaware residents under 18, and their parents or guardians, may contact us at privacy@hubsync.com to request deletion of any such data.
  • You have all rights described above, including the right to opt out of profiling.
  • We automatically recognize and honor Global Privacy Control (GPC) and other recognized universal opt-out signals for Delaware residents, as required under the Delaware Personal Data Privacy Act.
  • You have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. Under Delaware law, this includes profiling used to evaluate or make decisions regarding creditworthiness, employment eligibility, housing, health care access, education opportunities, or insurance. To exercise this right, use the contact methods in the ‘How to Submit a U.S. Privacy Rights Request’ section.
  • Delaware residents have 45 days (not 60) from the date of denial to submit an appeal, and we will respond to that appeal within 45 days (not 60), consistent with the Delaware Personal Data Privacy Act.

Tennessee (TIPA)

  • Tennessee’s Information Protection Act took effect July 1, 2025.
  • HubSync maintains a comprehensive privacy program designed to comply with applicable privacy laws, including the Tennessee Information Protection Act (TIPA). In accordance with TIPA §47-18-3204, HubSync conducts and documents data protection assessments for processing activities that present a heightened risk of harm to consumers, including targeted advertising, sale of personal data, profiling that produces legal or similarly significant effects, and processing of sensitive personal data. These assessments are available to the Tennessee Attorney General upon request. For questions about your rights under TIPA, please use the contact methods in the “How to Submit a U.S. Privacy Rights Request” section.
  • You have all rights described above.

HubSync’s technical and organizational security measures — including encrypted data storage and transit, 24/7 network monitoring, biannual penetration testing, and mandatory employee security training — are described in detail in the ‘Security Overview’ section of this Policy. Together with this Privacy Policy, these measures constitute HubSync’s bona fide privacy program as contemplated by the Tennessee Information Protection Act.

How do I contact you for more information?

We value your opinions and welcome your feedback. To contact us about this Policy or your Personal Information, please contact us at privacy@hubsync.com

Security Overview

Security Summary

HubSync is committed to providing the highest level of security for our clients and their data. As part of this commitment, we have designed and operate our privacy program to comply with the General Data Protection Regulation (GDPR), and we have achieved System and Organization Controls Type II (SOC 2 Type II) compliance, a rigorous third-party audit that evaluates whether our controls for Security, Availability, and Confidentiality operated effectively over a sustained review period.

  • Security – Controls that protect against unauthorized access, use, disclosure, alteration or damage to systems.
  • Availability – Controls that keep systems operational and available at a level that meets the highest industry standards.
  • Confidentiality – Controls that protect confidential information throughout its lifecycle from collection and processing to disposal.

To maintain our SOC 2 compliance and our GDPR program, we have deployed HubSync with a “security first” focus along with ongoing supporting controls, including:

Security Hosting

We use the most secure cloud computing environment available today – Amazon WebServices (AWS). AWS data centers and networks are architected to protect information, identities, applications, and devices. All data flowing across our platform is encrypted in transit and our databases housing customer data are encrypted at rest. The network is segmented to prevent unauthorized access. This allows us to achieve rigorous security and compliance requirements, such as data residency, protection, and confidentiality.

24/7 Network Operations Center

HubSync has a dedicated team monitoring systems 24/7, so we can quickly detect and resolve any issues that may arise in our production systems. This ensures the availability of our platform at all times. Our team uses the latest monitoring and performance software with automated alerts, robust logging, and real-time dashboards. Our infrastructure is constantly updated with the latest infrastructure and security releases, and auto-scales as usage increases during peak times (e.g., tax busy season).

Infrastructure Durability & Automation

AWS provides scalable hosting composed of AWS Regions and Availability Zones which allow HubSync to utilize multiple data centers across the United States with failover capabilities to ensure uptime and reliability. By using infrastructure as code (IaC) to manage and automate the provisioning and management of our AWS infrastructure, HubSync ensures that our systems are configured consistently, securely and can be scaled across the AWS cloud platform. We use version control to track changes to our infrastructure and regularly review and test our infrastructure automation and failover.

Threat Detection Management

We use the leading provider of threat intelligence and detection services to monitor cyber security threats and block any potential intrusion attempts. We protect our infrastructure perimeter using tools such as AWS Web Application Firewall, AWS Shield and Firewall Manager. Regular vulnerability scanning is performed by our NOC team along with 24/7 incident response support.

Penetration Testing

In addition to regular vulnerability scanning, HubSync engages 2x per year with a trusted third party to simulate cyber-attacks and test the resilience of our systems. This helps ensure the security of our platform and the data of our clients. We use techniques such as simulating attacks from various angles and testing all publicly accessible entry points to ensure that our systems are secure. We also utilize code quality tools on a daily basis to ensure our code is secure as we enhance the platform with new features.

Security Training for Employees

We mandate regular security training for all employees to ensure awareness and education of security best practices along with our policies for reporting potential threats. Our training covers the latest threats and vulnerabilities and provides hands-on exercises to help employees and developers apply what they have learned. This helps ensure the security of our platform and client data.

Overall, these measures help us ensure the security, availability, and confidentiality of our platform and client data. A full SOC2 report is available upon request. If you have any questions about the measures we have in place, please don’t hesitate to contact us at privacy@hubsync.com

Last Revision Date – 11.04.2026