Privacy policy

CPArelay is operations software for CPA firms, operated by Seveninblue LLC. This policy explains what data we hold, how we use it, and the choices you have. We aim to collect only what running the product requires.

What we store

• Account data — your firm name and contact details, and the email address and hashed password of each user on the account.
• Client records — the names, addresses, and contact details you enter for the clients you serve.
• Engagement data — the projects, to-dos, document requests, approvals, signature records, time entries, invoices, proposals, and payment records you create.
• Uploaded files — documents you and your clients exchange, and your firm logo.

Payments

Online card and bank payments are processed by Stripe through its hosted checkout. Card and bank details are entered on Stripe's pages and never reach CPArelay's servers. If you connect your own Stripe account, the API keys you provide are encrypted before being stored.

Email

We send transactional email — invoices, receipts, reminders, signature requests, password resets, and similar — through Resend. We do not send marketing email from your data.

No third-party tracking

CPArelay does not load third-party analytics, advertising networks, or session-replay scripts, and we do not sell your data. The only outside services that receive your data are the ones named above that we need to operate the product (Stripe for payments, Resend for email).

Security

Traffic to CPArelay is encrypted in transit with TLS. Sensitive payment credentials you provide are additionally encrypted at the application layer. Access to your account requires authentication, with optional two-factor authentication available in your settings.

Usage data and cookies

We keep basic server logs (IP address, browser, pages visited, timestamps) so we can keep the service running, debug issues, and protect against abuse. We use a small number of first-party cookies — to keep you signed in, remember your preferences, and protect against abuse. We do not use third-party advertising or analytics trackers, and we don't use your content to train AI models — ours or anyone else's.

Data retention

We retain your account data for as long as your account is active. When you cancel, we keep your data for 30 days so you can change your mind, then delete it. You can request immediate deletion at any time. Backups may persist for up to 90 days after deletion before being overwritten. Some records (like billing history) may be retained longer when required for tax or legal compliance.

Your rights

Regardless of where you live, you can: access your data, export it, correct inaccuracies, and request deletion. Email [email protected] and we will respond within a reasonable timeframe. If you're in California, the EU/UK, or another region with additional privacy rights (GDPR, CCPA, etc.), you have the same rights described above plus any additional ones granted by local law.

Children

CPArelay is not intended for anyone under 18, and we don't knowingly collect data from minors.

Legal disclosure

We may disclose information if legally required (subpoena, court order) or to protect against fraud or harm. When we can, we'll notify the affected user first.

Changes

If we update this policy, we'll change the date at the top and, for material changes, notify you by email.

Contact

Questions about this policy? Reach us at [email protected]. See also our Terms of Service, Cancellation, and Refund policies.