Privacy Policy

1. Overview & Scope

NSBC (“NSBC,” “we,” “our,” or “us”), operated by CareBear Books and hosted at boxbok.com and app.boxbok.com, provides practice management software purposefully built for CPA practices, accounting firms, and bookkeeping professionals operating in Washington State.

This Privacy Policy explains how personal and business data is collected, processed, encrypted, and maintained across the NSBC platform, including our marketing website, application portal, document exchange system, client spreadsheet import tools, and automated deadline tracking features.

By registering for an NSBC workspace, inviting team members or clients, or accessing the client portal, you acknowledge the data handling practices described in this policy.

2. Data Controller vs. Data Processor Roles

Under modern privacy frameworks and standard accounting industry safeguards:

• NSBC as Data Controller: NSBC acts as a Data Controller for primary account details provided by accounting firm administrators and team members (such as practitioner name, email address, practice billing details, and direct support tickets).
• NSBC as Data Processor: For all confidential client records, tax identification numbers, financial statements, filing histories, payroll summaries, and documents uploaded by the firm or by the firm’s end-clients, the accounting firm is the Data Controller, and NSBC acts strictly as a Data Processor. We handle client data solely under the direction of the accounting firm administrator.

3. Information We Collect

We collect information only as necessary to provide dependable practice workflow automation and secure document collaboration:

A. Accounting Firm Account Information

• Practitioner Profiles: Full name, professional email address, telephone number, job title, and firm role (Administrator, Staff, Preparer).
• Firm Profile: Practice legal name, physical office address, Washington business licenses, and practice preferences.
• Subscription & Billing Data: Plan selection (Starter or Growth), payment status, and transaction history. Payment card processing is handled securely through Level 1 PCI-DSS compliant processors; raw credit card numbers are never stored on NSBC servers.

B. Client Records Uploaded by the Firm

• Client Entity Details: Business names, entity structures (LLC, PLLC, S-Corp, C-Corp, Sole Proprietorship), DBA designations, and primary business contacts.
• Filing Identifiers: Washington State Unified Business Identifiers (UBI), Department of Revenue (DOR) tax reporting cadences (monthly, quarterly, or annual), Secretary of State annual report renewal months, Employment Security Department (ESD) account numbers, and Labor & Industries (L&I) risk class and reporting intervals.
• Federal Tax Data: Federal Employer Identification Numbers (EINs) and tax return types (e.g., Form 1120-S, 1065, 1040, 941).

C. Client Portal & Document Exchange Files

• Financial & Tax Documents: Tax returns, W-2s, 1099s, bank reconciliations, profit-and-loss statements, receipts, and supporting schedules uploaded directly by accounting staff or through the end-client portal.
• Portal Communication: Secure messages, clarification notes, and task comments exchanged between firm staff and business clients.

D. Technical, Device & Audit Logs

• Immutable Activity Logs: In keeping with professional accounting standards, our systems maintain audit logs of document uploads, document downloads, task status modifications, user invitations, and authentication attempts.
• Technical Telemetry: IP addresses, browser types, device identifiers, and session timestamps used solely for security monitoring, fraud prevention, and session maintenance.

4. How We Use Practice & Client Data

We process data exclusively for legitimate operational purposes:

• Automated Deadline Tracking: Calculating statutory filing deadlines across Washington DOR, SOS, ESD, L&I, and the IRS for up to two years ahead based on assigned service types.
• Client Portal Delivery: Providing end-clients with secure, role-restricted access to their specific documents, invoices, and messaging threads.
• Invoicing & Practice Operations: Generating one-time or recurring service fee invoices, tracking payment statuses, and maintaining the firm’s internal task board.
• Optional NSBC Team Backup: If your firm explicitly requests tax-season workload assistance via an in-app task hand-off, authorized NSBC support personnel review only the files relevant to that specific delegated task.
• Platform Security: Monitoring authentication integrity, detecting unauthorized access, and validating multi-tenant isolation boundaries.

5. Security, Isolation & Encryption

We employ rigorous technical and organizational measures designed to protect accounting workpapers and client records:

• Encryption in Transit: All HTTP connections are strictly forced to TLS 1.2 or TLS 1.3 with HTTP Strict Transport Security (HSTS).
• Encryption at Rest: All database storage, uploaded client documents, and backups are encrypted at rest using industry-standard AES-256 encryption.
• Strict Multi-Tenant Isolation: Data from different accounting firms is logically and cryptographically partitioned. Staff from one practice can never view, query, or access another practice’s clients or files.
• Role-Based Access Control (RBAC): Within each practice, administrators configure staff permissions, ensuring team members access only the clients and services assigned to them.

6. Client Portal Privacy

The NSBC Client Portal is designed with strict boundaries to ensure privacy for your accounting clients:

• Each end-client invited by your firm logs in with individual credentials.
• End-clients can view only documents, messages, and invoices explicitly tied to their own business entity.
• Clients cannot view the firm’s other clients, internal firm notes, or work items marked as private to staff.
• When clients upload documents, files land directly in their secure designated directory, eliminating unencrypted email attachments.

7. Data Storage & Retention

All data is hosted within certified, physically secure U.S. data centers compliant with SOC 2 Type II and ISO 27001 standards.

We retain practice information and client documents for the duration of your active subscription or free trial. If a subscription is terminated:

• The firm has a 30-day grace period to export client lists, task histories, and document repositories via our export tools.
• Following the grace period, data is scheduled for systematic purging and permanent deletion from production databases in accordance with our backup retention schedule.

8. Sub-Processors & Third-Party Services

NSBC partners only with reputable enterprise infrastructure vendors under strict data processing agreements:

We will never disclose firm or client information to government entities or law enforcement except where strictly compelled by a valid subpoena, court order, or search warrant, and we will give prompt written notice to the affected firm where legally permitted.

9. Your Rights & Data Export

Under Washington State privacy provisions and federal standards, accounting firms and their clients have clear rights regarding their data:

• Right of Access & Portability: Export your full client roster, service mappings, and deadline schedules as spreadsheets at any time.
• Right to Rectification: Edit, correct, or update client entity data, UBI numbers, filing frequencies, or contact details directly in the app.
• Right to Deletion: Delete individual client records, document files, or request complete account termination and tenant data erasure.

10. Contact Information & Privacy Officer

If you have any questions about this Privacy Policy, your firm’s data, or our security protocols, please contact our team: