Privacy Policy

Last Updated: October 25, 2026 Effective Date: November 13, 2025

Change Log:

---

Introduction

Second Difference Solutions®, LLC ("Company", "we", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your information when you use any of our business analytics applications and related services:

• 2diff.io Business ("2diff Business", formerly BizAnalyzer and BizInsights) - Business analytics and financial reporting on four plans: a Free plan that runs on sample business figures; the Bronze plan, which analyzes figures you type in yourself with no account connection and has no AI features; the Silver plan, which connects to QuickBooks® or works from figures you type in; and a Gold plan that is not yet offered. Subscribers who keep the former BizAnalyzer Pro plan also connect to QuickBooks
• 2diff Econ (formerly EconAnalyzer) - Economic trends analysis and forecasting using public data sources (in development; not currently offered as a paid subscription)
• MarketAnalyzer - Stock market analysis using public market data, with a watchlist kept in your browser (not currently offered to customers)
• 2diff Marketing (formerly MarketingAnalyzer) - Reporting on your own connected Google Analytics, Google Search Console, and Google Ads accounts (we only read your data; we never change it)
• Custom Apps - Bespoke business solutions and integrations
• AI Tools - Internal AI-powered tools (AIBot, AIAgent) used by the Company; not currently offered to customers

Collectively referred to as the "Services" or "Applications."

This Privacy Policy applies to information we collect through:

• Our Applications (web-based and any future mobile apps)
• Our website at https://2diff.io
• Electronic communications related to the Services (emails, notifications)

Important: This Privacy Policy does not cover third-party services that our Applications integrate with or retrieve data from:

• Intuit QuickBooks (for 2diff Business)
• Google Analytics, Google Search Console, and Google Ads (for 2diff Marketing, when you connect your Google accounts)
• Google sign-in (when you choose Sign in with Google)
• Yahoo and, where we configure it, Alpha Vantage (for MarketAnalyzer data)
• EIA and FRED APIs (for 2diff Econ data)
• Stripe (payment processing)

Those services are governed by their own privacy policies. We encourage you to review their policies.

Agreement to Policy: By using the Services, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this Privacy Policy, please do not use our Applications or provide us with your information.

---

Information We Collect

We collect several types of information depending on which Application(s) you use:

Core Information (All Applications)

Account Information

When you register for any Application, we collect:

• Name (first and last name)
• Email address (required for account creation and communication)
• Password (if you sign in with email; held by Firebase Authentication, our sign-in provider, and never stored by us)
• Google account details (if you sign in with Google, Firebase Authentication receives your Google account name, email address, and profile photo URL)
• Business name (optional - helps us personalize your experience)
• Phone number (collected by our payment processor, Stripe, at checkout for every paid subscription, and copied to your account profile for billing and support contact; it is not asked for when you create an account without subscribing)
• User preferences (settings and display options, such as your theme and AI settings)

Payment Information

For paid subscriptions, we collect:

• Billing address (collected by Stripe at checkout and copied to your account profile for billing and support)
• Payment method details (credit card information is collected and stored by our payment processor, Stripe)
• Transaction history (receipts, invoices, payment dates, subscription changes)

Important: We do not store full credit card numbers on our systems. Payment card information is securely processed and stored by Stripe, which is PCI-DSS compliant.

Usage Data

We automatically collect information about how you access and use the Applications:

Technical Information:

• IP address (used for security and approximate location)
• Device type, model, and operating system
• Browser type and version
• Unique device identifiers
• Internet connection type and speed
• General location (city, state, country) based on IP address

Activity Information:

• Pages and screens you visit within the Applications
• Features and reports you use
• Time and date stamps of each interaction
• Duration of sessions
• Navigation paths through the Applications
• Click patterns and user flows
• Error logs and crash reports
• Performance metrics (page load times, API response times)

Information You Submit Through Forms

When you use one of our public forms, we collect only what you enter on that form. You do not need an account to use these forms. The forms are:

• Careers interest form (on the Careers page): your name, email address, and consent, and, if you choose to give them, the role you are interested in, your phone number, a link (such as a portfolio or profile), your location, and a message.
• Internship application (on the Careers page): your name, email address, area of interest, consent, and your acknowledgment of the contractor terms shown on the form, and, if you choose to give them, the term, your phone number, school, program, graduation date, availability, start date, time commitment, a link, your location, and a message.
• Start a Project form (the project intake on the Start a Project and demo onboarding pages): your name, email address, company name, project type, and consent, and, if you choose to give them, your phone number, location, website address, and your answers about your business, goals, current website, marketing, and tools, timeline, budget, and how you heard about us. While you fill it in, your unfinished answers are saved in your own browser (see "Browser Storage" below) and are cleared from it when you submit.
• Newsletter signup (in the site footer): your email address, your consent to receive updates, and, if you choose to give it, your name.

With every submission we also record the IP address it came from, your browser's user-agent string, and the page origin, which we use only to investigate abuse.

• We use this information to respond to you, to review your application or inquiry, and, for the newsletter, to send you updates until you unsubscribe.
• Form submissions are stored in our own systems on Google Cloud Platform and are not readable by other users.
• We send email related to your submission (an acknowledgement, an internal alert to our team, or the newsletter confirmation link) through our email provider, Resend. See "Service Providers" below.
• The newsletter uses double opt-in: we add you to the list only after you click the confirmation link we email you. You can unsubscribe at any time.
• We keep the details you submit until you ask us to delete them; see "Data Retention and Deletion" for how long the technical metadata attached to a submission is kept.

Cookies and Tracking Technologies

Our own code sets one short-lived security cookie, and only while you connect QuickBooks or sign in with Intuit. Google Ads conversion tracking sets cookies only after you choose Accept all in the cookie banner. Google Analytics is on by default if you are outside the European Economic Area, the United Kingdom, and Switzerland, and you can turn it off with Reject all or the Cookie choices link; inside those regions it is set only after you choose Accept all. The site also keeps a few settings in your browser's local storage, such as your cookie choice and your light or dark theme.

The complete list, with what each item holds and how long it lasts, is in the "Cookies and Tracking Technologies" section below.

Application-Specific Data Collection

2diff.io Business (QuickBooks Integration)

When you connect 2diff Business to your Intuit QuickBooks account (on the Silver plan, or the former BizAnalyzer Pro plan), we access and retrieve financial and accounting data with your explicit authorization via OAuth 2.0.

Financial Data Accessed:

This is the complete list of what 2diff Business reads from QuickBooks. We read nothing else.

Company Information:

• The company information record in your QuickBooks company settings: company name and legal name, the company and legal addresses, the company email address, phone number, and website, the fiscal year start month, and an industry classification where QuickBooks provides one
• QuickBooks Company ID (the Realm ID that identifies your company file)

Company Preferences:

• Your company's default report basis (cash or accrual), so your reports match how your books are kept

Chart of Accounts:

• Your account list (account names, types, and current balances)

Financial Reports:

• Profit and Loss report (revenue, costs, expenses, and net income by account)
• Balance Sheet report (assets, liabilities, and equity by account)
• Statement of Cash Flows report (operating, investing, and financing activities)

What We Do Not Read: 2diff Business does not read individual transactions, invoices, bills, payments, bank feeds, journal entries, the general ledger, aging reports, customer or vendor records, employee or payroll records, or tax identification numbers from QuickBooks.

OAuth Credentials (Encrypted):

• QuickBooks OAuth access tokens (short-lived)
• QuickBooks refresh tokens (used to obtain new access tokens)
• Token expiration dates
• QuickBooks Realm ID (company identifier)

Generative AI Analysis Features

2diff Business may utilize generative AI (GenAI) technology to provide enhanced financial insights and natural language analysis. This section explains how AI features work and what data is involved.

Which plans include AI: AI features in 2diff Business come with the Silver plan and the former BizAnalyzer Pro plan. The Free plan includes AI chat on sample business figures only. The Bronze plan has no AI features.

How GenAI is Used:

• Financial report summaries (totals, ratios, percentages) may be provided as context to AI models to generate insights and answer your questions
• AI may analyze numerical trends and patterns based on your financial reports
• Natural language queries about your data are processed by AI systems to provide conversational responses

What Data May Be Provided to AI Systems:

• Report-level totals and summaries (e.g., total revenue, total expenses, net income)
• Calculated financial ratios and percentages (e.g., profit margin, current ratio)
• Date ranges and period comparisons
• Account category totals (e.g., "Office Expenses: $5,000")

Data Minimization Practices:

We take steps to minimize the amount of identifying information sent to AI systems. However, depending on how your QuickBooks data is structured, some business context may be included:

• Account names as they appear in your Chart of Accounts (withheld by default; sent only if you turn that on)
• Category and class names you have configured
• Report headers and labels from QuickBooks

What Is Not Sent:

• Transaction-level details, line items, invoices, and bills (we do not read them from QuickBooks, so they cannot be sent)
• Customer and vendor records, employee or payroll records, and tax identification numbers (we do not read them either)
• Bank routing numbers or payment credentials
• Your company's contact information (addresses, phone numbers, emails)

A customer, vendor, or bank name can still reach an AI provider only if it is part of an account name in your Chart of Accounts and you have turned on sending account names (they are withheld by default).

Important Clarifications:

• You choose what is sent. AI features are optional. When you use one, the financial context you turn on (report-level totals, ratios, category totals, and date ranges) is sent to the AI provider you select to generate your requested analysis, with individual account names withheld by default. We do not send your account password, your accounting access tokens, or your payment details.
• Handled under the provider's terms, which we do not control. Your request is sent to the provider you select through that provider's standard API: OpenAI (the Chat Completions API), Anthropic (the Messages API), or Google (Gemini through Google Cloud Vertex AI). Each provider handles your request, including how long it keeps it, as its own API terms describe: OpenAI API data controls, Anthropic Commercial Terms, and Google Vertex AI data governance. Those terms state that content submitted through the API is not used to train their models. We do not send your data to any provider for the purpose of training a model.
• What we retain. We do not use your financial data to train our own models, and we do not store the AI conversation on our servers after your active session. For each AI request we keep an audit record for 90 days that holds a cryptographic fingerprint (hash) of what was sent, not the content itself. How long a provider keeps a request on its own systems is set by that provider's terms linked above, which we do not control.
• Your Control: You can use 2diff Business without AI features if you prefer. AI-powered analysis is an optional feature.

How We Use 2diff Business Data:

We use your QuickBooks data solely to:

1. Generate customized financial reports and dashboards for you
2. Calculate financial ratios and key performance indicators (KPIs)
3. Identify trends in revenue, expenses, cash flow, and profitability
4. Provide business insights and analysis
5. Create visualizations of your financial data (charts, graphs)
6. Compare your metrics to your historical performance
7. Cache data temporarily for faster performance (see Data Caching below)

Data Caching:

2diff Business Silver (formerly BizAnalyzer Standard): To provide faster load times and enable historical trend analysis, financial report data may be cached persistently on our secure cloud servers. (This also applies to subscribers who keep the former BizAnalyzer Pro plan.) This cached data:

• Is encrypted at rest using AES-256 encryption on Google Cloud Platform infrastructure
• Is encrypted in transit using TLS 1.2 or higher
• Is accessible only to your authenticated account (owner-only access controls enforced at the database level)
• Is written only by our servers, and cannot be read or written by other users
• Is refreshed automatically based on data freshness rules (current-year data refreshes every 4 hours; historical closed-year data refreshes weekly or less frequently)
• Is deleted immediately when you disconnect your accounting connection, and within 90 days after your subscription ends if you cancel (the 90 days is a reactivation grace window; see the data lifecycle table under "Data Retention and Deletion")
• Is never shared with third parties, used for AI model training, or accessed for any purpose other than serving your reports

You can revoke data access at any time by disconnecting your accounting integration from the 2diff Business dashboard. Upon disconnection, all cached financial data is deleted from our servers.

What We Do NOT Do:

• Sell your QuickBooks data to third parties
• Use your financial data to train AI/ML models
• Include your data in industry benchmarks unless you opt in, and then only in de-identified form
• Share your data with competitors or public databases
• Store credit card numbers from QuickBooks
• Execute transactions or modify data in your QuickBooks account (we only read your reports)
• Access your QuickBooks data after you disconnect 2diff Business

2diff Business Bronze (No Account Connection)

2diff Business Bronze (formerly BizInsights, and before that BizAnalyzer Lite) does not connect to QuickBooks, Intuit, or any accounting software, bank, or other Third-Party Service. There is no OAuth connection, and we do not access, retrieve, or receive any data from an accounting system on your behalf. The only financial information we hold for 2diff Business Bronze is the figures you type in yourself.

Information You Provide:

• A label or name you choose for your figures (you are not required to use a real or legal entity name)
• The annual financial figures you enter, for one or more years, such as revenue, cost of goods sold, operating expenses, interest, income tax, assets, liabilities, owner equity, and similar headline numbers
• Financial goals or targets you choose to create

We do not collect transaction-level detail, customer or vendor names, bank or account numbers, payroll data, or tax identification numbers through 2diff Business Bronze. 2diff Business Bronze holds only the summary figures you enter.

Where Your Figures Are Stored:

The figures you enter are saved to your own account's secure profile record on Google Cloud Platform infrastructure, separate from any QuickBooks-connected data. This data:

• Is encrypted in transit using TLS 1.2 or higher and at rest using AES-256
• Is accessible only to your authenticated account (owner-only access controls enforced at the database level): only you, signed in to your account, can read or change it, and other users cannot
• Is stored as the figures you entered (numbers, organized by year). Your statements, ratios, trends, and forecasts are calculated from those figures on demand and are not separately stored
• Is never transmitted to QuickBooks, Intuit, or any accounting provider, and is never sold. We do not share it with third parties, and we never use it to train AI models

Generative AI in 2diff Business Bronze:

2diff Business Bronze has no AI features, so the figures you enter on Bronze are never sent to an AI provider. If you move to 2diff Business Silver and keep working from figures you type in yourself, Silver's optional AI insights can send those figures, and the ratios calculated from them, to the AI provider you select, under the same handling described in "Generative AI Analysis Features" above.

Retention and Deletion:

Your manually entered figures remain in your account until you delete them. You can delete all of your 2diff Business Bronze figures (and any goals you created with them) at any time from within 2diff Business Bronze. They are also deleted when we delete your account at your request (see "Requesting Data Deletion"). Cancelling a Bronze subscription does not delete them. Because 2diff Business Bronze connects to no outside service, there is nothing to disconnect; deletion is entirely within your control.

What We Do NOT Do (2diff Business Bronze):

• Connect to, access, or store data from QuickBooks, Intuit, your bank, or any other outside service
• Sell or share your entered figures with third parties
• Use your entered figures to train AI/ML models
• Mix your 2diff Business Bronze figures with any QuickBooks-connected data

2diff Econ (Economic Data Analysis)

2diff Econ retrieves publicly available economic data on your behalf from government and institutional sources. It does not access your personal financial accounts or private business data.

Public Data Retrieved:

From U.S. Energy Information Administration (EIA):

• Energy production statistics (oil, gas, coal, renewables)
• Energy consumption data (residential, commercial, industrial)
• Energy price data and forecasts
• Regional energy trends and statistics
• Environmental data related to energy
• Supply and demand projections

From Federal Reserve Economic Data (FRED):

• GDP and economic growth indicators
• Employment statistics and unemployment rates
• Inflation metrics (CPI, PCE)
• Interest rates (federal funds rate, treasury yields)
• Monetary data (money supply, credit conditions)
• Housing market data
• Consumer spending and confidence indices
• Regional economic data by state and metropolitan area

How We Use Economic Data:

1. Retrieve data in real-time based on your queries and analysis requests
2. Display data in charts, tables, and visualizations
3. Generate economic reports and trend analysis
4. Create forecasts using statistical models
5. Compare regional economic performance
6. Cache aggregated data temporarily for performance optimization

Important Notes:

• Economic data retrieved through 2diff Econ is publicly available and not subject to confidentiality
• We do not claim ownership of public economic data
• Data usage is subject to the terms of EIA and FRED (both allow free use for analysis)
• No personal financial data is required to use 2diff Econ (only email for account management)

MarketAnalyzer (Stock Market Analysis)

MarketAnalyzer retrieves publicly available market data for research and analysis purposes, by default from Yahoo and, where we configure it, from the Alpha Vantage API. It does not integrate with brokerage accounts or execute trades.

Public Market Data Retrieved:

Stock Market Data:

• Real-time and historical stock prices
• Trading volumes (daily, intraday)
• Technical indicators (moving averages, RSI, MACD, etc.)
• Company fundamentals (earnings, revenue, P/E ratios)
• Market indices (S&P 500, NASDAQ, Dow Jones)
• Sector and industry performance data

Cryptocurrency Data (if applicable):

• Cryptocurrency prices and market capitalization
• Trading volumes across exchanges
• Historical price data

Watchlist and Alerts (Optional Features):

MarketAnalyzer keeps no portfolio data on our servers. Your watchlist, price alert rules, and data-source choice stay in your browser's local storage until you clear them (see "Browser Storage" below).

Important: MarketAnalyzer does not:

• Connect to your brokerage accounts
• Execute trades on your behalf
• Access actual account balances or transaction history from brokers
• Provide real-time order execution capabilities
• Act as a broker-dealer or investment advisor

How We Use Market Data:

• Retrieve market data on-demand for your analysis and research
• Display data in charts, graphs, and analytics dashboards
• Calculate performance metrics
• Generate technical analysis reports

Important Disclaimers:

Not Financial Advice: Market data and analysis provided by MarketAnalyzer is for informational and educational purposes only. It does not constitute financial advice, investment recommendations, or an offer to buy or sell securities.

Not Licensed Investment Advisors: We are not registered investment advisors, broker-dealers, or financial professionals. You should consult with qualified financial advisors before making investment decisions.

No Warranty: We do not guarantee the accuracy, completeness, or timeliness of market data. Market conditions change rapidly and past performance does not guarantee future results.

User Responsibility: You are solely responsible for your own investment decisions and any trading activities you undertake.

2diff Marketing (Google Marketing Data)

2diff Marketing lets you connect your own Google marketing accounts so the application can report on them for you. You authorize the connection through Google OAuth 2.0. We never write, change, or delete anything in your Google account. The Google Ads scope Google offers is a single read-and-write scope; our code only reads, using it to pull the aggregated reporting data that builds your reports.

We access up to three Google products, and only the ones you choose to connect. Each product has its own Connect button, which asks Google for that product's access only, plus your Google account's email address and basic profile to identify the connection. We read a product's data when you open a report that uses it.

Google Data We Read:

Google Analytics:

• Aggregated traffic and audience metrics (sessions, users, page and screen views)
• Acquisition channels and traffic sources
• Top pages and landing pages
• Key events (conversions) and their counts
• Device and country breakdowns
• Date ranges and period comparisons

Google Search Console:

• Search queries your site appeared for
• Pages that received search impressions and clicks
• Clicks, impressions, click-through rate, and average position
• Device breakdown
• Date ranges and period comparisons

Google Ads:

• Campaigns, ad groups, and their performance
• Keywords and search terms
• Ad text (headlines, descriptions, and sitelink and other asset text) and the landing pages your ads link to
• Spend, clicks, impressions, and conversions, including conversion actions and breakdowns by location and device
• Aggregated cost and performance metrics

What We Do NOT Do (Google Marketing Data):

• We do not write, change, create, pause, or delete anything in your Google Analytics, Search Console, or Google Ads account. The Google Ads scope Google offers is a single read-and-write scope; our code only reads.
• We do not sell or share your Google marketing data with third parties.
• We do not use your Google marketing data to train AI or machine learning models.

Retention:

• Reports are built from data fetched on demand. When you open a report, 2diff Marketing fetches the current data from Google and uses it to build your report.
• A monthly summary history is kept per workspace. For each 2diff Marketing workspace, we keep a history of up to 36 months of monthly totals: Google Ads cost, clicks, impressions, and conversions; Google Analytics sessions, users, key events, and engagement rate; and Search Console clicks, impressions, click-through rate, and average position. It is stored on our servers, readable only through the application by members of that workspace, and kept until the workspace is deleted, which you can ask us to do by email. Disconnecting your Google account does not delete it.
• Your Google connection is stored encrypted. We store the access and refresh tokens that let us reach Google on your behalf, encrypted, together with the email address of the Google account you connected and the permissions you granted. The tokens are used only to fetch the reports you request. All of this is deleted when you disconnect the Google account. It is not deleted when your access to 2diff Marketing ends; to have it deleted then, email us. You can also remove our access from your Google Account at any time.

Generative AI Insights (Optional):

2diff Marketing offers optional AI Insights over your connected Google data. When you use them, reporting figures from your connected accounts may be provided to the AI provider you select to generate your requested analysis, under the same handling described in the "Generative AI Analysis Features" section above. This context includes the metrics listed above and the names and text behind them: campaign names, keywords, search terms, ad headlines, the search queries your site appeared for, page paths, and traffic sources. Account identifiers such as property IDs, site URLs, and customer IDs are withheld. AI Insights are optional; you can use 2diff Marketing without them.

Disconnecting:

While you have access to 2diff Marketing, you can disconnect a connected Google account from within it. Disconnecting deletes the stored Google OAuth tokens and the Google account email address for that connection, and asks Google to revoke our access. You can also remove our access at any time from the third-party connections page of your Google Account.

Information From Google

Two features receive information from Google, and both follow the Limited Use statement below:

• Sign in with Google. If you choose it, Firebase Authentication (our sign-in provider, part of Google Cloud) receives your Google account name, email address, and profile photo URL to sign you in. We keep your name and email address on your account profile; our code does not use the photo URL.
• 2diff Marketing. The Google Analytics, Search Console, and Google Ads data described in the 2diff Marketing section above, read with the access you grant.

2diff.io's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

AI in BizFeasibility, ParcelAnalyzer, and FilmAnalyzer

These Applications offer optional AI features, where you have access to them. When you use one, your question and the context below are sent to the AI provider you select, under the same handling described in "Generative AI Analysis Features" above:

• BizFeasibility: the results our model computes from the project inputs you enter (scenario metrics, flags, key drivers, scenario comparisons, and assumptions).
• ParcelAnalyzer: aggregate figures about your parcel dataset (counts, shares, ranges, and category labels). Owner names, addresses, and parcel IDs are not sent.
• FilmAnalyzer: the parts of your film project you select, such as chapters, characters, summary, notes, and research.

Public 2diff Business Demo

The 2diff Business demo can be used without an account. It shows a sample business's figures, not yours, and nothing in it connects to QuickBooks or any other outside account.

• The demo AI assistant. When you ask the demo assistant a question, your question (up to 1,000 characters) and your last few messages in that conversation are sent, together with the sample business's figures, to the AI provider that runs the demo (Anthropic or OpenAI), under that provider's API terms described in "Generative AI Analysis Features" above. Do not type personal or confidential information into the demo.
• What we keep. We do not store your demo questions or the answers on our servers. Our request log keeps the model used, the size of the question and answer, and any campaign tags from the link you arrived on, together with an identifier used for rate limiting: a random demo ID for your browser tab (see the next point), or your IP address when no demo ID is available. Those logs are kept for 90 days (see "Data Retention and Deletion").
• In your browser. Goals or figures you try out in the demo are kept only in your browser tab's session storage and are cleared when you close the tab.
• The demo ID. The first time you ask the demo assistant a question, Firebase Authentication (our sign-in provider, part of Google Cloud) gives your browser tab a random demo ID: an anonymous sign-in with no name, email address, or password, which holds no data. We use it only to apply the demo's per-visitor question limit, so visitors who share one network (for example, at an event) each get their own limit. It is kept in your tab's session storage and is cleared when you close the tab; it is separate from any account you sign in with, and it is never created if you do not use the demo assistant.

Custom Apps and AI Tools

Custom Apps:

Data collection and usage for Custom Apps varies depending on the specific solution developed for your needs. Custom Apps are typically governed by:

• This Privacy Policy (for general data handling practices)
• A specific service agreement or statement of work that defines:
  • What data will be collected
  • How it will be used
  • Retention periods
  • Access controls

If you are using a Custom App, please refer to your service agreement for details.

AI Tools (AIBot, AIAgent):

Our AI Tools are internal tools and are not currently offered to customers. If we offer them, they collect minimal information:

Conversation Data:

• Chat messages and queries you submit
• Conversation history (stored temporarily for context)
• Topics discussed and common questions
• Usage patterns (frequency, session duration)

How We Use AI Tool Data:

• Provide conversational responses to your queries
• Improve AI tool behavior over time (e.g., refining prompts and response quality; your data is never used to train third-party AI models)
• Analyze usage patterns to enhance features
• Debug errors and improve performance

Data Retention:

• Conversation history stored for 30 days then deleted
• Anonymized usage statistics retained indefinitely for analytics
• No integration with your financial accounts or sensitive data

Integration with Your Data (2diff Business Users):

If you are a 2diff Business subscriber and use AI-powered features:

• Financial report summaries may be provided to AI systems as context for generating insights
• Individual account names from your Chart of Accounts are withheld by default. We send account categories, types, and totals, not the specific names you gave your accounts (which can include bank or related-party names). Names are included only if you explicitly opt in to send them
• This data is used to answer your request and is never used by us for AI training; the AI provider handles it under its own API terms, as described in "Generative AI Analysis Features"

For complete details on how AI features handle your data, see the "Generative AI Analysis Features" section under 2diff Business above.

---

How We Use Your Information

We use the information we collect for various purposes related to operating, maintaining, and improving our Services:

Core Uses (All Applications)

Service Delivery:

• Operate and maintain the Applications
• Authenticate your identity and manage your account
• Process your subscription payments through Stripe
• Send transactional communications (account confirmations, receipts, password resets, security alerts)
• Provide customer support and respond to your inquiries
• Deliver the features and functionality you requested

Improvement and Development:

• Analyze usage patterns to understand how users interact with our Applications
• Identify and fix bugs, errors, and performance issues
• Develop new features and enhance existing functionality
• Conduct A/B testing of new features and designs
• Improve user interface and user experience
• Optimize application performance and speed

Communication:

• Send service updates, feature announcements, and maintenance notifications
• Respond to your support tickets and questions
• Send security alerts and important account information
• Send optional marketing emails about new features or services (you can opt out)
• Conduct user surveys and request feedback (optional participation)

Legal, Compliance, and Security:

• Comply with applicable laws, regulations, and legal processes
• Respond to subpoenas, court orders, or lawful government requests
• Enforce our Terms of Service and other agreements
• Detect, prevent, and respond to fraud, security threats, or illegal activities
• Protect the rights, property, and safety of our Company, users, or others
• Maintain audit logs for security and compliance purposes

Aggregated Analytics:

• Create aggregated, de-identified, or anonymized data that cannot be linked back to you
• Analyze overall trends across our user base (e.g., average usage patterns, popular features)
• Generate industry insights and benchmarks, which include your data only if you opt in, and then only in de-identified form
• Improve our Services based on aggregated usage statistics
• Share anonymized insights in marketing materials or reports

Important: Aggregated data will never contain information that could be used to identify you personally or your company specifically.

Application-Specific Uses

2diff.io Business Specific Uses

Your QuickBooks data is used exclusively to:

1. Financial Reporting:

   • Generate profit and loss statements
   • Create balance sheets and financial position reports
   • Produce cash flow statements and projections
   • Generate custom financial reports based on your preferences

2. Business Analysis:

   • Calculate key financial ratios (liquidity, profitability, efficiency)
   • Identify trends in revenue, expenses, and cash flow over time
   • Compare current period performance to prior periods
   • Highlight areas of concern or opportunity in your financials
   • Generate "what-if" scenarios for financial planning

3. Analysis and Insights:

   • Provide data-driven insights based on your financial data
   • Identify areas where costs or revenue differ from historical patterns
   • Point out unusual changes in your report totals over time
   • Benchmark your performance against your historical data
   • Create visualizations to help you understand your financial position

4. Performance Optimization:

   • Cache report data to speed up report generation (current-year data refreshes every 4 hours; see "Data Caching" above)
   • Pre-calculate commonly used metrics for faster display
   • Optimize database queries for better performance

What We Explicitly Do NOT Do with QuickBooks Data:

• No Selling: We never sell your QuickBooks data to third parties for any purpose
• No AI Model Training: Your financial data is never used to train, fine-tune, or improve artificial intelligence or machine learning models. This prohibition is absolute.
• No Public Sharing: We do not share your specific financial data publicly or with competitors
• No Benchmarking Without Consent: We do not include your data in industry benchmarks unless you explicitly opt in, and then only in de-identified form
• No Marketing to You: We do not use your QuickBooks data to target ads or market third-party services to you
• No Credit Decisions: We do not use your data for underwriting, credit scoring, or loan decisions
• No Modification: We only read data from QuickBooks; we never modify, delete, or create transactions in your QuickBooks account

2diff Econ Specific Uses

Economic data retrieved is used to:

1. Display current economic indicators relevant to your queries and interests
2. Generate economic forecasts and trend analysis reports
3. Compare regional economic data across states and metropolitan areas
4. Analyze correlations between different economic indicators
5. Provide context for business planning and strategy

Minimal Personal Data Required:

• 2diff Econ can be used with minimal personal information
• We only need your email address to manage your account
• No access to your financial accounts, business data, or sensitive information
• All data analyzed is publicly available from government sources

MarketAnalyzer Specific Uses

Market data retrieved is used to:

1. Research and Analysis:

   • Display real-time and historical stock prices
   • Generate technical analysis charts and indicators
   • Analyze market trends and patterns
   • Compare stock performance across time periods and sectors
   • Provide market news and context (if integrated)

2. Watchlist and Alerts (Optional):

   • Show the stocks on your watchlist, which is kept in your browser
   • Check the price alert rules you set, in your browser only

3. Educational Tools:

   • Help users learn about investing and market analysis
   • Demonstrate technical indicators and their interpretations
   • Provide historical context for market movements

Important Disclaimers (Repeated for Emphasis):

Not Financial Advice: Market data and analysis provided by MarketAnalyzer is for informational and educational purposes only. It does not constitute:

• Financial or investment advice
• Recommendations to buy or sell any security
• Offers or solicitations for any financial products
• Professional financial planning services

Not Licensed Professionals: Second Difference Solutions®, LLC is not:

• A registered investment advisor
• A broker-dealer
• A financial planner
• Licensed to provide investment advice

No Guarantee of Accuracy: We do not guarantee:

• The accuracy or completeness of market data
• The timeliness of data updates
• The profitability of any investment strategies
• Future market performance based on historical data

User Responsibility: You are solely responsible for:

• All investment decisions you make
• Conducting your own due diligence
• Consulting with qualified financial professionals
• Understanding the risks of investing
• Compliance with securities laws and regulations

---

Cookies and Tracking Technologies

This section lists every cookie and browser storage item our website and Applications use. A cookie is a small text file a website stores in your browser. Local storage and session storage are similar browser features: local storage stays until you clear it, and session storage is cleared when you close the browser tab. None of the items below hold your password, your payment details, or your accounting data.

Cookies

We use Google Ads conversion tracking to measure our own campaigns, not to build advertising profiles or retarget you on other websites. Stripe's checkout page runs on Stripe's own website, and any cookies it uses are governed by Stripe's privacy policy.

Browser Storage

Local storage (stays until you clear it):

Session storage (cleared when you close the tab):

Sign-in storage: when you sign in, Firebase Authentication (our sign-in provider, part of Google Cloud) keeps your signed-in session in your browser's storage (IndexedDB) until you sign out.

Analytics and Your Cookie Choice

Your defaults depend on where you are, and a banner on your first visit lets you change them:

• Analytics: Google Analytics, used to measure site traffic and how pages are used. We ask Google to anonymize your IP address. If you are outside the European Economic Area, the United Kingdom, and Switzerland, analytics is on by default, and you can turn it off at any time with Reject all or the Cookie choices link. If you are inside those regions, analytics is off by default and turns on only if you choose Accept all.
• Advertising: Google Ads conversion tracking, used to measure whether a visit that came from one of our ads went on to sign up or subscribe. Advertising is off by default everywhere and turns on only if you choose Accept all.

While a category is off, Google's tags still load but use Google Consent Mode: they send Google basic, cookieless signals (for example, that a page was viewed) without storing or reading a cookie or identifier on your device. Choosing Reject all keeps both categories off and records that choice so the banner stops asking. You can change your choice at any time using the Cookie choices link in the site footer. This control covers Google's analytics and advertising cookies. It does not switch off the security cookie or the browser storage listed above; of those, only sds_funnel_id depends on your choice, and it exists only while analytics is on.

When analytics is on, Google Analytics records the pages you visit, how you move between them, how long you stay, and your device, browser, and approximate location. You can also block it in any website with the Google Analytics Opt-Out Browser Add-On.

Email Measurement (Limited Use)

Purpose: We use limited tracking in our own marketing communications.

What we do:

• Email open tracking (pixel in emails to know if you opened our newsletter)
• Link click tracking in emails (to see which content interests you)

What we DO NOT do:

• We do not display third-party advertisements in our Applications
• We do not sell your data to advertisers
• We do not use retargeting or behavioral advertising across other websites
• We do not use QuickBooks, market, or economic data for advertising

Can you turn it off? Yes:

• Unsubscribe from marketing emails using the link in any email
• Use email clients that block tracking pixels

Browser Settings

Most web browsers let you block or delete cookies and site data:

• Chrome: Settings > Privacy and security > Cookies and other site data
• Firefox: Settings > Privacy & Security > Cookies and Site Data
• Safari: Preferences > Privacy > Manage Website Data
• Edge: Settings > Cookies and site permissions > Manage and delete cookies

If you block or clear site data, you will be signed out, your theme and cookie choice will be forgotten, and connecting QuickBooks will not work while the security cookie is blocked.

Do Not Track Signals

Currently, our website does not respond to "Do Not Track" (DNT) browser signals. This is because there is no industry consensus on how to respond to DNT signals.

However, we limit our use of tracking technologies to the purposes described above and do not engage in invasive tracking practices.

---

How We Share Your Information

We value your privacy and do not sell your personal information to third parties. We only share information about you in the limited circumstances described below:

Service Providers (Third-Party Processors)

We share your information with trusted third-party service providers who perform services on our behalf. These providers are contractually obligated to:

• Protect your information
• Use it only for the purposes of providing services to us (and by extension, to you)
• Not use your data for their own purposes
• Comply with applicable data protection laws

If you are a business customer who requires a Data Processing Addendum (DPA) for compliance purposes, a DPA is available upon request. Contact us at info@2diff.io with the subject line "Data Processing Addendum Request."

For a complete list of our service providers and their roles, see our Sub-Processor List.

Service providers we use include:

Infrastructure and Hosting:

• Google Cloud Platform (Firebase):
  • Hosts our applications and databases
  • Provides authentication services, including Sign in with Google
  • Stores user data securely
  • U.S.-based data centers

Payment Processing:

• Stripe:
  • Processes subscription payments
  • Stores payment card information securely (PCI-DSS Level 1 compliant)
  • Handles refunds and billing
  • Holds a customer record for every account: when you create an account, we create a customer record at Stripe with your email address and account ID, even if you never subscribe
  • Sends us the name, phone number, and billing address you enter at checkout, and the status of your subscriptions and payments; we never receive your full card number

Analytics:

• Google Analytics:
  • Helps us understand how users interact with our Services
  • Collects anonymized usage data
  • Generates reports on traffic and engagement

Communication:

• Resend (email delivery):
  • Sends transactional emails (form acknowledgements, the newsletter confirmation link, receipts, password resets, alerts)
  • Stores confirmed newsletter contacts so we can send updates until you unsubscribe
  • Receives the recipient email address, the name you provide, and the message we send; never your financial data
  • U.S.-based; see the Sub-Processor List for details

Scheduling:

• Google Calendar appointment schedules (Google LLC):
  • Books the calls you schedule through our booking links
  • Receives the name, email address, and any answers you enter on the booking page, under Google's privacy policy
• Calendly:
  • Books the calls you schedule through the meeting links on our site
  • Receives the name, email address, and any answers you enter on its booking page, under its own privacy policy

API Data Providers (Data Sources):

These providers supply data to our Applications but do not receive your personal information:

• Intuit (QuickBooks API): For 2diff Business - we authenticate with your OAuth tokens
• Google (Google Analytics Data, Search Console, and Google Ads APIs): For 2diff Marketing - we authenticate with the OAuth tokens you grant and read your reporting data
• Yahoo and Alpha Vantage: For MarketAnalyzer - we retrieve public market data on your behalf (Yahoo by default; Alpha Vantage only where we configure it)
• EIA and FRED APIs: For 2diff Econ - we retrieve public economic data

AI Service Providers:

We use the following third-party AI providers to power the optional AI features in 2diff Business (the Free plan on sample business figures, the Silver plan, and the former BizAnalyzer Pro plan; the Bronze plan has no AI features), 2diff Marketing, BizFeasibility, ParcelAnalyzer, and FilmAnalyzer:

• OpenAI (GPT model family) - Processes natural language queries and generates financial insights
• Anthropic (Claude model family) - Processes natural language queries and generates financial insights
• Google (Gemini model family, via Vertex AI) - Processes natural language queries and generates financial insights

For all AI providers:

• Receive only the context described for the feature you use: financial summaries for 2diff Business (see "Generative AI Analysis Features"), the reporting context described under "Generative AI Insights" for 2diff Marketing, and the context listed for BizFeasibility, ParcelAnalyzer, and FilmAnalyzer
• Handle your request under their own published API terms, which we do not control and which state that content submitted through the API is not used to train their models: OpenAI API data controls, Anthropic Commercial Terms, and Google Vertex AI data governance
• How long a provider keeps a request on its own systems is set by those terms; we do not store the AI conversation on our servers after your session
• For 2diff Business, what is sent: Report-level totals, calculated ratios and percentages, account category totals, date ranges
• For 2diff Business, what is NOT sent: Individual transactions, vendor or customer names, individual Chart of Accounts names (withheld by default unless you opt in to include them), bank account numbers, personal identifying information

Important: When you use an AI feature, the provider you select receives your question together with the financial context you choose to include (the report-level totals, ratios, category totals, and date ranges listed above). We do not send your account password, your accounting access tokens, or your payment details to any AI provider. Each provider processes that request under its published API data-use terms, which for the providers listed above state that content submitted through the API is not used to train their models.

Business Partners (Confidential Programs)

We do not publicly share your QuickBooks data, financial information, or personal data with third parties.

However, if your use of the Applications is part of a specific program or partnership that you have voluntarily enrolled in (examples: small business mentorship program, industry-specific analytics program, academic research), we might share relevant information with the program organizers under strict confidentiality agreements.

In such cases:

• You will be informed in advance and must opt-in
• Data shared will be limited to what is necessary for the program
• Data will be protected under the terms of a private agreement
• Program partners are bound by confidentiality and cannot share your data further
• We will never disclose your data publicly or to competitors

Legal Compliance and Protection

We may disclose your information when we believe in good faith that such disclosure is necessary to:

Comply with Legal Obligations:

• Respond to subpoenas, court orders, or lawful government requests
• Comply with applicable laws, regulations, or legal processes
• Cooperate with law enforcement investigations
• Meet tax, accounting, or audit requirements

Protect Rights and Safety:

• Enforce our Terms of Service and other agreements
• Protect and defend the rights, property, or safety of our Company, our users, or others
• Investigate and defend against third-party claims or allegations
• Detect, prevent, or respond to fraud, security threats, or illegal activities
• Prevent harm to individuals or the public

In such cases:

• We will limit disclosure to the minimum necessary to fulfill the legal requirement
• We will notify you if legally permitted and practical
• We will verify the legitimacy of requests before disclosing information

Business Transfers

If the Company is involved in a merger, acquisition, sale of assets, bankruptcy, or reorganization:

• Your information (including personal data and any QuickBooks data we have stored) may be transferred to a successor or affiliate as part of that transaction
• Your information will remain subject to the protections of this Privacy Policy (unless you are notified otherwise and consent to a new policy)
• We will notify you (via email or a prominent notice on our website) of any change in ownership or material changes to how your personal information will be used
• You will have the opportunity to opt out or delete your account if you do not agree with the new entity's practices

With Your Consent

We may share your personal information with others for purposes not described above if you explicitly ask or consent us to do so. Examples:

• You ask us to integrate with another third-party service and authorize data sharing
• You request us to send your data to your accountant, advisor, or business partner
• You opt-in to a feature that involves sharing data with a specified third party

We will always obtain your affirmative consent before sharing data for new purposes not covered by this Privacy Policy.

What We Never Do

• Sell your data: We never sell your personal information, QuickBooks data, or any other data to third parties for marketing purposes or any other reason
• Share publicly: We do not publicly share your individual data, financial information, or company details
• Share with competitors: We do not share your data with competing services or businesses
• Use for unrelated purposes: We do not use your data for purposes unrelated to providing and improving our Services

---

Data Retention and Deletion

We retain your information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

General Retention Policies

Active Accounts:

• Account data: Retained while you have an account, until you ask us to delete it (see "Requesting Data Deletion")
• Usage logs: We retain structured request logs for internal security monitoring, debugging, and usage analytics. API activity logs, external integration logs, security events, authentication events, rate-limiting events, and error logs are retained for 90 days; billing and subscription events are retained for 365 days. All logs are stored in our secure cloud infrastructure and are not accessible to users or third parties.
• Transaction records: Retained for 7 years to comply with U.S. tax and accounting requirements

Cancelled Subscriptions:

• Cached QuickBooks data, goals, and the QuickBooks connection: Kept for 90 days after your subscription ends (in case you resubscribe), then deleted
• Your profile, preferences, settings, and any figures you typed in yourself: Kept until you ask us to delete your account; cancelling a subscription does not delete them. You can delete figures you typed in at any time from within the app
• Financial transaction records: Retained for 7 years for legal and tax compliance purposes
• Support correspondence: May be retained longer for legal protection and reference

Anonymized Data:

• We may retain anonymized, aggregated data indefinitely for analytics and research
• This data cannot be used to identify you personally

Form Submissions:

• What you submitted (your name, email address, and message, and any other fields you filled in on the careers interest, internship, Start a Project, or newsletter form) is kept until you ask us to delete it. Email info@2diff.io to have your submission removed.
• Technical metadata attached to a submission (the IP address it came from and your browser's user-agent string, which we keep only to investigate abuse) is automatically removed 90 days after you submit.
• Newsletter contacts: if you confirm a newsletter signup, your email address stays on the list until you unsubscribe, which you can do at any time from any newsletter email. The confirmation link stops working 7 days after we send it. An unconfirmed signup is never added to the list and is not used for mailing (you receive only the one confirmation email), and the pending request is removed after a short retention window.

Public Demo:

• We do not store your demo questions or the answers. The request log entries described under "Public 2diff Business Demo" are kept for 90 days, like our other API activity logs.

Application-Specific Retention

2diff.io Business Data Retention

While Connected (2diff Business Silver, and the former BizAnalyzer Pro plan):

• Session data: Cached in-session during active use (for performance)
• OAuth tokens: Stored encrypted (Fernet symmetric encryption) until you disconnect or revoke access
• Cached financial data: Stored persistently on secure cloud servers, encrypted at rest (AES-256), and refreshed based on data freshness rules. Current-year data refreshes every 4 hours; historical data refreshes less frequently (up to 30 days for closed fiscal years). Financial goals and targets are also stored persistently for progress tracking.

Data lifecycle (2diff Business, all plans). Disconnecting your accounting connection and cancelling your subscription are different events, and your cached data is handled differently for each. This table is the authoritative summary; it reflects what our code actually does.

Kept regardless (legal requirement): transaction records showing you paid for a subscription are retained for 7 years for U.S. tax and accounting compliance. We also do not delete your customer record at Stripe (your email address, account ID, and billing history). No QuickBooks financial data is retained after the deletion above, except in our database backups until they expire (see "Requesting Data Deletion").

Note on Sign-In Identity: If you use "Sign in with Intuit" to authenticate with 2diff Business, certain identity fields associated with your Intuit account (such as your Intuit account identifier and verified email address) are retained on your 2diff Business user profile independently of your accounting data connection. This identity information is used solely to recognize your account if you sign in with Intuit again in the future. It is not used for any other purpose and is not shared with third parties. To request complete removal of this identity information, contact us at info@2diff.io and we will process the removal within 30 days.

How to Disconnect:

• You can disconnect 2diff Business from QuickBooks anytime through your dashboard
• Click "Disconnect" button → Confirm → All access is immediately revoked

Important: When you disconnect 2diff Business:

• We permanently lose access to your QuickBooks data
• We do not restore disconnected data on request; backup copies expire as described under "Requesting Data Deletion"
• You will need to re-authorize if you reconnect later (starting fresh)

2diff Econ Data Retention

Public Economic Data:

• Economic data from EIA and FRED is publicly available and not subject to deletion
• We may cache public data for performance (up to 24 hours)

Your Data:

• 2diff Econ stores no reports, query history, or alerts for you; it caches public data only

MarketAnalyzer Data Retention

Public Market Data:

• Market data from Yahoo or Alpha Vantage is publicly available and not subject to deletion
• We may cache public data for performance (up to 24 hours)

Your Watchlist and Alerts:

• MarketAnalyzer keeps no portfolio data on our servers; your watchlist, price alert rules, and data-source choice stay in your browser's local storage until you clear them

Important: MarketAnalyzer does not store actual brokerage account data (we don't have access to it).

2diff Marketing Data Retention

Requesting Data Deletion

You have the right to request deletion of your personal information at any time.

How to Request Deletion:

1. In the Application (your financial data):

   • Open 2diff Business and use the Disconnect QuickBooks control in the Data Connection panel
   • Disconnecting revokes our access with Intuit and permanently deletes the financial data we hold for that company: imported and cached report data, financial goals, goal history, and saved valuation inputs
   • This removes your financial data immediately from our live database. Copies in our database backups expire on their own: daily backups after 14 days, weekly backups after 8 weeks, and point-in-time recovery copies after 7 days. It does not close your account, so use the email path below for that.

2. Email Request (full account deletion, or specific data):

   • Email info@2diff.io
   • Include "Data Deletion Request" in subject line
   • Provide your name and email address
   • Specify what data you want deleted, or ask for your account to be deleted in full
   • We will verify your identity and process within 30 days

What Happens When You Ask Us to Delete Your Account:

Account deletion is handled by our team when we process your email request, within 30 days. We delete:

• Your account: your sign-in account with Firebase Authentication, and your account profile, preferences, and settings
• 2diff Business data: cached QuickBooks data, goals, goal history, saved valuation inputs, and any figures you typed in yourself
• Your connections: your QuickBooks connection, after we ask Intuit to revoke its token, and your Google connection, after we ask Google to revoke its token, so we lose access to those accounts
• Saved work in our other Applications: for example, BizFeasibility projects, and a 2diff Marketing workspace set up for your own accounts together with its monthly history
• Your form submissions and newsletter contact: the details you submitted through our forms with the same email address, and your newsletter contact at our email provider

What we keep:

• Transaction records, kept for 7 years for tax and accounting purposes, and your customer record at Stripe (your email address, account ID, and billing history), which we do not delete
• Request and security logs, which are not deleted early and expire on the schedule under "General Retention Policies" (90 days, or 365 days for billing events)
• Your acceptance record: the date and the versions of our Terms and Privacy Policy you accepted at checkout
• Data under a legal hold or that the law requires us to keep

Service terminated: You will no longer be able to access the Applications.

Important Notes:

• We do not restore deleted data on request
• Copies in our database backups are not used by the Applications and expire on their own: daily backups after 14 days, weekly backups after 8 weeks, and point-in-time recovery copies after 7 days
• If you request deletion but have an active subscription, we will cancel your subscription (no refund for remaining time)

---

Data Security

We take the security of your personal information seriously and implement reasonable and appropriate measures to protect it.

Technical Safeguards

Encryption:

• Data in Transit: All data transmitted between your device and our servers is encrypted using TLS/SSL (HTTPS)
• Data at Rest: Data stored in our databases is encrypted at rest by Google Cloud Platform using AES-256
• OAuth Tokens: Accounting access tokens carry an additional application layer of authenticated encryption on top of that at-rest encryption. We do not store account passwords (handled by Firebase Authentication) or payment card numbers (handled by Stripe)
• End-to-End: QuickBooks API communications use OAuth 2.0 with encrypted tokens

Access Controls:

• Authentication: Account sign-in is handled by Firebase Authentication, and email address verification is required before an account can reach the applications or start a subscription
• Authorization: Role-based access control limits data access to authorized personnel only
• Least Privilege: Employees and contractors have access only to data necessary for their job functions

Network Security:

• DDoS Protection: Traffic reaches our services through Google Cloud's front end, which carries Google's default distributed denial-of-service protection
• Rate Limits: Our sign-in, form, and AI endpoints enforce rate limits
• Secure Infrastructure: Built on Google Cloud Platform infrastructure (SOC 2 and ISO 27001 certified data centers)

Application Security:

• Secure Coding: We follow OWASP secure coding guidelines
• Input Validation: All user inputs are validated and sanitized
• NoSQL Injection Prevention: All database operations use parameterized document references and validated input
• XSS Protection: Output encoding prevents cross-site scripting attacks
• CSRF Protection: Tokens prevent cross-site request forgery

Administrative Safeguards

Personnel:

• Access Restrictions: Access to sensitive data and production systems is restricted to authorized personnel only
• Confidentiality Agreements: All personnel sign confidentiality agreements
• Security Practices: Security-conscious development practices followed across all operations
• Limited Access: Only essential personnel have access to production systems

Policies and Procedures:

• Incident Response Plan: We maintain documented procedures for handling security incidents. In the event of a confirmed data breach affecting your personal information, we will notify affected users without undue delay and within 72 hours of becoming aware of the breach. Notification will include a description of the nature of the breach, the categories of data affected, the likely consequences, and the measures we are taking or propose to take to address the breach. To receive breach notifications, ensure your account email address is current. Contact info@2diff.io to update your contact information.
• Security Audits: We run security audits of our code and infrastructure and keep a dated written record of each
• Vendor Management: Third-party vendors are vetted for security practices
• Data Minimization: We collect only data necessary for our Services

Physical Safeguards

Data Centers:

• Secure Facilities: Data hosted in Google Cloud Platform data centers with:
  • 24/7 security monitoring
  • Biometric access controls
  • Video surveillance
  • Environmental controls (fire suppression, climate control)
• Redundancy: Our database is stored in the Google Cloud us-central1 region, which keeps copies in more than one zone of that region, and we keep scheduled database backups (daily backups for 14 days, weekly backups for 8 weeks, and point-in-time recovery for 7 days)
• Compliance: Google Cloud Platform data centers maintain SOC 2, ISO 27001, and other security certifications

Limitations

Despite our efforts to protect your information, no security measure is 100% foolproof:

• The transmission of information via the internet is not completely secure
• We cannot guarantee absolute security against all threats
• Unauthorized access, hardware failures, and other factors may compromise security

Your Responsibility:

• Keep your login credentials confidential
• Use a strong, unique password for your account
• Log out from shared devices
• Keep your devices and software updated
• Report suspicious activity immediately

Breach Notification

In the event of a data breach that affects your personal information:

• We will investigate the breach immediately
• We will notify you via email within 72 hours of discovering the breach (as required by applicable law)
• We will notify relevant regulatory authorities as required
• We will provide information about:
  • What data was affected
  • What we are doing to address the breach
  • Steps you can take to protect yourself
• We will post a notice on our website if the breach is widespread

To report a security concern or suspected vulnerability, contact us at info@2diff.io with the subject line "Security Report."

---

Your Rights and Choices

You have certain rights and choices with respect to your personal information. The specific rights available to you may depend on your location and applicable law.

Access and Correction

Right to Access: You have the right to access the personal information we hold about you.

How to Access:

• If you subscribe, the Manage Subscription button on your dashboard opens the Stripe billing portal, which shows your subscription and billing details
• Email info@2diff.io to request a copy of all personal data we have about you
• We will provide the data in a commonly used electronic format (PDF, CSV, JSON)

Right to Correction: You have the right to request corrections of any inaccuracies in your personal information.

How to Correct:

• Email info@2diff.io to request a correction
• We will update the information within 30 days

Deletion of Data

Right to Deletion: You may request that we delete the personal information we have collected about you.

How to Request Deletion:

• See the "Data Retention and Deletion" section above for detailed instructions
• Email info@2diff.io with "Data Deletion Request" in the subject line

Exceptions: We may retain certain information if:

• Required by law (e.g., transaction records for tax purposes)
• Necessary to complete a transaction you requested
• Necessary to detect and prevent fraud or security threats
• Necessary to defend legal claims
• Subject to a legal hold or pending litigation

Opt-Out of Marketing Communications

Right to Opt-Out: You can opt out of receiving promotional emails or newsletters from us.

How to Opt-Out:

• Click the "unsubscribe" link at the bottom of any marketing email
• Email info@2diff.io with "Unsubscribe" in the subject line
• Our newsletter uses double opt-in: we add you to the list only after you click the confirmation link we email you, and you are never added from a form submission alone

To have the details from a form you submitted removed, use the deletion path in "Deletion of Data" above.

Important: Even if you opt out of marketing emails, we will still send you:

• Transactional emails (receipts, password resets, security alerts)
• Service notifications (downtime alerts, feature updates affecting your account)
• Legal notices (changes to Terms or Privacy Policy)

These messages are necessary to operate your account and cannot be opted out of.

Data Portability

Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format.

How to Request:

• Email info@2diff.io with "Data Export Request" in the subject line
• We will provide your data in JSON, CSV, or PDF format (your choice)
• Delivery within 30 days

What's Included:

• Account information (name, email, preferences)
• Subscription history
• Generated reports and analyses
• Usage history (if requested)

Not Included:

• Data from third-party services (QuickBooks, market data) - request directly from those providers
• Aggregated or anonymized data that doesn't identify you
• Information that would violate others' privacy

Withdraw Consent

Right to Withdraw: In cases where we rely on your consent for processing personal information, you have the right to withdraw your consent at any time.

How to Withdraw:

• For marketing emails: Use the unsubscribe link or email info@2diff.io
• For optional features: Stop using the feature, or email info@2diff.io
• For data processing: Email info@2diff.io with details

Effect of Withdrawal:

• Withdrawal does not affect the legality of any processing we conducted prior to your withdrawal
• Withdrawal may impact our ability to provide certain features or services
• We will stop processing your data for that purpose going forward

California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

Right to Know:

• What categories of personal information we collect
• Sources from which we collect it
• Business or commercial purposes for collecting it
• Categories of third parties with whom we share it
• Specific pieces of personal information we have collected about you

Right to Delete:

• Request deletion of personal information we have collected (subject to exceptions)

Right to Correct:

• Request correction of inaccurate personal information

Right to Opt-Out:

• Opt out of the "sale" or "sharing" of personal information
• Note: We do not sell personal information, so this right does not apply

Right to Limit:

• Limit use and disclosure of sensitive personal information (we do not use sensitive information for purposes requiring this right)

Right to Non-Discrimination:

• We will not discriminate against you for exercising your CCPA rights
• We will not deny services, charge different prices, or provide different quality of service

How to Exercise CCPA Rights:

• Email info@2diff.io with your request
• Include "California Privacy Request" in the subject line
• Provide your name and email address for verification
• We will respond within 45 days (may extend to 90 days for complex requests with notice)

Authorized Agents:

• You may designate an authorized agent to make requests on your behalf
• Agent must provide proof of authorization (power of attorney or signed permission)

Verification:

• We will verify your identity before fulfilling requests
• May ask for additional information to confirm you are the person whose data is being requested

GDPR and International Data Protection Rights

If you are in the European Economic Area (EEA), United Kingdom, or a similar jurisdiction with data protection laws (GDPR), you have additional rights:

Access, Rectification, Erasure:

• Request access to your personal data
• Request correction of inaccurate data
• Request deletion ("right to be forgotten") subject to legal exceptions

Restriction and Objection:

• Request restriction of processing in certain circumstances
• Object to processing based on legitimate interests
• Object to direct marketing (including profiling for marketing)

Data Portability:

• Receive your data in a structured, machine-readable format
• Transmit your data to another controller (where technically feasible)

Withdraw Consent:

• Withdraw consent at any time (where processing is based on consent)

Lodge a Complaint:

• File a complaint with your country's data protection authority (supervisory authority)
• List of EU supervisory authorities: https://edpb.europa.eu/about-edpb/board/members_en

How to Exercise GDPR Rights:

• Email info@2diff.io with your request
• Include "GDPR Request" in the subject line
• We will respond within 30 days as required by GDPR

Legal Bases for Processing:

See the "Legal Bases for Processing (EEA/UK Users)" section below for details on the legal bases we rely on.

---

Legal Bases for Processing (EEA/UK Users)

For individuals in the EEA, UK, or other regions that require a legal basis for processing personal data, we process your information under the following legal bases:

Performance of a Contract

We process personal data as necessary to provide our Services to you in accordance with our contract (the Terms of Service/EULA).

Examples:

• Processing your account information to authenticate you and provide access
• Processing QuickBooks data to generate financial reports (2diff Business)
• Processing payment information to manage your subscription
• Sending transactional emails related to your use of the Services

Legitimate Interests

We process certain data for our legitimate business interests, balanced against your rights and interests.

Our legitimate interests include:

• Securing and improving our Applications
• Understanding how users interact with our Services
• Developing new features and enhancing functionality
• Communicating with you about our Services
• Administering our agreements and protecting our legal rights
• Detecting and preventing fraud, security threats, and abuse

Balancing your interests:

• We assess whether processing is necessary and proportionate
• We consider your reasonable expectations based on our relationship
• We provide opt-outs and controls where appropriate
• We do not process sensitive data under legitimate interests unless necessary

Legal Obligation

In some cases, we need to process and retain data to comply with our legal obligations.

Examples:

• Keeping records of transactions for tax and accounting purposes (7 years in the U.S.)
• Responding to lawful requests from law enforcement or government agencies
• Complying with data breach notification requirements
• Retaining information subject to legal holds or court orders

Consent

Where we have obtained your consent, we will process your personal data within the scope of that consent.

Examples:

• Sending optional marketing emails (you opt in through the newsletter signup)
• Participating in surveys or beta programs (you opt-in when asked)
• Sharing data with specific third parties you authorize
• Using your data for purposes not covered by other legal bases (we ask for consent first)

Important: You have the right to withdraw any consent you have provided at any time. Withdrawal does not affect processing that occurred prior to withdrawal.

---

Children's Privacy

Our Services are intended for use by businesses and adults (18 years or older) and are not directed to children or minors.

Age Restrictions:

• Users must be at least 18 years old to create an account
• We do not knowingly collect personal information from individuals under 18
• We do not knowingly collect personal information from children under 13 (or under 16 in certain jurisdictions where a higher age threshold applies under local law, such as the EU)

If We Discover We Have Collected Data from a Child:

• We will promptly delete such information from our records
• We will terminate the account
• We will take steps to prevent future use by minors

Parents and Guardians: If you believe that a minor has provided us with personal information without appropriate consent, please contact us immediately at info@2diff.io so that we can take appropriate action.

No Marketing to Children: We do not market our Services to children and do not knowingly collect information from children for marketing purposes.

---

International Data Transfers

Our Services are operated in the United States. If you are accessing our Services from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States.

Data Transfer Mechanisms:

For EEA/UK Users:

• We rely on Standard Contractual Clauses (SCCs) approved by the European Commission for transfers of personal data from the EEA/UK to the United States
• We implement appropriate safeguards to protect your data in accordance with GDPR requirements
• You may request a copy of the SCCs by contacting info@2diff.io.

Data Privacy Framework:

• We monitor developments in the EU-U.S. Data Privacy Framework and Swiss-U.S. Data Privacy Framework
• We may implement additional safeguards as needed to ensure compliance

Your Consent:

By using our Services, you consent to the transfer of your information to the United States and other countries where we or our service providers operate.

Data Protection Standards:

• We apply the same privacy and security protections to data regardless of where it is stored
• We require our service providers to protect data in accordance with this Privacy Policy and applicable law

---

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other reasons.

How We Notify You of Changes:

For Material Changes:

• We will notify you by email at the address associated with your account
• We will post a prominent notice in the Applications or on our website
• We will update the "Last updated" date at the top of this Privacy Policy
• We will maintain a "Change Log" at the top of this document

For Non-Material Changes:

• We will update the "Last updated" date
• We will note the change in the Change Log
• Continued use of the Services constitutes acceptance

Your Options:

• You will have at least 30 days to review material changes before they take effect
• If you do not agree to the changes, you may cancel your subscription and stop using the Services before the changes take effect
• Continued use after the effective date of changes constitutes acceptance

Review Regularly: We encourage you to periodically review this page for the latest information on our privacy practices.

Previous Versions: Previous versions of this Privacy Policy are available upon request by contacting info@2diff.io.

---

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email Contacts:

• Privacy inquiries and data rights requests: info@2diff.io
• General support: info@2diff.io
• General information: info@2diff.io

For Data Rights Requests (GDPR, CCPA, etc.):

• Email: info@2diff.io
• Include "Data Rights Request" in the subject line
• Specify which right you are exercising (access, deletion, correction, etc.)
• Provide your name and email address for verification

Response Time:

• We will respond to all privacy inquiries within 30 days as required by applicable law
• For urgent security matters, we will respond within 72 hours
• For general questions, we typically respond within 1-2 business days

---

By using our Services, you acknowledge that you have read this Privacy Policy, understand it, and agree to the collection, use, and disclosure of your information as described herein.

---

Related Information

• Terms of Service
• Security Information
• Sub-Processor List

---

Intuit and QuickBooks^® are registered trademarks of Intuit Inc. Used with permission. Second Difference Solutions^®, LLC is an independent software provider and is not affiliated with, endorsed by, or sponsored by Intuit Inc. Our applications integrate with QuickBooks^® products via Intuit's official APIs.