Privacy Policy

Last updated: May 29, 2026

1. Overview

BOA ("we," "our," or "the Service") takes the privacy and security of your financial data seriously. This policy describes what data we collect, how we protect it, how we use it, and your rights regarding your data.

2. Data We Collect

Category	Examples	Purpose
Account	Email address, hashed password	Authentication and account management
Financial Profile	Filing status, state, AGI, tax liability, DOB	Tax strategy calculations
Business Data	Entity names, EINs, revenue, expenses, employee salaries	Entity structure optimization and strategy generation
Income Data	W-2 amounts, K-1 distributions, rental income, capital gains	AGI calculation, bracket placement, strategy sizing
Retirement Data	Account types, balances, contributions	Contribution maximization strategies
Trust Data	Trust names, values, beneficiaries	Estate planning strategies
Usage Data	API access logs, audit trail entries	Security monitoring, audit compliance

3. Data We Do NOT Collect

• We do not use analytics scripts, tracking pixels, or third-party cookies
• We do not sell, rent, or share your data with third parties for marketing purposes
• We do not use your data to train AI models
• We do not retain data after account deletion

4. How We Protect Your Data

• Encryption at rest: Your business and financial data is encrypted on disk using AES-256-GCM authenticated encryption. The encryption key is held separately from the encrypted data.
• Encryption in transit: All connections use TLS 1.2+
• Per-user data isolation: Each user's data is stored in a separate encrypted data store. No user can access another user's data.
• Password security: Passwords are hashed using scrypt with OWASP-recommended parameters (N=16384, r=8, p=1). We never store plaintext passwords.
• Session security: JWT tokens in HttpOnly, Secure, SameSite=Lax cookies. CSRF protection on all state-changing requests.
• Rate limiting: API rate limiting prevents brute force attacks. Account lockout after repeated failed login attempts.
• Audit logging: All data access is logged in an append-only audit trail per user.

5. Third-Party Integrations

If you choose to connect third-party services (QuickBooks, payroll providers, banking, document scanning), data flows are governed by those providers' privacy policies. All integration vendors are SOC 2 Type II certified.

Integration	Data Shared	Vendor Privacy
QuickBooks (Intuit)	OAuth token; BOA reads financial data	intuit.com/privacy
Finch (Payroll)	OAuth token; BOA reads employee/salary data	tryfinch.com/privacy
Plaid (Banking)	Link token; BOA reads account balances and transactions	plaid.com/legal
Veryfi (OCR)	Uploaded document images; deleted within 24 hours	veryfi.com/privacy

Raptor (AI Governance)Business context (entity types, revenue ranges, filing status) for governed strategic analysisInternal service — data processed but not retained

No integration is required to use BOA. All integrations are opt-in.

AI Governance Disclosure: When the Raptor governance engine is connected, BOA may send summarized business context (entity types, revenue ranges, filing status, and your questions) to the Raptor service for governed strategic analysis. This data is used to generate responses and is not retained after processing. Core tax calculations, alerts, and recommendations run locally on the BOA server and never leave the system. Raptor governance is optional — BOA functions fully without it.

6. Raptor Governance

BOA uses the Raptor governance engine for strategy validation and audit trail generation. When strategies are generated, a summary of the analysis (strategy count, savings total, filing status, state) is sent to the Raptor service for governance evaluation. No raw financial data (SSN, EIN, account numbers, salary amounts) is sent to Raptor. Raptor produces an audit attestation that is returned to your BOA account.

7. Data Retention

• Active accounts: Data is retained for as long as your account is active.
• Deleted accounts: All data is permanently deleted upon account deletion. This includes financial data, audit logs, and encryption keys. Deletion is immediate and irreversible.
• Backups: Encrypted backups are retained for up to 30 days after deletion for disaster recovery, then permanently purged.

8. Your Rights

• Access: You can export all your data at any time (JSON or encrypted PDF).
• Correction: You can edit any data in your account at any time.
• Deletion: You can delete your account and all associated data at any time through the app settings.
• Portability: Data exports are in standard JSON format, compatible with any system.

9. Children

BOA is not intended for use by individuals under 18 years of age. We do not knowingly collect data from minors.

10. Changes

We may update this Privacy Policy from time to time. Material changes will be communicated via the Service. The "Last updated" date at the top reflects the most recent revision.

11. Contact

Questions about this Privacy Policy may be directed to privacy@boa.aaservent.com.