GOESRED INC
Privacy policy
GOESRED INC (“GoesRed,” “Red,” “we,” “us,” or “our”) provides automated compliance deadline tracking and reminder systems for owner-operated bookkeeping and accounting practices. This Privacy Policy describes our standards and practices regarding the collection, processing, storage, and protection of business and personal data.
1. Roles and Scope (B2B Platform)
GoesRed provides services exclusively to businesses. We maintain a direct contractual relationship with the subscribing bookkeeping firm owner (“Bookkeeper” or “Customer”). Under applicable data protection regulations, the Bookkeeper acts as the data controller of Bookkeeper’s client records, and GoesRed operates strictly as a data processor and service provider.
Clients of the Bookkeeper do not receive accounts, credentials, or logins. If you are an individual or business client of an accounting firm using GoesRed, any inquiries regarding your information should be directed to your accountant, who maintains sole administrative control over your roster record.
2. Information We Collect
Account and Profile Information: When a Bookkeeper subscribes to GoesRed, we collect her name, firm business name, business email address, selected time zone, and her mobile phone number (verified via one-time passcode).
Client Roster Data: To operate deadline reminders, the Bookkeeper uploads or syncs client records containing client business or individual names, client email addresses, assigned statutory deadline tags (e.g., Form 941, state sales tax, quarterly estimated tax), and an optional client phone number.
Payment and Billing Metadata: All payment transactions are processed directly by Stripe. GoesRed does not receive, process, or store credit card numbers, CVVs, or bank account credentials. We retain only Stripe customer identifiers, transaction IDs, and subscription lifecycle statuses.
System and Transmission Logs: We maintain operational logs essential for delivering the service and administering our performance guarantee, including email dispatch timestamps, delivery statuses, open receipts, click timestamps, bounce notices, spam complaints, unsubscribe requests, audit records of roster modifications, and bot mitigation tokens generated by Cloudflare Turnstile.
Underwriting Compliance and Legal Assent Audit Logging: To comply with Tech E&O and Cyber insurance underwriting, regulatory non-repudiation, and fraud prevention standards, we record immutable audit logs upon checkout and return authentications. These audit entries capture the subscribing user's user ID, verified email, IP address, user-agent string, exact timestamp, and the SHA-256 cryptographic hashes of our active Terms of Service and Privacy Policy. Each subsequent login (via magic link token consumption or Google OAuth) logs an ongoing reaffirmation entry with the client IP and active policy versions into our isolated database audit tables.
3. Prohibited Data (Strict Data Minimization)
GoesRed adheres to a strict data minimization policy. We do not collect, request, or store:
- Social Security Numbers (SSNs) or Individual Taxpayer Identification Numbers (ITINs);
- Employer Identification Numbers (EINs) or federal/state tax identification numbers;
- Financial account numbers, bank routing credentials, or credit card numbers;
- Tax returns, tax workpapers, 1099s, W-2s, or payroll filings; or
- Health data, biometric records, or sensitive personal classifications.
Our ingestion infrastructure programmatically inspects uploaded spreadsheets and rejects any file containing columns labeled SSN, EIN, or TIN, or cells containing nine-digit tax identifier patterns.
4. How We Use Information
We process information strictly to provide and secure our software services:
- To maintain your firm account, authenticate sessions, and enforce tenant security;
- To calculate statutory filing deadlines based on assigned jurisdictions and frequencies;
- To transmit transactional reminder emails (ten days before, three days before, and the day of a due date) to your tracked clients on your behalf;
- To transmit weekly Monday morning digest text messages and verification codes to your verified mobile phone number;
- To meter and bill subscription quantities accurately through Stripe; and
- To measure aggregate, first-party conversion performance for our own B2B advertising campaigns upon completion of a $49 base membership purchase via Meta Conversions API and Pixel. For California visitors and visitors transmitting recognized opt-out signals (including the Global Privacy Control), GoesRed instructs Meta to apply Limited Data Use (LDU), restricting Meta to act solely as a service provider for that conversion without using the event for cross-context behavioral retargeting or lookalike modeling. This processing is strictly limited to GoesRed’s own direct subscription acquisition. We never send client names, emails, phone numbers, or roster data to Meta or any advertising platform.
5. Telecommunications and Email Privacy
Zero Automated Client Text Messages: GoesRed never sends SMS or text messages to your clients. A client phone number stored on your roster is used solely to populate a pre-formatted link on your device using the standard sms: protocol. When clicked, your device opens your native messaging application with a pre-filled draft. You retain sole control over whether to send or discard the message. The message originates from your device and your personal carrier service, not from GoesRed.
Bookkeeper Text Messages: Text messages from GoesRed are sent solely to the Bookkeeper’s verified mobile number via our dedicated 10DLC brand (GOESRED INC). These consist exclusively of weekly Monday compliance digests and security verification codes (OTP). Message and data rates may apply. Reply STOP at any time to opt out, HELP for assistance, or START to resume. We never share or sell mobile phone numbers or consent data with third parties for marketing purposes.
Client Transactional Emails: Client notification emails are dispatched through an isolated Postmark email server provisioned specifically for your firm. Emails display your firm’s name and designate your email address as the reply-to destination. Emails include direct action links and unsubscribe mechanisms. We do not subject your clients to marketing campaigns or automated sales funnels.
6. QuickBooks Online Accountant Integration
If you connect QuickBooks Online Accountant (QBOA), GoesRed requests authorization to read client contact names and email addresses from your accountant firm profile. We do not request or access individual client company files, general ledgers, invoices, payroll records, or tax identifiers. You can disconnect GoesRed at any time within your Intuit app management settings. Intuit’s independent privacy policy governs information stored in QuickBooks.
7. Service Providers and Subprocessors
We share data only with vetted infrastructure subprocessors bound by strict data protection and confidentiality agreements:
- Supabase (AWS): Secure PostgreSQL database hosting with tenant-level Row Level Security (RLS) and AES-256 encryption at rest.
- Vercel & Railway: Cloud application hosting, secure edge routing, and isolated background task execution.
- Stripe: PCI-DSS Level 1 payment processing and subscription billing.
- Postmark (ActiveCampaign): Dedicated transactional email delivery infrastructure with firm-level server isolation.
- Telnyx: Registered 10DLC telecommunications carrier for Bookkeeper digest SMS and OTP delivery.
- Cloudflare: DDoS mitigation, network edge protection, and Turnstile bot detection.
- Sentry: Server-side error monitoring with automated PII scrubbing and data masking.
- Meta Platforms: Web Pixel and Conversions API infrastructure utilized strictly for first-party acquisition attribution of Customer’s own base membership purchase under Limited Data Use restrictions where applicable. Meta receives no client roster records, client communications, or telecommunications data.
Business Transfers and Corporate Reorganizations: In the event of a merger, acquisition, corporate reorganization, financing, asset sale, or bankruptcy involving GOESRED INC., Customer and roster records may be transferred to the acquiring entity or successor in interest, subject to the protections of this Privacy Policy.
8. What We Never Do
- We do not sell, rent, monetize, or trade your data or your clients’ data.
- We do not share your client roster with other customers, advertisers, or brokers.
- We do not transmit automated text messages to your clients.
- We do not store client Social Security numbers, EINs, or financial account credentials.
9. Data Retention and Deletion
We retain your firm data and roster information for the duration of your active subscription. You may modify, edit, or delete individual client records or optional phone numbers at any time through the platform interface.
Following account cancellation or subscription termination, we retain core accounting, billing transaction records, and transmission logs only for the period necessary to comply with statutory tax obligations, resolve disputes, administer guarantee claims, or satisfy legal requirements. All other roster records are securely purged or permanently de-identified within sixty (60) days, except where automated encrypted backup system rotation cycles require a temporary post-deletion retention window before permanent purge. Customers may also request an expedited purge of their client roster data by contacting privacy@goesred.com upon account closure.
10. Security Safeguards and Incident Notification
We implement robust physical, technical, and organizational security measures, including TLS 1.3 encryption in transit, AES-256 encryption at rest, PostgreSQL Row Level Security (RLS) tenant isolation, and passwordless authentication. For a detailed description of our security controls, please review our dedicated Security policy.
Security Incident and Breach Notification: In the event of a confirmed security incident or data breach involving Customer or client personal data, GoesRed will notify affected Customers without unreasonable delay following forensic confirmation of the scope and impact of the incident, in accordance with applicable state and federal data breach notification laws, providing information regarding the nature of the incident and recommended remediation measures.
11. Your Privacy Rights
Depending on your jurisdiction (including under the California Consumer Privacy Act as amended by the California Privacy Rights Act, CCPA/CPRA), you may have the right to request access to, correction of, or deletion of your personal information, or to opt out of certain data practices. GoesRed does not sell your personal information or your clients’ personal information. Platform analytics and conversion measurement are utilized strictly for first-party B2B subscription attribution. When a user is in California or transmits a recognized browser-level opt-out signal (including the Global Privacy Control, GPC), GoesRed automatically applies Meta’s Limited Data Use (LDU) parameters, restricting data usage to first-party conversion attribution and preventing cross-context behavioral advertising or audience enrichment. You may also manage or block tracking technologies directly through your web browser preferences. We will not discriminate against you for exercising any of your privacy rights. To verify your request, we may require you to authenticate your account session or confirm details associated with your active subscription.
To exercise any privacy rights, contact us at privacy@goesred.com.
12. Contact Information
GOESRED INC
3400 Cottage Way, Ste G2 #36931
Sacramento, CA 95825
Email: privacy@goesred.com