Privacy Policy
Keep-It-Balanced Pro ("KIB Pro," "we," "our," or "us"), a subsidiary of Prestige VA Solutions, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, including financial data retrieved through our integration with Plaid, Inc.
Phishing-Resistant MFA
Passkeys (WebAuthn/FIDO2) and TOTP required before any financial data access.
Session Timeout
Automatic sign-out after inactivity (default 30 min) to protect open books.
AES-256 Encryption
All financial data and Plaid tokens encrypted at rest and in transit.
Restore Points
Snapshot and roll back transactions before any bulk operation — fully reversible.
Duplicate Prevention
Multi-field deduplication and data-precedence hierarchy prevent corrupted books.
Webhook Verification
JWT RS256 signature validation on all Plaid webhooks prevents spoofing.
About Prestige VA Solutions — Data Controller
Keep-It-Balanced Pro ('KIB Pro') is a product line operated by Prestige VA Solutions, a company organized under the laws of the State of Delaware, United States. Prestige VA Solutions is the data controller responsible for the collection, use, disclosure, and protection of all personal and financial data described in this Privacy Policy. All references to 'we,' 'our,' 'us,' or 'KIB Pro' throughout this policy refer to Prestige VA Solutions and its authorized personnel. Prestige VA Solutions is committed to operating in compliance with applicable U.S. federal and state privacy laws, IRS recordkeeping regulations, and financial data protection standards. For all privacy, security, data protection, and compliance inquiries, contact: Eduardo Marines, Security Lead / Head of Information Security, support@prestigevasolutions.com.
1. Information We Collect
We collect information you provide directly: name, email address, business details, financial data (bank statements, transaction records, receipts), and tax-related documents. We also collect data automatically: IP addresses, browser type, device information, and usage analytics through cookies and similar technologies. When you connect third-party services (Google Drive, Gmail, Plaid, bank feeds), we access only the data you explicitly authorize during the OAuth consent flow.
2. Consumer Consent for Data Collection and Processing
We obtain explicit, informed consent from consumers before collecting, processing, or storing any financial or personal data. Consent is obtained through: (a) affirmative action during account registration (checking a box to accept this Privacy Policy); (b) OAuth-based authorization when connecting third-party financial accounts via Plaid or other integrations, where the consumer is shown exactly what data will be accessed before granting permission; and (c) in-app confirmation prompts before any sensitive data operation (e.g., uploading bank statements, sharing data with a CPA). Consumers may withdraw consent at any time by disconnecting integrations or requesting data deletion, as described in Sections 6 and 9. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.
3. Financial Data and Banking Integration (Plaid)
Keep-It-Balanced Pro integrates with Plaid, Inc. ('Plaid') to enable consumers to securely connect their financial accounts. When a consumer uses Plaid Link, Plaid retrieves financial data (account balances, transaction history, account holder information) from the consumer's financial institution and transmits it to KIB Pro for bookkeeping and tax categorization purposes. The consumer controls which accounts to connect and can revoke access at any time through Plaid or within our application. Plaid access tokens issued during the connection process are encrypted at rest using AES-256 in GCM mode with a key derived via PBKDF2 (250,000 iterations) from an application secret — no plaintext access tokens are ever stored in our database, logs, or caches. All incoming Plaid webhook notifications are verified via JWT RS256 signature validation with body-hash matching and a 5-minute freshness window to prevent spoofing or replay attacks. We use consumer financial data received from Plaid solely for: (a) transaction categorization and bookkeeping; (b) tax intelligence and deduction discovery; (c) financial reporting and analysis; and (d) generating insights to improve the consumer's financial position. We do not use Plaid-sourced data for advertising, sale to third parties, or any purpose beyond the services the consumer has requested. Plaid's own privacy practices are governed by the Plaid Privacy Policy, available at plaid.com/legal.
4. How We Use Your Information
We use your data to: provide and maintain our bookkeeping and tax intelligence services; process and categorize financial transactions received from Plaid, bank statements, or manual entry; generate tax insights, deduction opportunities, and compliance reports; communicate with you about your account; improve our AI categorization models and platform reliability; comply with legal and regulatory obligations including IRS recordkeeping requirements; and prevent fraud, abuse, and unauthorized access.
5. Data Storage and Security
All data is encrypted at rest using AES-256 encryption and in transit using TLS 1.2 or higher. Consumer financial data retrieved from the Plaid API is encrypted at-rest in its entirety — no plaintext financial data is stored in any database, log, or cache. Our application infrastructure is hosted on the Base44 platform, which provides managed security including network segmentation, DDoS protection, and continuous infrastructure monitoring. We enforce role-based access controls (RBAC) so only authorized personnel can access sensitive data, and all access is logged and auditable. We actively perform vulnerability scans against all production assets and infrastructure, and we patch identified vulnerabilities on a defined remediation timeline based on severity: Critical within 72 hours, High within 7 days, Medium within 30 days, and Low within 90 days. All administrative and user access to systems storing or processing consumer financial data requires phishing-resistant multi-factor authentication (see Section 6).
6. Multi-Factor Authentication & Session Security
We require phishing-resistant multi-factor authentication (MFA) for all users before they can connect financial accounts via Plaid or access critical systems storing or processing consumer financial data. Supported MFA methods include: (a) Passkeys (WebAuthn / FIDO2) — including Windows Hello, Touch ID, and Face ID — which provide cryptographic, phishing-resistant authentication bound to the user's device; and (b) TOTP-based authenticator apps (Google Authenticator, Authy, 1Password). SMS-based codes are not accepted as they are vulnerable to SIM-swapping and interception. MFA credentials are strictly user-scoped: each user's MFA secret, passkey registrations, and recovery codes are isolated to their account and cannot be used to authenticate on behalf of another user. Users may optionally enable a 'Remember me for 30 days' persistence during MFA verification, which stores a device-bound, user-scoped token that is automatically invalidated if the user's account changes, the token expires, or the user signs out. To protect against unattended access to financial data, the platform enforces an automatic session timeout — users are signed out after a configurable period of inactivity (default: 30 minutes; options: 15 minutes, 30 minutes, 45 minutes, or 1 hour). A 2-minute warning is displayed before timeout so users can save their work. All session activity (mouse, keyboard, scroll, touch) resets the inactivity timer. Session timeout and MFA persistence settings are managed by the user in Settings → MFA & Security.
7. Data Integrity, Restore Points & Duplicate Prevention
We have implemented multiple layers of data integrity protection to ensure your bookkeeping is never corrupted by accidental changes, duplicate imports, or processing errors: (a) Restore Points — Before any bulk operation (bulk recategorization, statement import, or manual restore), the platform automatically creates a snapshot of the current transaction state (categories, statuses, personal/business flags, tags, and notes). Users can also create manual restore points at any time from the Restore Points page. If something goes wrong — a bad recategorization, an accidental import — the user can roll back all transactions to a known-good state with a single click. An auto-snapshot of the current state is always created before any restore, so the action is fully reversible. Restore points store categorization metadata only — never raw financial values or account numbers. (b) Duplicate Transaction Prevention — All incoming transactions, whether from bank statement parsing, Plaid sync, or manual entry, are checked against existing records using a multi-field deduplication algorithm that compares date, amount, direction, vendor, and account. The system also respects a data-precedence hierarchy: check-scrubbed data (extracted from physical check images) has the highest authority and cannot be superseded; bank statement data overrides Plaid and QuickBooks data; manual entries have the lowest authority. This prevents duplicate or conflicting records from corrupting your books. (c) Multi-Pass Account Matching — When processing bank statements, the system performs a two-pass search (business-specific, then cross-business) for existing financial account records to prevent duplicate account creation. (d) Stalled Pipeline Recovery — A background job monitors statement processing pipelines and automatically recovers any stalled or stuck tasks every 10 minutes, ensuring no data is lost during long-running imports.
8. Data Retention and Deletion
We maintain a defined and enforced Data Retention and Deletion Policy in compliance with applicable U.S. privacy laws, IRS regulations, and financial recordkeeping requirements. Financial records are retained for the duration of your active account plus seven (7) years to comply with IRS recordkeeping obligations (IRC § 6001 and Treasury Regulation § 1.6001-1). Upon account termination or upon your written request, we will delete your personal and financial data within 30 days, except where retention is required by law (e.g., IRS audit retention, active legal holds, or regulatory investigation). When data is deleted, it is permanently removed from all production databases, backups, and caches. Consumers may request data deletion at any time by contacting support@prestigevasolutions.com. Our full Data Retention and Deletion Policy is available to authorized reviewers and compliance partners upon request.
9. Data Sharing and Disclosure
We do not sell your personal or financial data. We may share data: (a) with your explicit consent (e.g., sharing reports with your CPA or tax preparer); (b) with service providers who assist in our operations — including Plaid for financial data connectivity — under strict confidentiality and data processing agreements; (c) as required by law, court order, or government regulation; (d) to protect our rights, property, or safety, or that of our users; and (e) in connection with a business transfer, merger, or acquisition, provided the acquiring entity agrees to honor this Privacy Policy.
10. Your Privacy Rights
You have the right to: access and obtain a copy of your personal data; correct inaccurate or incomplete data; request deletion of your data (subject to legal retention obligations); object to or restrict the processing of your data; request data portability (receiving your data in a structured, machine-readable format); and withdraw consent for data processing at any time. To exercise any of these rights, contact us at support@prestigevasolutions.com. We will respond to verified requests within 30 days. If you have connected your financial accounts via Plaid, you may also manage or revoke data access directly through Plaid's dashboard at plaid.com or through your financial institution's account settings.
11. Third-Party Integrations
When you connect third-party services (Google Workspace, Plaid, financial institutions, CPA portals), those services have their own privacy and security policies. We are not responsible for their data practices. We recommend reviewing their policies before connecting. Third-party integrations are connected via OAuth 2.0, and we never request more permissions than necessary for the service you have requested. You may revoke any third-party integration at any time from your account settings, and we will cease accessing data from that integration immediately.
12. Children's Privacy
Our services are not directed to individuals under 18. We do not knowingly collect data from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.
13. Vulnerability Management
We maintain an active vulnerability management program that includes regular vulnerability scanning of all production assets, employee and contractor machines, and infrastructure components. Identified vulnerabilities are triaged by severity (Critical, High, Medium, Low) and remediated according to defined timelines: Critical within 72 hours, High within 7 days, Medium within 30 days, and Low within 90 days. Our vulnerability management practices are reviewed quarterly and updated as new threats emerge.
14. Changes to This Policy
We will notify you of material changes to this Privacy Policy via email and in-app notification at least 30 days before they take effect. Continued use of our services after the effective date constitutes acceptance of the updated policy.
15. Contact Us
For privacy-related inquiries: support@prestigevasolutions.com. For information security or compliance inquiries: Eduardo Marines, Security Lead / Head of Information Security, support@prestigevasolutions.com. For data protection officer inquiries: dpo@keepitbalancedpro.com.
Questions?
Prestige VA Solutions is the data controller responsible for your personal and financial data. If you have any questions about this Privacy Policy, please contact our Security Lead, Eduardo Marines, at support@prestigevasolutions.com.