Privacy Policy

Information we collect

• Account information — name, email address, phone, title, and profile photo.
• Client content — documents, messages, form responses, and other materials you upload or submit.
• Engagement data — engagements, deliverables, invoices, meetings, and performance metrics related to your work with CMA.
• Usage data — basic technical information needed to operate and secure the Service.

QuickBooks data

When an authorized CMA administrator connects QuickBooks Online, we access accounting data — such as invoices, customers, and financial summary reports — solely to display financial dashboards to CMA staff and to create or sync invoices initiated within the Service. We store only the data necessary to provide these features, we do not sell it, and we do not share it with third parties except the service providers listed below. An administrator can disconnect QuickBooks at any time from the Integrations page, which removes our stored access tokens.

How we use information

• Provide, maintain, and improve the Service.
• Deliver consulting engagements, share deliverables, and communicate with you.
• Generate invoices and financial reporting.
• Send service-related notifications and summaries.
• Protect the security and integrity of the Service.

How information is shared

We share information only with service providers that help us operate the Service, under confidentiality obligations: Supabase (database, authentication, and file storage), Vercel (application hosting), Resend (transactional email), and Intuit QuickBooks (accounting). We do not sell personal information. We may disclose information if required by law.

Data security

Access is restricted by role and by organization: each client can access only their own organization’s data, enforced at the database level. Data is encrypted in transit. We take reasonable measures to protect information, though no method of transmission or storage is completely secure.

Data retention

We retain information for as long as your account is active or as needed to provide the Service and meet legal, accounting, and reporting obligations. You may request deletion of your data by contacting us.

Your choices

You may review and update your profile in the Service, and you may request access, correction, or deletion of your information by contacting us at the address below.

Cookies and similar technologies

The Service uses cookies and equivalent browser storage strictly to keep you signed in, remember the organization workspace you last viewed, and protect against cross-site request forgery. We do not use advertising cookies and we do not run third-party analytics on the authenticated portal. The public marketing landing page may set a small number of essential cookies; you can decline non-essential cookies in your browser settings without breaking the Service.

Your California privacy rights (CCPA / CPRA)

California residents have the right to request disclosure of the categories and specific pieces of personal information we have collected, to request deletion, to correct inaccurate information, and to opt out of any sale or sharing of personal information. CMA does not sell or share personal information for cross-context behavioral advertising. To exercise any of these rights, email privacy@colemanma.com; we’ll verify the request and respond within the timeframe required by applicable law.

EU / UK residents (GDPR / UK-GDPR)

If you are in the European Economic Area or United Kingdom, you have rights of access, rectification, erasure, restriction of processing, portability, and objection regarding your personal information. The lawful basis for our processing is either the performance of our engagement contract with you or our legitimate interest in operating the Service securely. You may withdraw consent or lodge a complaint with your local supervisory authority at any time.

Children

The Service is intended for business clients of Coleman Management Advisors and is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has submitted information through the Service, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date above.

Contact

Questions about this policy? Email privacy@colemanma.com.