Legal
Contents
Section 1
GatherDoc, Inc. (“GatherDoc,” “we,” “us,” or “our”) operates the GatherDoc document chase automation platform for accounting professionals. This Privacy Policy explains how we collect, use, and protect information in connection with our services.
GatherDoc acts as a data processor (and a CCPA “service provider”) on behalf of accounting firms (“Firms”) with respect to End Client data. The Firm is the data controller for its clients’ personal information. GatherDoc acts as a data controller for information about Firm accounts and users.
GatherDoc also operates as an auxiliary service provider as defined under Treasury Regulation § 301.7216-1(b)(2), providing document collection communications in connection with tax return preparation. In this capacity, GatherDoc uses taxpayer contact information solely for the purpose of delivering authorized document collection reminders on behalf of the subscribing Firm, and for no other purpose.
Section 2
We collect two categories of data:
Firm Account Data - Information about the accounting firm and its staff members:
| Data Type | Examples | Source |
|---|---|---|
| Account identity | Name, email address, firm name | You, at signup |
| Authentication | Login credentials (managed by Clerk) | Clerk auth provider |
| Billing | Subscription plan, billing history (card data held by Stripe) | Stripe payment processor |
| Usage data | Feature usage, chase counts, session logs | Automatically collected |
| Support communications | Emails, help requests | You, when contacting support |
End Client Data - Information about the Firm’s tax clients, imported by the Firm:
| Data Type | Examples | Source |
|---|---|---|
| Contact information | Name, email address, phone number | Firm import / Portal sync |
| Return metadata | Return type (1040, 1120-S, etc.), tax year | Firm import |
| Collection status | Readiness score, chase count, status label | GatherDoc system |
| Communication log | Message timestamps, delivery status, opt-outs | GatherDoc system |
Section 3
We use the data we collect to:
We do not use End Client data for any purpose other than providing the Service to the Firm that imported it. We do not use End Client data for marketing, advertising, or profiling.
Section 4
Our system design enforces these limits at the data model level - these fields do not exist in our database schema.
Section 5
After auto-deletion, the following non-PII metadata is retained for the Firm’s audit log:
This auto-deletion policy is a core feature of GatherDoc designed to minimize data retention and reduce compliance risk for accounting firms. The 7-day window allows for any necessary record-keeping before permanent deletion.
Firms that require longer retention of End Client contact data must maintain that data in their own practice management systems. GatherDoc is not designed or intended to serve as a long-term client contact database.
Section 6
We do not sell personal data. We do not sell, rent, or trade End Client data or Firm data to any third party for commercial purposes.
We share data only in the following limited circumstances:
Section 7
GatherDoc uses the following third-party services to operate. Each has its own privacy policy:
| Provider | Purpose | Data Shared |
|---|---|---|
| Clerk | User authentication & session management | Firm user email, name, login metadata |
| Stripe | Payment processing | Billing contact, subscription data (no card data stored by us) |
| Neon | Serverless Postgres database hosting | All application data (encrypted at rest) |
| Zapier | Webhook automation for Portal integrations | Status updates, workflow triggers |
| SendGrid | Transactional email delivery | End Client email address, message content |
| Twilio | SMS delivery | End Client phone number, message content |
Section 8
To End Clients (on behalf of the Firm): GatherDoc sends automated email and SMS messages to End Clients solely as directed by the Firm. Every outbound SMS includes a STOP opt-out instruction. Every outbound email includes the Firm’s identity and an opt-out mechanism, as required by CAN-SPAM. Opt-out requests are processed immediately and respected in all future sequences.
To Firm Users: We send transactional emails related to your account (billing receipts, password resets, important service notices). We may also send product updates and tips. You may opt out of non-transactional emails at any time.
GatherDoc does not send marketing or promotional messages to End Clients. Chase Sequences are operational messages sent at the direction of the Firm and are limited to document collection communications.
Section 9
We implement industry-standard technical and organizational security measures to protect data against unauthorized access, alteration, disclosure, or destruction, including:
No method of transmission over the internet or electronic storage is 100% secure. While we use commercially reasonable safeguards, we cannot guarantee absolute security.
Breach Notification: In the event of a confirmed data breach affecting End Client personal information or Firm account data, we will notify affected Firm customers within 72 hours of our confirmation of the breach, as required under GDPR Article 33 and applicable US state breach notification laws. Notification will be sent to the primary email address on your account and will describe the nature of the breach, the data affected, and the steps we have taken or are taking to address it.
Section 10
We retain data for as long as necessary to provide the Service and comply with legal obligations:
Upon account termination, all Firm data and any remaining End Client PII is deleted within 30 days. You may request an export of your chase history log before deletion.
Section 11
Firm Account Holders have the right to:
To exercise these rights, contact legal@gatherdoc.io. We will respond within 30 days.
End Clients who have received messages from a GatherDoc-powered accounting firm and wish to opt out, access, or delete their data should contact the accounting firm directly, as the firm is the data controller for End Client data. GatherDoc will cooperate with Firms in responding to End Client data requests.
Section 12
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
To submit a CCPA request, email legal@gatherdoc.io with the subject “CCPA Request.” We may need to verify your identity before processing the request.
Section 13
GatherDoc is primarily designed for accounting firms operating in the United States. If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the following applies:
Legal Basis for Processing: We process Firm account data based on (a) performance of our contract with you, (b) our legitimate interests in operating a secure, reliable service, and (c) your consent where required. End Client data is processed based on the Firm’s instructions as data controller.
Data Transfers: Data is stored and processed in the United States. If you are in the EEA, your data is transferred to the US under appropriate safeguards (Standard Contractual Clauses or equivalent).
GDPR Rights: EEA residents have the rights listed in Section 11 and may also lodge a complaint with their local supervisory authority.
If your firm requires a Data Processing Agreement (DPA) for GDPR compliance, contact legal@gatherdoc.io.
Section 14
GatherDoc is a professional B2B service intended for accounting firms and their staff. It is not directed at, and we do not knowingly collect personal information from, individuals under the age of 18. If you believe we have inadvertently collected data from a minor, contact us at legal@gatherdoc.io and we will delete it promptly.
Section 15
We may update this Privacy Policy periodically. If we make material changes - such as new categories of data collected or changes to how we use or share data - we will notify you by email at least 14 days before the changes take effect.
For minor changes, we will update the effective date at the top of this page. Your continued use of GatherDoc after the effective date constitutes acceptance of the updated Policy.
Section 16
For privacy questions, data requests, or to report a concern:
We aim to respond to all privacy inquiries within 5 business days and to complete data requests within 30 days.