Privacy Policy

PROPIO PRIVACY NOTICE Version: 2026-11-09 Last updated: November 9, 2026 Effective date: November 9, 2026 1. SCOPE AND ROLES Propio Inc. provides software for accounting, bookkeeping, tax planning, invoicing, payments, payroll and related communications. This notice applies to our websites and apps and explains our handling of personal information about firm personnel, business users, employees, contractors, other people whose information is provided to us, and people who contact us. An accounting firm or business (a Customer) may provide information about its clients or workers even when those people do not have a Propio account. For records we process on that Customer's behalf, its instructions, agreements and privacy obligations also apply. We are separately responsible for our own account administration, security and other processing described here. The role depends on the information and purpose, not simply on whether a person signs in. Workers are not treated as commercial Customers merely because they use a portal. This notice is not a payment mandate, payroll-provider agreement, consent to disclose tax-return information where a separate consent is required, or consent to electronic-only W-2/1099 or pay-statement delivery. Those matters use their own disclosures and authorizations. 2. INFORMATION WE HANDLE AND ITS SOURCES We may receive information directly from you, from the firm or business you work with, from your employer, from authorized connected accounts and service providers, and through use of the Services. It can include: • Account and contact details, identity and role information, invitations, organization memberships, preferences and authentication information. • Financial, accounting, transaction, invoice, payment and bank-account information supplied through the relevant authorized workflow. • Tax and payroll records, including identifiers, pay, withholding, employment details, hours, benefits, deductions, tax forms and supporting documents. • Documents, imports, messages, support requests, feedback and instructions, including information submitted to AI features and the resulting outputs. • Device and usage data, such as IP address, browser/device characteristics, cookies, logs, interface interactions and diagnostic information. Analytics and session-replay tools may help us understand and troubleshoot app use where enabled and permitted. They do not authorize unrelated use of your financial or tax information. • Agreement evidence, such as the document version and hash, the person and capacity accepting, displayed language, controls selected, date/time, IP address and user agent. Provide sensitive identifiers and bank details only through the designated secure fields or provider flows, not ordinary chat, email or support messages. Never give us another person's online banking credentials. 3. PURPOSES We use information to provide and administer the Services; connect authorized accounts; process requested records and workflows; provide available reports, payroll, invoicing and support features; deliver operational communications; maintain agreement evidence; protect security and prevent fraud; debug and improve the Services; comply with legal obligations; and establish, exercise or defend legal claims. Marketing communications, where permitted, are subject to applicable consent requirements and the choices described below. We do not sell personal information or share it for cross-context behavioral advertising. We do not use financial or tax-return information for advertising. Any aggregated or de-identified information used for analysis or improvement must not identify an individual, Customer or end-client. 4. AI FEATURES AI features process information to provide functions such as categorization, document extraction, summaries, recommendations and assisted workflows. They can send relevant input to AI service providers. Propio does not use Customer Data, including tax-return information, to train generative AI models. We use AI providers under applicable terms that prohibit using that data to train their models and limit retention to what is necessary for the relevant service. Our commercial DPA also addresses this processing. AI output can be wrong or incomplete. The responsible person must review inputs, outputs and consequential instructions within their role. Authorized automations do not create legal authority to act for someone, sign an agreement, debit an account or disclose data. Applicable rights regarding automated processing remain available under law; contact us as described below to raise a concern or request information. 5. DISCLOSURES AND ACCESS We disclose information as needed to providers of hosting, security, authentication, AI processing, bank connectivity, payment processing, payroll, communications, analytics and other contracted functions. Providers receive information needed for their functions and are subject to applicable contractual or provider-term protections. A provider may also have a direct relationship with an account holder under its separately accepted terms. The relevant flow identifies those providers and their applicable notices. Customers may request the sub-processor information described in the DPA. We make Customer-controlled records available to the appropriate Customer and authorized people according to their actual roles and lawful instructions. Employers and firms may access worker information needed for their services; workers see the records made available to them in their own role. Reseller billing and support do not imply unrestricted access to banking information, tax identifiers or other sensitive records. Any additional access must have the required authority and comply with the applicable agreements. We may disclose information to comply with law or legal process, protect rights and safety, prevent fraud or security incidents, enforce agreements, or in a corporate transaction subject to applicable protections. We may disclose information at a person's lawful direction or with a separately required consent. Accepting app terms is not blanket permission for these activities where another legal basis or consent is required. 6. SECURITY AND RETENTION We maintain administrative, technical and physical safeguards designed to protect information. No system is perfectly secure. SOC 2 Type II audit work is underway; this notice does not represent completed certification. We keep information as needed for the Services and applicable contracts, security, recordkeeping, disputes and legal obligations. Retention depends on the record and purpose. Agreement evidence may remain after account closure to establish the applicable terms and decisions. Payroll and tax records may require longer retention or access than ordinary account data. Deletion requests are subject to those requirements. When information is no longer needed, we take reasonable steps to delete or de-identify it. Signed export, retention and record-access commitments continue to apply. 7. CHOICES AND RIGHTS Depending on applicable law, you may have rights to access, correct, delete or obtain a copy of information, object to or opt out of certain processing, use an authorized agent, appeal a request decision where applicable, and exercise rights without unlawful discrimination. Some financial or tax information is subject to specific federal rules rather than every state privacy right. We honor the rights that apply. Contact privacy@joinpropio.com. We may verify identity and authority before responding. For records controlled by your firm or employer, we may direct the request to that organization and assist it. We handle requests about information for which Propio is independently responsible. A worker does not need to accept a commercial contract to make a privacy request. You can opt out of marketing email using the message's unsubscribe option or by contacting us. Operational, security and legally required messages may continue where permitted. Ordinary app messages and marketing choices do not change a separately recorded electronic tax-delivery election. 8. COOKIES AND SIMILAR TECHNOLOGIES We use cookies and similar tools to operate the Services, remember choices, analyze usage and improve them. Browser settings can limit cookies, though some functions may be affected. Where legally required, we honor recognized opt-out preference signals and provide required controls. Our systems may not respond to every browser "Do Not Track" setting. 9. CHILDREN AND NON-APP WORKERS The apps are intended for people eligible under our agreement and are not directed to children under 13. We do not knowingly collect information directly from children under 13. An employer or firm may lawfully provide records about a worker who does not use an app, including a minor worker; that is different from offering that worker an app account. Contact us about information provided directly by a child so we can take appropriate action. 10. LOCATION AND CHANGES Information may be processed in the United States and other locations where our providers operate, subject to applicable law and contractual safeguards. A Customer must obtain any required authority for the data it provides. We may update this notice and will give notice or obtain consent where law requires. Material agreement changes follow the agreement's notice rules. 11. CONTACT Privacy questions and requests: privacy@joinpropio.com. Legal notices: legal@joinpropio.com. Propio Inc., 1100 NE Campus Parkway Ste 200, Seattle, WA 98105.

Privacy policy