Strategic Financial Reporting, Inc. ("SFR," "we," "us," or "our") respects the privacy and confidentiality of clients, prospective clients, website visitors, and others who interact with our firm. This policy explains what personal information we may collect, how we use and share it, how SMS consent is handled, the safeguards and limitations associated with electronic communications and third-party technology, and the responsibilities of clients and other information sources. It applies to information collected through our website, forms, client onboarding, secure portals, and other business interactions with SFR.

1. Information We Collect

SFR may collect information you voluntarily provide, or that is reasonably necessary to respond to an inquiry or perform approved services, including your name, contact information, business or entity information, billing and payment information, and financial, bookkeeping, payroll, tax, accounting, compliance, or supporting documents. The information collected depends on your relationship with SFR and the services or information you request.

2. How We Use Information

SFR may use personal information to respond to inquiries; establish and administer client relationships; provide approved professional services; communicate about appointments, deadlines, documents, billing, account activity, and service matters; process payments; maintain business and engagement records; operate and secure our systems; coordinate approved third-party services; protect legitimate business interests; and comply with legal, regulatory, contractual, or professional obligations.

3. Confidentiality and Information Sharing

SFR treats client and personal information as confidential. Information may be disclosed when required or permitted by law, necessary to provide requested services or administer the client relationship, necessary to protect or operate SFR's business, necessary for an approved service provider to perform services, or when appropriate authorization or consent has been provided. SFR does not sell personal information.

4. Third-Party Service Providers

SFR may use third-party service providers and technology platforms to support communications, document exchange, accounting, payment processing, electronic signatures, data storage, and other business functions. Information may be transmitted to or processed by these providers when reasonably necessary to provide services or operate SFR's business. SFR does not control a third party's independent performance, availability, security practices, terms, or service interruptions.

5. SMS and Text Message Communications

6. Electronic Communications and Information Security

SFR may communicate through email, text message, secure portals, electronic signature services, telephone, video conferencing, and other electronic methods. Electronic communications can be intercepted, delayed, misdirected, blocked, corrupted, accessed by unintended recipients, or affected by technology or service failures. SFR maintains administrative, technical, and operational safeguards designed to protect personal and confidential information. Access to sensitive information is limited to individuals who require it for legitimate business purposes, and SFR uses approved methods and service providers to support secure handling, storage, and transmission of information. No electronic transmission, storage system, communication platform, or third-party service can be guaranteed to be completely secure.

7. Records Retention

SFR generally maintains engagement and business records for seven (7) years unless a different period is required or appropriate due to applicable law, regulation, litigation hold, contractual or professional requirements, or operational necessity. At the end of the applicable retention period, records may be securely destroyed, deleted, or otherwise removed in accordance with SFR policies and applicable requirements. Clients remain responsible for maintaining their own original records and documents.

8. Reliance on Information and Client Responsibility

SFR may receive and rely upon information provided by clients, authorized representatives, governmental agencies, taxing authorities, financial institutions, payroll providers, technology providers, and other outside sources in connection with its services. Unless otherwise required by applicable professional standards or a written engagement, SFR does not independently verify or guarantee the accuracy, completeness, timeliness, or reliability of information originating from a client or outside source. Clients are responsible for providing complete and accurate information, promptly disclosing material changes, reviewing information and documents prepared or presented for approval, and making final decisions, elections, representations, classifications, approvals, and instructions that remain within the client's authority and responsibility. SFR may provide information, analysis, recommendations, and professional guidance within the scope of an applicable engagement; however, the client retains final responsibility for decisions and approvals unless a written agreement expressly provides otherwise. To the fullest extent permitted by applicable law, SFR is not responsible for errors, delays, penalties, losses, or other consequences arising from inaccurate, incomplete, untimely, or misleading information supplied by a client or outside source, or from client decisions or instructions, except to the extent otherwise required by law or expressly provided in a written engagement agreement.

9. Client and User Responsibilities

Individuals are responsible for taking reasonable steps to protect their own information, devices, accounts, and access credentials. Clients are responsible for privacy, confidentiality, cybersecurity, disclosure, and data-protection requirements applicable to their own business, profession, industry, employees, customers, or operations, and for notifying SFR if additional protections are required.

10. Limitation of Responsibility and Liability

To the fullest extent permitted by applicable law, SFR is not responsible for consequential, special, incidental, indirect, exemplary, or punitive damages arising from third-party technology failures, telecommunications or internet interruptions, transmission errors or delays, unauthorized interception, security incidents outside SFR's reasonable control, or failure to use approved secure communication methods. For SFR clients, additional terms and limitations may be contained in the applicable signed engagement letter or service agreement. Nothing in this policy is intended to waive or limit any right, obligation, or liability that cannot lawfully be waived or limited.

11. Changes and Contact Information

SFR may update this policy to reflect changes in business practices, services, technology, communication methods, legal or regulatory requirements, or third-party systems. Questions regarding this policy or SFR's privacy practices may be directed to admin@strategicfinancialreporting.com or 805-306-1325.