Privacy Policy
Effective Date: August 7, 2026 · Last Updated: October 18, 2026
1. Who We Are and What This Covers
InflowSheet LLC ("InflowSheet," "we," "us," or "our") is a Wyoming limited liability company that provides an engagement and workflow platform for CPA firms handling tax, audit, and advisory work.
This Privacy Policy explains what information we handle, why, where it lives, who else touches it, and what choices exist. It covers our website at inflowsheet.com and the InflowSheet platform (together, the "Service").
Please read Section 2 first. It determines which parts of this policy apply to you, and it is the most important thing to understand about how InflowSheet handles data.
The Service is offered to business customers in the United States. It is not offered to, or intended for, individuals or organizations in the European Economic Area, the United Kingdom, or Switzerland, and we make no representations regarding the GDPR or UK GDPR.
2. Two Different Roles: Controller and Processor
2.1 Customer Data — we are a processor
When a CPA firm ("Customer") uses InflowSheet, it uploads and generates documents and records belonging to itself and to its own clients. This is Customer Data.
- The CPA firm is the controller. It decides what to collect, why, how long to keep it, and who may see it.
- InflowSheet is the processor. We handle Customer Data only on the firm's instructions — expressed through our Terms of Service, this policy, the firm's configuration of the Service, and its use of features.
If you are a client of a CPA firm that uses InflowSheet, we process your information on that firm's behalf. We are not the right party to answer questions about why your information was collected, how long it is kept, or to action requests to access or delete it.
Please contact your CPA firm. If you contact us directly, we will refer you to them and assist them in responding.
2.2 Account and Website Data — we are a controller
For information about our customers, prospective customers, and website visitors — account registration details, support correspondence, and website usage — InflowSheet acts as a controller in its own right.
3. Information We Handle
3.1 Customer Data (processor role)
Depending on how a firm uses the Service, Customer Data may include:
- Documents and files uploaded by firm staff or by the firm's clients — tax documents, financial statements, supporting schedules, audit evidence, engagement materials, and correspondence.
- Engagement records — document requests, checklists, task and approval status, review notes, comments, and message threads.
- Signature records — documents routed for electronic signature, signer names and email addresses, and signature audit information.
- Data extracted from documents by AI-assisted features, as described in Section 5.
Because these are documents from tax, audit, and advisory engagements, they frequently contain sensitive personal and financial information — including identifiers such as Social Security numbers and taxpayer identification numbers, income and financial account information, and other information the firm's clients provide. We do not choose what goes into these documents. The firm and its clients do.
3.2 Microsoft 365 Integration Data (processor role)
Where a Customer connects the Service to its own Microsoft 365 tenant, a tenant administrator grants consent to our application's Microsoft Graph permissions. We publish the complete list rather than describing it generally.
Application permissions (the application acts without a signed-in user):
| Permission | What it allows |
|---|---|
| Sites.Selected | Access only to the specific SharePoint sites an administrator explicitly grants — not all sites in the tenant |
| Group.Read.All | Read group information used to map teams and membership |
| GroupMember.ReadWrite.All | Read and update the membership of Microsoft 365 groups, which hold Teams membership |
| Directory.Read.All | Read directory data to identify users and organizational structure |
| User.Read.All | Read user profiles to identify users and map them to roles |
| Team.Create | Create teams. This permission is included in the consent request, but the Service does not create teams; engagements are linked to private teams the Customer already has |
| Team.ReadBasic.All | Read basic properties of Teams |
| TeamMember.ReadWrite.All | Add and remove Team members for engagement collaboration |
| Channel.Create | Create channels within a team |
| ChannelMember.ReadWrite.All | Manage channel membership for engagement collaboration |
Delegated permissions (the application acts on behalf of the signed-in user, limited to what that user can already access):
| Permission | What it allows |
|---|---|
| openid | Sign the user in |
| profile | Read the signed-in user's basic profile |
| User.Read | Read the signed-in user's profile |
| Sites.FullControl.All | Act on SharePoint sites with the signed-in user's own permissions, for site and document library operations |
These permissions are shown on the Microsoft consent screen at the time of approval and remain visible in the Microsoft Entra admin center. The tenant administrator controls this access and may revoke it at any time.
3.3 Account and Usage Information (controller role)
- Account information — name, business email, phone, job title, firm name, and tenant identifier.
- Payments — we do not currently collect or process payment card data through the Service. Any billing is arranged directly under the applicable order form.
- Support and correspondence — messages you send us and records of support interactions.
- Usage and log data — IP address, browser and device information, features used, timestamps, and error and diagnostic logs.
- Website inquiries — information you submit through the contact form on our website, which is delivered to us by email.
3.4 Cookies and Tracking
We use cookies and similar technologies that are strictly necessary to operate the Service — to keep you signed in, maintain your session, and preserve security. We do not use advertising cookies, third-party analytics, tracking pixels, or tag managers on our website.
4. How We Use Information
4.1 Customer Data
We process Customer Data solely to provide the Service to the Customer, which includes: storing and organizing documents and records; operating request, review, approval, and collaboration workflows; performing AI-assisted processing at the Customer's direction (Section 5); routing documents for electronic signature (Section 6); sending transactional notifications; providing support and investigating technical problems at the Customer's request; maintaining security, preventing abuse, and creating backups; and complying with law.
We do not use Customer Data for our own purposes. Specifically:
• We do not sell or rent it.
• We do not share it for advertising, cross-context behavioral advertising, or marketing of any kind.
• We do not use it to train, fine-tune, or improve AI or machine learning models — not ours, and not any third party's.
• We do not disclose it to anyone other than the subprocessors named in Section 7 and the limited legal circumstances in Section 8.
4.2 Account and Usage Information
We use it to create and administer accounts, authenticate users, provide support, monitor and improve performance and reliability, secure the Service, communicate about the Service, and comply with law.
4.3 Marketing
We may send marketing communications to business contacts about InflowSheet. You can opt out at any time using the unsubscribe link or by contacting us. We will still send transactional and service messages, such as security notices.
5. AI Processing — What Actually Happens
The Service offers AI-assisted features including document data extraction, summarization, variance and risk indicators, and evidence mapping.
How it works. When these features run, document content is sent to Azure AI Document Intelligence and Azure OpenAI Service — services operated by Microsoft within the Microsoft Azure environment — which return extracted data, summaries, or indicators to the Service.
- Document content is transmitted to these Microsoft Azure services for processing, and is processed within the Azure environment.
- Customer Data is not used to train or improve the underlying AI models, whether by InflowSheet or by Microsoft.
- Processing occurs in the United States. See Section 9.
- Under Microsoft's standard Azure OpenAI configuration, prompts and generated outputs may be retained by Microsoft for up to 30 days for the purpose of detecting and preventing abuse and misuse. Where retained, they are accessible only to authorized Microsoft personnel under Microsoft's own controls, and are not used to train models. This retention does not apply where Microsoft has approved an exemption from abuse monitoring for the relevant resource.
- AI output can be wrong. Extractions and summaries are probabilistic and may be inaccurate or incomplete. They require human review and are not professional advice.
6. Electronic Signatures
Signature workflows are performed through DocuSign. When a document is routed for signature, the document and the signer's name and email address are transmitted to DocuSign, which handles the signing ceremony and returns the executed document and its audit record. Signature requests are sent from DocuSign's United States environment.
DocuSign processes this information as our subprocessor in support of the Service. DocuSign's own privacy practices also apply to signers who interact directly with its interface.
7. Subprocessors
We use a small number of third parties to provide the Service. Each is bound by contractual confidentiality and security obligations, and each processes Customer Data only to provide its service to us.
| Subprocessor | What it does | Data involved | Location |
|---|---|---|---|
| Microsoft Corporation Azure (compute, Azure Cosmos DB for MongoDB, Azure Files, container hosting) |
Cloud hosting, application compute, database, and file storage for the InflowSheet platform | All Customer Data | United States (East US) |
| Microsoft Corporation Azure AI Document Intelligence, Azure OpenAI Service |
AI-assisted document extraction, summarization, and analysis | Document content submitted to AI features | United States |
| Microsoft Corporation Azure Communication Services |
Transactional and notification email | Recipient email addresses and message content | United States |
| DocuSign, Inc. | Electronic signature workflows | Documents routed for signature; signer names and email addresses | United States |
We do not disclose Customer Data to any third party other than those listed above, except in the limited legal circumstances described in Section 8.
Note on your Microsoft 365 tenant. When the Service interacts with a Customer's own Microsoft 365 tenant, that tenant is the Customer's environment, not a subprocessor of ours. Content in the Customer's tenant remains under the Customer's control and governed by the Customer's own agreement with Microsoft.
We will notify Customers before adding a new subprocessor that processes Customer Data.
8. When We Disclose Information
- To the Customer. Customer Data is disclosed to the Customer firm and to the users it authorizes, according to the roles and permissions the firm configures.
- When required by law. In response to a subpoena, court order, or other lawful demand. If we receive a legal demand for a Customer's data, we will notify the Customer before disclosing unless legally prohibited, so the Customer can seek protective relief. Where lawful, we will direct the requesting party to the Customer.
- To protect rights and safety. Where necessary to investigate fraud, enforce our Terms, or protect the rights, property, or safety of InflowSheet, our customers, or the public.
- In a business transfer. If InflowSheet is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. The recipient would remain bound by this policy or one at least as protective, and we would notify Customers before their Customer Data becomes subject to a different policy.
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
9. Where Data Is Stored and Processed
Customer Data is stored and processed in InflowSheet's Microsoft Azure environment in the United States (East US region), using Azure Cosmos DB for MongoDB, Azure Files storage, and Azure container hosting operated by InflowSheet.
We want to be direct about one point, because it is easy to get wrong: when you use the InflowSheet platform, your documents are processed and stored in InflowSheet's Azure environment — they are not confined to your own Microsoft 365 tenant.
The Service also integrates with your tenant, and content that resides in your tenant stays there under your control. But the platform itself holds and processes Customer Data in our Azure environment, and that is what makes the Service work. Everything in this policy — the subprocessor list, the AI processing description, the security measures — describes that environment.
10. Security
We maintain administrative, technical, and physical safeguards designed to protect information, including:
- Encryption in transit — TLS for data moving between users, the Service, and integrated services.
- Encryption at rest — Customer Data encrypted in storage within our Azure environment.
- Tenant isolation — logical separation so each Customer's data is accessible only within that Customer's environment.
- Access controls — role-based permissions within the Service (administrator; staff in the Tax, Audit, and Consulting roles; and client roles), so users see only what their role and assignments permit.
- Scoped integration access — Microsoft Graph access limited to the permissions a tenant administrator has consented to, published in Section 3.2 and revocable at any time.
- Identity controls — authentication through Microsoft Entra ID, allowing Customers to apply their own single sign-on, multi-factor authentication, and Conditional Access policies to InflowSheet sign-in.
- Restricted production access — access to production systems limited to personnel who require it.
- Audit logging — records of user and system actions within the Service.
- Backups — encrypted backups of Customer Data, retained on a rotating basis.
We do not currently hold a SOC 2 report, ISO 27001 certification, or any other third-party security attestation, and we make no such claim. If that changes, we will update this policy.
No method of transmission or storage is completely secure. We cannot guarantee absolute security.
10.1 Security Incidents
If we become aware of a security incident involving confirmed unauthorized access to or acquisition of Customer Data, we will notify the affected Customer without undue delay and in any event within 72 hours of confirming the incident, with what we know about the incident, the data involved, and our response.
Because the Customer is the controller, notifying its own clients and any regulators is the Customer's responsibility. We will cooperate reasonably in that process.
11. Your Rights
11.1 If you are a client of a CPA firm using InflowSheet
Direct your requests to that firm. It controls your information and decides how requests are handled. We act on its instructions and will support it in responding to you.
11.2 If you are a Customer, prospective customer, or website visitor
Depending on where you live, you may have the right to access the personal information we hold about you, correct inaccuracies, request deletion, obtain a portable copy, opt out of marketing, and not be discriminated against for exercising these rights.
To exercise any of these, contact us using Section 14. We will verify your identity before acting and respond within the timeframe required by applicable law.
12. Retention
Customer Data is retained for as long as the Customer's account is active. After termination, it may be exported for 30 days and is deleted from production systems within 60 days, as described in our Terms of Service, Section 12.3. Residual copies in encrypted backups are deleted as those backups expire in the ordinary course of rotation. The Customer controls what it stores and may delete Customer Data through the Service at any time.
Account information is retained for the life of the account and afterward as required for legal, tax, and accounting purposes.
13. Children
The Service is a business tool and is not directed to children. We do not knowingly collect personal information directly from children. Documents a firm's client uploads may contain information about their dependents; that information is Customer Data, handled under the firm's instructions as described in Section 2.1.
14. Changes and Contact
We may update this policy. If we make a material change, we will update the "Last Updated" date and notify Customers by email to the account administrator or by notice in the Service before the change takes effect. Prior versions are available on request.
InflowSheet LLC
Casper, Wyoming, United States
Privacy and security inquiries: info@inflowsheet.com
If you are a client of a CPA firm that uses InflowSheet, please contact that firm first — see Section 2.1.