Privacy Policy

Effective Date: January 1, 2024 | Last Updated: May 13, 2026 (portal section added)

At Take Flight Business ("we," "our," or "us"), we are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website takeflightbs.com or use our services. By accessing or using our website, you agree to this Privacy Policy.

If you have any questions or concerns about this Privacy Policy, please contact us using the information provided in Section 10 below.

1. Information We Collect

A. Personal Information

We may collect personal information that you voluntarily provide to us when you:

• Complete a contact form or request a consultation
• Subscribe to our newsletter or other communications
• Use our tax savings calculator or other interactive tools
• Engage with our services

This personal information may include:

• Name, email address, phone number, and company information
• Billing and payment information when you engage us for services
• Business details provided through our tools (e.g., revenue, entity type)

B. Non-Personal Information

We may collect non-personal information automatically when you visit our website. This information may include:

• IP address, browser type, device type, and operating system
• Information about how you interact with our website (e.g., pages visited, time spent)

We collect this information using cookies, web beacons, and similar technologies. See Section 4 for more details on our use of cookies.

2. How We Use Your Information

We may use the information we collect for the following purposes:

• To provide services: Process your requests and deliver services you have requested
• To communicate: Respond to inquiries, send service-related updates, and provide information about our services
• To improve our website and services: Analyze usage trends to enhance user experience
• For marketing purposes: With your consent, send newsletters, promotions, and updates about our services
• To comply with legal obligations: Fulfill any legal or regulatory requirements

3. Client Portal — Additional Data Practices

If you create an account in our secure client portal at /portal, additional information is collected, used, and shared as described below. As a paid tax preparer, we are classified as a "financial institution" under the Gramm-Leach-Bliley Act (GLBA), and we follow the safeguards outlined in IRS Publication 4557 and the FTC Safeguards Rule.

A. Account & profile data

• Email address, name, password (stored hashed by Firebase Authentication), MFA factor (phone number if you enroll a second factor)
• Business information you provide during onboarding (entity type, service interest, revenue range, business address)

B. Tax & financial data (handled by integrated providers)

• TaxDome. When linked, your tax documents, signed forms, and organizer responses live in TaxDome. We do not store these in our own database — we display references to items in your TaxDome workspace and provide a single-sign-on link.
• QuickBooks Online. If you choose to connect QuickBooks, we receive read-only OAuth tokens and pull Profit & Loss and Balance Sheet reports on demand. Your QuickBooks credentials never reach our servers; the tokens stay encrypted in our database and you can revoke them at any time from your portal.
• Stripe. Payment card numbers, ACH details, and payment authorization are collected by Stripe's hosted checkout. Take Flight never sees or stores card data — our PCI scope is the lowest tier (SAQ-A). We retain payment metadata (amount, date, engagement reference) for accounting and tax purposes.
• SignWell / DocuSign (when used). If your engagement requires KBA-backed e-signature (e.g., IRS Form 8879), signature workflows are handled by the e-sign provider. We store the signed document reference, completion timestamp, and IP address for audit.
• Plaid (optional, when used). If you connect a bank account, Plaid's Link UI collects your bank credentials directly — they never reach our servers. We store only an access token (encrypted) and the resulting transaction records.

C. In-portal messages and attachments

Messages you send through the portal, including any files you attach, are stored in our Firestore + Storage infrastructure with strict access controls — only you and our staff can read them. Messages are encrypted in transit and at rest. Retention is 7 years post-engagement-termination to match IRS records-retention guidance.

D. Engagement & consent records

When you accept an engagement letter via click-to-accept, we record: the consent text shown, the timestamp, your IP address, and your browser user-agent string. This serves the "intent to be bound" requirement under E-SIGN and UETA for non-IRS digital signatures.

E. Audit logs

For compliance with IRS Publication 4557 and the FTC Safeguards Rule, we log security-relevant events including sign-in attempts, MFA enrollments, role changes, document accesses, and webhook events from integrated providers. Audit logs are retained for 7 years and are accessible only to designated admins.

F. What we do NOT do in the portal

• We do not sell or share any portal data with advertisers, data brokers, or marketing partners.
• We do not use AI services on identifiable customer data without your explicit consent.
• We do not retain tax documents past the IRS 7-year retention window without your written instruction.

4. Sharing Your Information

We do not sell or rent your personal information to third parties. However, we may share your information in the following situations:

• With service providers: We may share information with trusted third-party service providers who assist us in delivering our services (e.g., payment processors, IT service providers).
• For legal purposes: We may disclose your information if required by law, regulation, or legal process, or if we believe disclosure is necessary to protect our rights or the safety of others.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction.

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our website. Cookies are small data files stored on your device that help us understand how you use our site.

Types of cookies we use:

• Essential cookies: Required for basic site functionality, such as remembering your cookie choice and keeping you signed in to the client portal.
• Analytics cookies: Help us understand how visitors interact with our website (Google Analytics and Firebase Analytics). These are set only if you accept them.

We do not use advertising or marketing cookies. We run no ad pixels, remarketing tags, or cross-site advertising trackers.

If you choose Decline on our cookie banner, we do not load analytics at all — no Google Analytics or Firebase Analytics data is collected from your visit. You can change your mind by clearing this site's data in your browser, which brings the banner back. You can also control cookies through your browser preferences.

6. Data Security

We take reasonable measures to protect your personal information from unauthorized access, use, or disclosure. Our security measures include:

• SSL/TLS encryption for data transmitted through our website
• Secure cloud infrastructure with access controls
• Regular security assessments

While we strive to use commercially acceptable means to protect your personal data, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access and correction: You have the right to access and correct the personal information we hold about you.
• Data deletion: You may request that we delete your personal information, subject to legal obligations.
• Opt-out: You may opt out of receiving marketing communications at any time by using the unsubscribe link in our emails or contacting us directly.
• Do Not Track: Our website does not currently respond to "Do Not Track" browser signals.

8. Third-Party Links

Our website may contain links to third-party websites or services that are not operated by us (e.g., QuickBooks for accounting software, or a scheduling tool if we link to one). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

9. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time. If we make significant changes, we will post a notice on our website and update the "Effective Date" above. Your continued use of our website after any changes indicates your acceptance of the revised policy.

10. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at: