Privacy Policy

1. Introduction

Financial Frontera LLC d/b/a Conecta ("we," "our," or "us") operates Conecta, a bilingual CRM for tax professionals. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

By using Conecta, you consent to the data practices described in this Privacy Policy.

2. Information We Collect

Google API Data (Limited Use)

Conecta's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not send Google user data obtained via Google APIs to third-party AI services, and our systems enforce technical controls that prevent such data from being used for AI processing, training, or model improvement.

AI Services and Data Segregation

Conecta uses artificial intelligence ("AI") features to assist users with certain workflows. To comply with the Google API Services User Data Policy (Limited Use requirements), Conecta enforces strict technical data segregation controls. Google API data is rendered directly in the application interface and is not included in any AI prompts, embeddings, summaries, or automated AI workflows.

• Data obtained via Google APIs (including Google Calendar and Google Business Profile) is explicitly tagged as Google-sourced data.
• Google-sourced data is never transmitted to, processed by, or shared with any AI services.
• AI features are available only for content that users manually provide to Conecta (for example: text input or file uploads not obtained via Google APIs).
• Any attempt to process Google-sourced data using AI services is programmatically blocked and logged.

Conecta does not use Google user data to train, fine-tune, or improve generalized AI or machine learning models.

2.1 Personal Information

• Account Information: Name, email address, phone number, business address
• Client Data: Contact information, tax returns, Social Security Numbers (SSNs), Employer Identification Numbers (EINs), financial documents
• Payment Information: Billing address, payment method details (processed securely by our payment processors)
• Communication Data: Messages, emails, and other communications with clients and team members

2.2 Technical Information

• Usage Data: How you interact with our platform, features used, time spent
• Device Information: IP address, browser type, operating system, device identifiers
• Cookies and Tracking: Essential cookies for authentication, analytics cookies, marketing pixels

2.3 Google Services Data

When you connect a Google account to Conecta, we receive only the Google account and service data needed for the features you authorize through OAuth 2.0:

• Authentication Data: Connected Google account email address and OAuth access tokens required to maintain the connection
• Calendar Data: Calendar metadata (title, description, default time zone) and calendar events (title, description, date, time, attendees) necessary to see your availability and manage events on your behalf
• Gmail Send Data: The connected Gmail or Google Workspace address and permission to send one-to-one email on your behalf when you send a normal Inbox message. Conecta does not read, search, list, or store your existing Gmail inbox messages or message contents.
• Account Information: Connected Google account email address

We do not receive any data from Google that you have not explicitly authorized through Google OAuth consent dialogs. Normal one-to-one Inbox email can be sent through Gmail when you connect it; existing SES/domain senders and Email Blasts continue to use their configured non-Gmail sending path.

2.4 Google Business Profile Data

When you connect a Google Business Profile to Conecta, we receive data from Google via OAuth 2.0 and the Google My Business API based on the permissions you grant:

• Authentication Data: Google user ID, OAuth access tokens, and refresh tokens required to maintain the connection
• Business Profile Data: Business name, location ID, address, phone number, website URL, and current hours settings (regular hours and special hours)
• Account Information: Basic profile information associated with your Google account

We do not receive any data from Google that you have not explicitly authorized through Google OAuth consent dialogs. Conecta allows tax professionals to connect their Google Business Profile in order to manage and update business hours and special hours directly from our platform. The business.manage scope is required to see, edit, create and delete your Google business listings. Conecta does not access personal Google account data and does not use this data for advertising or analytics.

2.5 Zoom Services Data

When you connect a Zoom account to Conecta, we receive data from Zoom via OAuth 2.0 and the Zoom Meeting API based on the permissions you grant:

• Authentication Data: Zoom account ID, OAuth access tokens, and refresh tokens required to maintain the connection
• Meeting Data: Meeting ID, join URL, start URL, and passcode for meetings created through Conecta appointments. We store only these meeting identifiers to display them in booking details and send them to clients
• Account Information: Basic account information associated with your Zoom account

We do not access or store meeting content, recordings, or any other meeting data beyond the meeting identifiers listed above. We do not receive any data from Zoom that you have not explicitly authorized through Zoom OAuth consent dialogs.

3. How We Use Your Information

• Provide and maintain the Conecta platform
• Process tax returns and financial documents securely
• Enable client communication and workflow automation
• Process payments and manage subscriptions
• Provide customer support and technical assistance
• Improve our services through analytics and user feedback
• Comply with legal obligations and tax regulations
• Send important service updates and notifications
• Connect Google accounts using Google OAuth to enable calendar functionality
• See availability and create, read, update, and delete calendar events in your Google Calendar to manage appointments, meetings, and client schedules
• Connect Zoom accounts using Zoom OAuth to enable automatic meeting creation for appointments
• Create, update, and optionally delete Zoom meetings when users manage appointments inside our app
• Store meeting identifiers (meeting ID, join URL, start URL, passcode) to display in booking details and send to clients

SMS Communications and Marketing

Conecta enables participating tax professionals to communicate with their customers via SMS (text messaging) using dedicated toll-free numbers assigned through our platform.

When customers provide their phone number through an online intake form, website form, onboarding form, or other electronic submission that includes an explicit consent checkbox, they agree to receive promotional and service-related SMS messages from the participating tax office.

• Message Types: Promotional offers, seasonal reminders, service announcements, and customer engagement communications.
• Message Frequency: Message frequency varies by tax office.
• Opt-Out: Customers may reply STOP at any time to unsubscribe.
• Help: Customers may reply HELP for assistance.
• Carrier Disclaimer: Message and data rates may apply.

Financial Frontera LLC d/b/a Conecta acts as the platform provider. Individual tax offices are responsible for obtaining proper consent from their customers before initiating SMS communications.

4. Information Sharing and Disclosure

4.1 We Do Not Sell Your Data

We do not sell, trade, or rent your personal information to third parties for marketing purposes.

4.2 Third-Party Service Providers

We share information with trusted third-party providers who assist us in operating our platform:

• Firebase (Google): Authentication and security services
• Google Calendar API: Calendar management, including seeing availability and managing events
• Zoom Meeting API: Meeting creation, update, and deletion for appointments scheduled through Conecta
• Neon: Secure database hosting with encryption
• AWS: Document storage, cloud infrastructure, and mass email delivery via SES
• Payment Processors: Secure payment processing
• Marketing Analytics: Google Analytics, LinkedIn Pixel, Facebook Pixel

4.3 Data Processors Outside the United States

Some third-party providers (including Google) may process data outside of the United States. We ensure appropriate safeguards are in place, such as Standard Contractual Clauses, before transferring personal information internationally.

4.4 Legal Requirements

We may disclose information when required by law, court order, or to protect our rights and the safety of our users.

5. Data Security

We use layered security controls to protect your sensitive information:

• Encryption: All data is encrypted in transit and at rest using industry-standard protocols
• Authentication: Firebase Authentication with multi-factor authentication support
• Access Controls: Organization-scoped data isolation and role-based permissions
• Infrastructure: Secure cloud hosting with AWS and Neon
• Compliance: We follow IRS Publication 4557 guidelines for tax professional data security
• Monitoring: Continuous security monitoring and regular security audits

6. Your Rights (CCPA Compliance)

As a California resident or user, you have the following rights:

• Right to Know: Request information about what personal data we collect and how we use it
• Right to Delete: Request deletion of your personal information (subject to legal and business requirements)
• Right to Opt-Out: Opt-out of the sale of personal information (we do not sell data)
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To exercise these rights, contact us at privacy@holaconecta.com.

7. Data Retention

We retain your information for as long as necessary to provide our services and comply with legal obligations:

• Active Accounts: Data is retained while your account is active
• After Suspension or Termination: Account data may generally be retained for a reasonable period after suspension or termination. Conecta may delete account data after the applicable retention period and is not required to preserve it indefinitely.
• Longer Retention: Certain information may be retained longer for backups, security, fraud prevention, payment records, legitimate business records, dispute resolution, or legal compliance
• Deletion Requests: You can request deletion of your data at any time, subject to applicable retention needs and legal or business requirements

Retention and deletion practices may vary by data type and are described further in this Privacy Policy.

8. Cookies and Tracking

We use cookies and similar technologies to enhance your experience:

• Essential Cookies: Required for authentication and security
• Analytics Cookies: Google Analytics for usage insights
• Marketing Pixels: LinkedIn and Facebook pixels for marketing analytics

You can control cookie settings through your browser preferences.

9. Children's Privacy

Conecta is designed for tax professionals and businesses. We do not knowingly collect personal information from children under 13 years of age.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

11. Google Permissions and User Controls

When you connect Google to Conecta, you grant access to specific OAuth scopes so Conecta can provide the Google functionality you enable. These scopes may include:

• Calendar Events: https://www.googleapis.com/auth/calendar.events - Used to read calendar events to check availability and prevent double-booking, and to create, update, and delete calendar events related to appointments scheduled through Conecta (including rescheduling and cancellation).
• Business Profile Management: https://www.googleapis.com/auth/business.manage - Used only when you connect Google Business Profile to manage listings and actions you request through Conecta.
• Gmail Send: https://www.googleapis.com/auth/gmail.send - Used to send one-to-one email communications to contacts from the connected Gmail account through the Conecta Inbox.
• Account Email: https://www.googleapis.com/auth/userinfo.email - Used to identify the connected Gmail account email address.
• OpenID: openid - Used as part of Google account authorization. Conecta does not request Google profile information or profile pictures for Gmail Send.
• Revoking Access: You can revoke Conecta's access at any time in your Google Account under Security > Third-party apps with account access, or by disconnecting Google inside Conecta.
• In-App Controls: Each team member can connect their own Gmail or Google Workspace mailbox. Workspace admins can control which team members can use Google-connected features through Conecta's role-based controls.
• Audit Trail: We log key connection and calendar actions (for example: connected/disconnected, appointment created/updated/deleted) so you can review activity.

Conecta's use of Google information is subject to the Google API Services User Data Policy, including the Limited Use requirements.

12. Google Data Retention and Deletion

We retain Google-derived data only as needed to provide the features you enable and for legitimate business purposes (such as security, troubleshooting, and audit logs), unless a longer period is required by law. When you disconnect Google or request deletion:

• OAuth access and refresh tokens, including Gmail send refresh tokens, are stored securely in Conecta's database for the connected user's account, revoked promptly when possible, and removed from our systems within 48 hours after disconnection or deletion.
• Cached scheduling data (such as availability results) and appointment metadata stored by Conecta (such as calendar ID and event ID for appointments created through Conecta) are deleted within 30 days unless you request earlier removal.

You can initiate deletion by contacting support@holaconecta.com. We will confirm completion within 7 business days.

13. Google Business Profile Permissions and User Controls

When you connect Google Business Profile to Conecta, you grant us access to the https://www.googleapis.com/auth/business.manage OAuth scope. We only use this permission to deliver the requested features within Conecta.

• Business Profile Management: Conecta uses this scope to see, edit, create and delete your Google business listings at your explicit request. This includes reading business metadata (name, location ID, hours) and updating regular hours and special hours when you request changes through our platform.
• Data Storage: OAuth tokens and business profile metadata are stored securely on our servers, encrypted at rest. We do not access or store personal Google account data beyond what is necessary for business profile management, and we do not share any Google Business Profile data with third parties.
• Revoking Access: You can revoke Conecta's access at any time from your Google account settings by navigating to Security > Third-party apps with account access, or by visiting myaccount.google.com/permissions.
• In-App Controls: Conecta administrators can disconnect Google Business Profile accounts, regenerate tokens, and limit which team members have access to business profile functionality.
• Audit Trail: We log actions performed on your behalf (business hours updated, profile changes made) so you can review account activity.

14. Google Business Profile Data Retention and Deletion

We retain Google Business Profile-derived data only as long as needed to provide the services you request or as required by law. When you disconnect Google Business Profile or request deletion:

• OAuth access tokens are revoked immediately and removed from our systems within 48 hours
• Cached business profile data and metadata are deleted within 30 days unless you request earlier removal
• Business hours update records and logs are retained for compliance and audit purposes but do not include sensitive business data beyond what is necessary for service delivery
• No personal Google account data is stored in our systems beyond what is necessary for business profile management

You can initiate deletion by contacting privacy@holaconecta.com. We will confirm completion within 7 business days.

15. Zoom Permissions and User Controls

When you connect Zoom to Conecta, you grant us access to specific OAuth scopes to create, update, and optionally delete Zoom meetings when users manage appointments inside our app. We only use these permissions to deliver the requested features within Conecta.

• Meeting Management: Conecta uses Zoom meeting scopes to automatically create Zoom meetings when you schedule appointments. For each meeting, we store only the meeting ID, join URL, start URL, and passcode so we can display them in booking details and send them to clients.
• Data Storage: OAuth tokens and meeting metadata are stored securely on our servers, encrypted at rest. We do not access or store meeting content or recordings, and we do not share any Zoom data with third parties.
• Revoking Access: You can revoke Conecta's access at any time from your Zoom account settings or by disconnecting the integration in Conecta Settings → Integrations.
• In-App Controls: Conecta administrators can disconnect Zoom accounts and limit which team members have access to Zoom meeting functionality.
• Audit Trail: We log actions performed on your behalf (meetings created/updated/deleted) so you can review account activity.

16. Zoom Data Retention and Deletion

We retain Zoom-derived data only as long as needed to provide the services you request or as required by law. When you disconnect Zoom or request deletion:

• OAuth access tokens are revoked immediately and removed from our systems within 48 hours
• Stored meeting identifiers (meeting ID, join URL, start URL, passcode) are deleted within 30 days unless you request earlier removal
• Meeting metadata is anonymized or deleted according to your instructions
• No meeting content or recordings are stored in our systems

You can initiate deletion by contacting privacy@holaconecta.com. We will confirm completion within 7 business days.

17. Contact Information

If you have any questions about this Privacy Policy, Google or Zoom data handling, or our data practices, please contact us:

• Email: privacy@holaconecta.com
• Address: Financial Frontera LLC, 601 E Palomar Ste #554, Chula Vista, CA, 91911
• Phone: (619) 826-8955