VaretIQ Privacy Policy

VaretIQ and Variatax are software products operated by Veratiq Technologies LLC. VaretIQ provides accounting, payroll, time, banking connectivity, AI-assisted features, accountant workspaces, and related services. Variatax provides tax-preparation and e-file workflows, including provider-connected e-file services. This Privacy Policy explains how VaretIQ handles personal information when a person visits the website, creates a login, uses the application, receives communications, or interacts with support.

When a business, firm, or other organization uses VaretIQ, that organization generally controls workspace data, decides who may access it, and configures integrations. VaretIQ generally processes that data on the organization’s behalf. For account administration, billing, security, support, product operations, and direct website relationships, VaretIQ may act as a controller or business under applicable law.

Depending on use, VaretIQ may process account and profile information; company and business information; accounting and financial records; banking and transaction information; invoices, bills, expenses, budgets, inventory, payroll and time records; employee, contractor, customer, vendor, owner, and professional-user information; taxpayer and tax-identification information; documents and uploads; identity or verification documents required for an authorized provider workflow; communications and support content; subscription and billing information; authentication and security information; device, browser, network, IP, session, usage, diagnostic, cookie, and local-storage information.

Information may come directly from a user or organization, an authorized integration, an invited professional or workspace user, a payment or financial provider, an identity-verification provider, or automatically from use of the Service. Users should not send credentials, full account numbers, identity documents, or client-identifying financial details through informal or public contact channels.

Workspace data may include financial-account data, government identifiers, taxpayer information, payroll information, identity-verification documents, precise location information if a user enables a location-based capability, and other information treated as sensitive under applicable law. VaretIQ processes sensitive information only for disclosed and reasonably necessary Service, security, compliance, provider, or customer-directed purposes and obtains consent where required.

VaretIQ and its providers use cookies, local storage, and similar technologies to authenticate users, maintain sessions, remember preferences, protect against abuse, diagnose errors, and operate the Service. The application currently uses essential and service-operation technologies rather than cross-context behavioral advertising. If non-essential analytics or marketing technologies are introduced, VaretIQ will provide notice and choice where required.

When an organization authorizes banking, payment, payroll, authentication, storage, communications, AI, or other integration, information may be exchanged with that provider as necessary to deliver the requested integration. Provider terms and privacy policies may apply. Integrations controlled by the user may be disconnected where the Service supports disconnection.

Continue with Google provides basic identity information such as Google account identifier, email address, and basic profile information. Basic Google Sign-In does not authorize access to Gmail, Drive, Calendar, Contacts, or unrelated Google content. A future feature requiring additional Google scopes will use a separate authorization flow, request only reasonably necessary scopes, explain the access, and provide disconnection where technically available.

VaretIQ uses information to provide and maintain the Service; administer workspaces, accounts, subscriptions, and billing; authenticate users and enforce access controls; support accounting, payroll, time, reporting, authorization, reconciliation, close, and related workflows; deliver authorized integrations; provide support; detect, investigate, and prevent fraud, abuse, and security incidents; comply with legal, regulatory, tax, accounting, audit, and provider obligations; diagnose problems; maintain reliability; improve the Service; and establish, exercise, or defend legal claims.

AI-assisted features are optional and not included in every plan. When a user enables or invokes one, information reasonably necessary for the request may be processed through authorized providers acting under contractual controls. Unless clearly disclosed otherwise and authorized as required, VaretIQ does not use Customer Content to train a third-party foundation model for the provider’s independent purposes. AI output is a suggestion for human review, not a professional determination or an instruction to file, pay, post, classify, or submit with appropriate human review.

VaretIQ may disclose information to processors and service providers that host, secure, support, communicate, analyze, or operate the Service; people and professionals authorized by an organization; providers for integrations a user enables; legal authorities or others where required by law or reasonably necessary for safety, fraud prevention, legal claims, or Terms enforcement; and parties to a merger, financing, acquisition, reorganization, or sale of assets subject to appropriate protections.

VaretIQ does not use Customer Content for third-party advertising. VaretIQ does not currently sell personal information for money or share Customer Content for cross-context behavioral advertising. If practices change in a manner that requires consent or opt-out rights, VaretIQ will provide the applicable notice and choice before or when required.

VaretIQ uses safeguards designed for the nature of the Service and information processed. Safeguards may include encryption in transit, protections for sensitive information at rest, tenant separation, row-level and role-based access controls, individual accounts, multi-factor and step-up authentication, session controls, audit logging, monitoring, bot protection, restricted administrative access, vendor controls, and incident-response procedures. Controls may vary by configuration and technical environment.

No method of transmission or storage is completely secure. VaretIQ does not claim a certification or attestation it has not obtained. Users are responsible for secure devices and networks, individual credentials, appropriate roles, access reviews, prompt revocation, and notice of suspected compromise. When an incident requires notification, VaretIQ provides notice as required by law and applicable contracts; not every security event triggers notice.

VaretIQ provides a 30-day post-cancellation export period, deletes or de-identifies active account data within 90 days after termination, and allows backups to expire within approximately 35 days after active-system deletion. VaretIQ may retain records longer only when required by state or federal law or reasonably necessary for security, fraud prevention, disputes, audits, tax, payroll, accounting, compliance, or a documented legal hold.

Depending on location and subject to legal thresholds, roles, exceptions, and verification, a person may have rights to confirm processing; access, correct, delete, or obtain a portable copy of personal information; opt out of certain targeted advertising, sales, or profiling; limit or withdraw consent for certain sensitive-data processing; use an authorized agent; and appeal a request decision.

When personal information is in an organization’s workspace, VaretIQ generally processes it for the organization and may direct the request to that organization or assist it in responding. Requests and appeals may be submitted through the published privacy-request channel. VaretIQ may verify identity and authority and may retain or withhold information where permitted for security, fraud prevention, legal compliance, accounting, audit, tax, dispute resolution, or backup purposes. VaretIQ will not discriminate against a person for exercising an applicable privacy right.

The Service is intended for business and professional use and is not directed to children. VaretIQ does not knowingly create accounts for children under 13. An organization may place limited information about employees’ or contractors’ dependents or beneficiaries, including minors, into authorized payroll, benefits, tax, or record-keeping workflows. In that context, VaretIQ processes the information on the organization’s instructions and the organization is responsible for lawful collection and required notices or consents.

VaretIQ is operated from the United States. Information may be processed in the United States or another country where VaretIQ or its providers operate. Where applicable law requires a transfer mechanism or safeguard, VaretIQ will use an appropriate mechanism.

VaretIQ may update this Policy as the Service and law evolve. Material changes receive additional notice before taking effect where required. Privacy questions, requests, appeals, and concerns may be submitted through the published VaretIQ privacy or contact page, including privacy@varetiq.com.