Privacy Policy

Two kinds of people, two roles

Most of the information in Swift belongs to the firms who use it — their clients' tax records, financial statements, and signed forms. For that data, the firm decides what is collected and why, and we process it only on the firm's instructions and under our agreement with the firm. If you are a taxpayer whose case is managed in Swift, your firm is the right place to direct questions about your data; we will help them answer.

For the rest — visitors to this website, people who request a demo, and firm staff accounts — we are the party collecting the data, and this policy describes what we do with it.

What we collect

• From the website: if you request a demo or join the waitlist, your name, work email, firm name, and anything you write in the message box. With that request we also record how you reached the site: campaign tags and ad click identifiers from the link you followed, and the address of the page that referred you, without its search terms. This is kept in your browser for the length of your visit and sent only if you submit the form. Standard server logs record IP address, browser type, and pages requested.
• From firm accounts: name, email, role, sign-in activity, and the settings and content you create in the product. If your firm enables two-factor authentication or a sign-in network allowlist, we store what those features need (an authenticator enrollment, the allowed addresses).
• From clients of firms: when a firm sends you a secure link to upload documents or sign an engagement letter, we receive what you upload or sign, plus the time and IP address of the action, which the firm relies on as evidence of signature.
• Payments: when a firm charges a client card, the card number is sent directly to the firm's payment processor; Swift stores only a token, the last four digits, and the card type. When a firm pays for Swift itself, its card is handled the same way by our billing provider.

How we use it

• To run the product: sign people in, store and display case data, generate forms, send the notifications and reminders a firm configures, and process the payments a firm initiates.
• To respond to demo requests and waitlist signups. We will email you about the request; we do not add you to marketing lists you did not ask for.
• To learn which channels bring firms to us, from the referral details recorded with a demo or waitlist request. We use this in aggregate and do not send it to advertising platforms.
• To keep the service secure and reliable: detecting abuse, investigating incidents, and debugging.
• To meet legal obligations, such as tax and accounting record-keeping.

We do not sell personal information, and we do not use case data to train machine-learning models.

Who we share it with

Only service providers that run parts of the product on our behalf, each bound by contract to use the data only to provide their service to us:

• Cloud hosting and database providers, in the United States, for storing and serving the application.
• An authentication provider for sign-in, password reset, and two-factor authentication. Firms may also offer sign-in with Google, in which case Google confirms your identity to us.
• An e-signature provider for engagement letters and forms that firms send for signature.
• Payment processors for card payments, as described above.
• A transactional email provider for invitations, notifications, and reset links.

We will also disclose information if the law requires it, or to protect the rights and safety of our users or the public. If Quickly Flowing is acquired or merges, data may transfer to the successor under this same policy.

How we protect it

Each firm's data is isolated by row-level security enforced in the database, so one firm's session cannot read another's records. Social Security and employer identification numbers are encrypted at rest and shown masked unless a firm administrator has granted a user permission to reveal them; each reveal is logged. All traffic is encrypted in transit. Firms can require two-factor authentication and restrict sign-in to approved network addresses, and each user account is limited to one active session at a time.

No system is perfectly secure. If we learn of a breach affecting your data we will notify the affected firm without unreasonable delay so it can meet its own obligations, and we will notify individuals directly where the law requires it.

How long we keep it

• Firm and case data: for as long as the firm's account is active, and then for a wind-down period during which the firm can export it, after which it is deleted or anonymized. Firms may delete records sooner within the product.
• Demo and waitlist requests: until we have followed up and the request is resolved, or on request.
• Server and audit logs: for a limited period for security and debugging, then discarded.
• Billing records: as long as tax and accounting law requires.

Your choices and rights

You can ask us what personal information we hold about you, ask us to correct or delete it, or object to a use of it, by emailing hello@quicklyflowing.com. If your data is in Swift because a firm put it there, we will route the request to that firm and help them respond. Depending on where you live, you may have additional rights under state privacy laws; we honor them regardless of residence where we reasonably can.

Firm users can update their profile in the product; firm administrators can remove users and delete records.

Cookies

Swift uses cookies only to keep you signed in and to remember preferences like theme. The public website does not use advertising or cross-site tracking cookies.

Children

Swift is a business product and not directed at children. Firms may record a dependent's information as part of a taxpayer's case; that data is the firm's, handled as described above.

Changes and contact

If we change this policy in a way that matters, we will update the date above and tell firm administrators in the product. Questions go to hello@quicklyflowing.com. Our Terms of Service cover the rest of the relationship.