Privacy policy

This notice describes the privacy terms for 11OneDock, a workspace for accounting firms and their authorized employees and clients, operated by Tony Wallace individually from Florida, United States. The software operator is separate from 11One Accounting and from the firm that provides your professional services. Contact 11onedocksupport@gmail.com for privacy questions and notices.

Information handled by the service

Depending on the features your firm uses, the service handles account names and email addresses, firm membership and access roles, client and engagement records, accounting reports and transactions, documents and workpapers, requests, messages, review decisions, time records and audit history. Account authentication and technical operations also generate session, device, request and security information.

Only enabled and authorized connections can supply provider data. Selecting a provider or seeing its name in settings does not mean an account is connected. Do not send passwords, authenticator codes, full payment-card details or provider secrets through ordinary messages or document uploads.

Why information is used

Information is used to operate authorized firm workspaces, authenticate users, enforce access controls, organize client work, preserve supporting evidence, support review and delivery, reconcile permitted time and financial records, provide support, and investigate errors or misuse. Customer content is not sold or used for targeted advertising.

Your accounting firm and the software operator

Your firm determines which client information it enters, who is assigned to the work, and which materials it shares with clients. Contact the firm about the accuracy, professional use or retention of its accounting records. The software operator handles account administration and technical service operations. We process professional records under the firm’s authorized instructions and handle our own account administration and security obligations. Any additional data-processing or international-transfer agreement required for a jurisdiction must be established before onboarding that use; this notice does not supply that agreement.

Connected services and payment links

Authorized integrations may retrieve accounting, email, calendar, file or time information from the connected provider. Requested permissions are shown during the provider’s authorization flow. Disconnecting stops future authorized retrieval through that connection; it does not automatically delete records already imported into the workspace or the provider’s own records.

The intended payment-link feature sends users to a payment page hosted by QuickBooks or another explicitly identified provider. That provider handles payment entry and processing under its own terms. A link does not authorize 11OneDock to charge an account. This description does not represent the payment-link feature as active.

Connected information and Google Limited Use

Gmail and Outlook connections access authorized account identity, message metadata, content and attachments for email, correspondence and document intake. Drive and OneDrive connections use file identifiers, folders, metadata and selected contents for finding, importing and linking files. Calendar connections use calendar and event information for schedules and availability. Available sending or modification actions require the appropriate permission and authorized user action.

QuickBooks Online supplies authorized company identity, accounts, transactions and reports for client accounting or the separately connected firm’s own financial view. QuickBooks Time supplies company, employee, job and time records for explicit mappings and official time. Authorized time-entry actions are distinct from reading time.

We retain imported records or relevant excerpts for the feature and evidence history, with connection identifiers and encrypted credentials. Connecting a personal mailbox does not itself give colleagues access. Deliberately sharing or linking information can make it available to authorized workspace users. You can also revoke a connection in the provider’s settings and request deletion of retained application copies.

Our handling and transfer of Google API information follows the Google API Services User Data Policy and Google Workspace user data policy, including Limited Use. We use it for disclosed, user-facing features you authorize, not advertising, lending or creditworthiness decisions, surveillance, or training general-purpose or non-personalized AI models.

Google-data transfers are restricted to authorized features, security, legal obligations, or a business transfer with prior consent where required. Human access requires affirmative agreement to specific information, a security or legal need, or another exception expressly permitted by Google’s policy. These restrictions also apply to derived information.

Who may receive information

Access is limited according to firm membership, client assignments and the materials deliberately shared with recipients. The service uses Vercel for hosting and Supabase for database, authentication and private file storage. Additional providers receive information only as needed for enabled services, authorized connections or approved communications. Appropriate support access, legal obligations and security investigations may also require disclosure.

Resend handles configured transactional email, including recipient details, message content and delivery records; account email may also use the configured authentication service. Google hosts our support inbox. Authorized Google, Microsoft and Intuit connections exchange the records needed for their enabled features. The operator is in the United States; providers and authorized users may process information there or elsewhere. No certification, absolute security guarantee or exclusive country of storage is claimed here.

AI features

Operational AI processing is disabled in the current pilot configuration. Before activation, the firm must be told which features use AI, which records may be sent to which provider, and the applicable controls and terms. AI suggestions require human review and do not establish accounting approval. Client content is not used by 11OneDock to train a shared model or shared as another firm’s AI memory. Enabled OpenAI features may send the user’s request and selected authorized messages, document excerpts or work records to OpenAI for a draft, summary or suggestion. Local processing, where configured, uses the designated authorized worker computer. Firm memory consists of permission-controlled preferences, approved procedures and source-linked summaries. We do not promise zero retention by an AI provider; its applicable data controls and the feature disclosure govern that handling. New uses of connected information require applicable notice and consent before activation.

Security and retention

The application uses authenticated access, firm and client authorization controls, private storage and encrypted provider credentials. These controls reduce risk but cannot guarantee that a service is free from incidents. Report suspected unauthorized access promptly through the verified support channel.

Active records are retained as needed for the service, supporting evidence and authorized firm instructions. Removing a user does not erase shared firm records. On a verified closure or deletion request, we review scope, arrange available exports and remove information no longer needed. Limited retention for legal obligations, security, disputes or another legitimate purpose requires a documented reason and review date. Deletion is manual, not instant. Record type, firm instructions and applicable obligations determine what must remain; there is no uniform accounting-record retention period. Backup copies, where present, are restricted from ordinary use and may remain until safely expired or replaced. Completed deletion and access-removal decisions must be reapplied before restored data is made available.

Cookies and privacy requests

The service uses authentication and session technology to keep users signed in and protect access. Any optional analytics or advertising technology must be separately disclosed before use. Depending on applicable law, you may be entitled to request access, correction, deletion or other action concerning your personal information. Requests require appropriate identity and authority checks. We coordinate with your firm where appropriate and respond within applicable legal deadlines. You may ask support to review a declined request and contact the relevant regulator where applicable.

For privacy requests during the pilot, contact Tony Wallace at 11onedocksupport@gmail.com. This inbox handles both privacy and support inquiries. Describe your request without attaching client financial records, passwords or verification codes; we can arrange an appropriate way to provide any information needed.

Changes and scope

See account and data deletion requests for the current request process and support for access and security problems.

The service is intended for business use by authorized users, not for children. We identify each version and provide notice of material changes. Additional consent is obtained where required before a new use of information. This notice does not replace your firm’s professional engagement agreement or applicable statutory rights.