Privacy policy
This draft describes the intended privacy terms for 11OneDock, a workspace for accounting firms and their authorized employees and clients, operated by Tony Wallace individually from Florida, United States. The software operator is separate from 11One Accounting and from the firm that provides your professional services. Florida is the confirmed operating location; this does not establish a registered entity, registered address or contractual choice of law. The final contracting identity, retention policy and effective date still require review.
Information handled by the service
Depending on the features your firm uses, the service handles account names and email addresses, firm membership and access roles, client and engagement records, accounting reports and transactions, documents and workpapers, requests, messages, review decisions, time records and audit history. Account authentication and technical operations also generate session, device, request and security information.
Only enabled and authorized connections can supply provider data. Selecting a provider or seeing its name in settings does not mean an account is connected. Do not send passwords, authenticator codes, full payment-card details or provider secrets through ordinary messages or document uploads.
Why information is used
Information is used to operate authorized firm workspaces, authenticate users, enforce access controls, organize client work, preserve supporting evidence, support review and delivery, reconcile permitted time and financial records, provide support, and investigate errors or misuse. Proposed policy: customer content is not sold or used for targeted advertising.
Your accounting firm and the software operator
Your firm determines which client information it enters, who is assigned to the work, and which materials it shares with clients. Contact the firm about the accuracy, professional use or retention of its accounting records. The software operator handles account administration and technical service operations. The respective legal roles and any required data-processing agreement must be confirmed for the applicable service and jurisdiction before commercial release.
Connected services and payment links
Authorized integrations may retrieve accounting, email, calendar, file or time information from the connected provider. Requested permissions are shown during the provider’s authorization flow. Disconnecting stops future authorized retrieval through that connection; it does not automatically delete records already imported into the workspace or the provider’s own records.
The intended payment-link feature sends users to a payment page hosted by QuickBooks or another explicitly identified provider. That provider handles payment entry and processing under its own terms. A link does not authorize 11OneDock to charge an account. This feature is not represented as active by this policy draft.
Who may receive information
Access is limited according to firm membership, client assignments and the materials deliberately shared with recipients. The service uses Vercel for hosting and Supabase for database, authentication and private file storage. Additional providers receive information only as needed for enabled services, authorized connections or approved communications. Appropriate support access, legal obligations and security investigations may also require disclosure.
A final provider list, processing locations and applicable contractual safeguards must be verified before this policy becomes effective. No certification, absolute security guarantee or exclusive country of storage is claimed here.
AI features
Operational AI processing is disabled in the current pilot configuration. Before activation, the firm must be told which features use AI, which records may be sent to which provider, and the applicable controls and terms. AI suggestions require human review and do not establish accounting approval. Proposed policy: client content is not used by 11OneDock to train a shared model or shared as another firm’s AI memory. Provider retention and data-use settings must be verified before activation; this draft does not promise zero retention.
Security and retention
The application uses authenticated access, firm and client authorization controls, private storage and encrypted provider credentials. These controls reduce risk but cannot guarantee that a service is free from incidents. Report suspected unauthorized access promptly through the verified support channel.
Records must be retained only as needed for the service, firm instructions, security, dispute resolution and applicable obligations. A documented schedule for active records, audit logs, backups and terminated accounts is still required. This draft makes no immediate-deletion or fixed retention-period promise. A deletion request may need to be coordinated with the firm’s recordkeeping duties.
Cookies and privacy requests
The service uses authentication and session technology to keep users signed in and protect access. Any optional analytics or advertising technology must be separately disclosed before use. Depending on applicable law, you may be entitled to request access, correction, deletion or other action concerning your personal information. Requests require appropriate identity and authority checks.
For privacy requests during the pilot, contact Tony Wallace at 11onedocksupport@gmail.com. This inbox handles both privacy and support inquiries. Describe your request without attaching client financial records, passwords or verification codes; we can arrange an appropriate way to provide any information needed.
Changes and scope
See account and data deletion requests for the current request process and support for access and security problems.
The service is intended for business use by authorized users, not for children. A final notice will state its effective date and explain material changes. This draft is not a substitute for the final privacy notice, firm engagement agreement or applicable statutory rights.