Privacy Policy

IOLTATrusts is a product of Bit Base Studio LLC ("we," "us," or "our"). We provide attorney trust accounting software accessible at www.ioltatrusts.com. Our platform helps law firms manage IOLTA (Interest on Lawyers' Trust Accounts) trust accounts, track client ledgers, reconcile bank statements, and maintain compliance with state bar requirements.

Contact: Brian Lee · admin@ioltatrusts.com · www.ioltatrusts.com

Information You Provide

When you create an account or use our platform, we collect:

• •Account registration: firm name, your name, email address, and password
• •Billing information: credit card details processed by Stripe — we do not store card numbers
• •Firm information: address, tax identification number, and trust account details
• •Client records: client names, contact information, and matter details you enter
• •Trust account records: deposits, disbursements, check numbers, payees, memos, and ledger entries
• •Support communications: messages you send us

Information from Bank Connections (via Plaid)

If you connect a bank account using our Plaid integration, we receive through Plaid's API:

• •Bank account and routing numbers
• •Account type and institution name
• •Real-time and historical account balances
• •Transaction history for bank feed import and reconciliation

Plaid's own privacy policy governs data collected during account linking. Review Plaid's privacy policy →

Information from QuickBooks Online (via Intuit OAuth)

If you connect a QuickBooks Online ("QBO") account, we access QBO on your behalf using OAuth 2.0 tokens that you authorize through Intuit's official authorization flow. We collect:

• •Chart-of-accounts data (account names, types, and IDs) — used to populate account mapping dropdowns
• •Customer records (names, emails, phone numbers) — used only if you choose to import QBO customers as IOLTATrusts clients
• •OAuth access tokens and refresh tokens — stored encrypted (AES-256) at rest and never logged or exposed

We write journal entries to your QBO company file to reflect trust transactions you post in IOLTATrusts. We do not read, store, or share any QBO data beyond what is described above. We comply with Intuit's developer data-handling requirements. You can revoke QBO access at any time from the Integrations page — this immediately deletes your tokens and revokes our access with Intuit.

Information Collected Automatically

• •IP address and browser type
• •Pages visited and features used within the application
• •Login timestamps and activity logs
• •Error logs and performance data

This data is used to operate, secure, and improve the platform. We do not use it for advertising.

We use the information we collect to:

• •Provide and operate the IOLTATrusts platform, including trust accounting, reconciliation, and reporting features
• •Process your subscription payments through Stripe
• •Connect to and retrieve data from your bank accounts via Plaid, at your direction
• •Send transactional emails including account statements, reports, and security notifications
• •Respond to your support requests
• •Monitor for security threats, unauthorized access, and fraud
• •Improve the platform based on usage patterns and feedback
• •Comply with legal and regulatory obligations

We do not use your data or your clients' financial data for advertising, profiling, or sale to third parties.

We do not sell your personal information. We share data only in these limited circumstances:

Service Providers

• •Intuit (QuickBooks Online) — accounting ledger sync via OAuth 2.0, if you connect QBO
• •Plaid — bank account linking and financial data retrieval, if you connect a bank feed
• •Stripe — payment processing and subscription management
• •Vercel — frontend application hosting
• •Google (Gmail SMTP) — transactional email delivery

Legal Requirements

We may disclose information if required by law, court order, or to protect the rights, property, or safety of IOLTATrusts, our users, or the public.

Business Transfers

If IOLTATrusts is acquired or merged, customer data may transfer as part of that transaction. We will notify affected users beforehand.

• •Active account data is retained for the duration of your subscription
• •Trust account transaction records are retained for a minimum of 7 years to comply with attorney trust account regulations
• •After account cancellation, your data is retained for 90 days to allow for export, then permanently deleted or anonymized
• •Billing records may be retained longer as required by tax law

To request earlier deletion of non-legally-required data, contact us at admin@ioltatrusts.com. We will process requests within 30 days.

• •All data in transit is encrypted using TLS 1.2 or higher
• •Data at rest is stored on encrypted infrastructure
• •Access to production systems is restricted to authorized personnel via SSH key authentication
• •Passwords are hashed using industry-standard algorithms and never stored in plain text
• •Multi-factor authentication (TOTP and passkeys) is required for all user accounts
• •Plaid access tokens are stored encrypted and accessed only to serve authenticated requests

In the event of a data breach affecting your information, we will notify you as required by applicable law.

IOLTATrusts uses session cookies and local browser storage to maintain your authenticated session. We do not use third-party advertising cookies or tracking pixels. We do not share browsing data with advertising networks.

You may configure your browser to refuse cookies, though this will prevent you from logging in to the platform.

• •Intuit / QuickBooks Online — accounting ledger sync (optional). If you connect QBO, Intuit's privacy policy governs how Intuit handles your data on their platform. We handle your QBO OAuth tokens as described in Section 2.
• •Plaid — financial data aggregation. Plaid's privacy policy governs how Plaid handles your data during the account-linking process.
• •Stripe — payment processing. Stripe handles billing information directly and is PCI DSS Level 1 certified.
• •Vercel — hosting for the web application frontend.

IOLTATrusts is a professional software platform intended for law firms and legal professionals. We do not knowingly collect personal information from anyone under the age of 18. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and update the effective date at the top of this policy. Continued use of the platform after the effective date constitutes your acceptance of the changes.

If you have questions, concerns, or requests regarding this Privacy Policy, contact:

We will respond to all privacy-related inquiries within 10 business days.