Privacy policy
Effective September 11, 2026
Protected Xchange ("the Service") is operated by Build Your Firm, Inc. ("we", "us"). It is a document-exchange portal that accounting firms ("Firms") use to share files securely with their clients. This policy explains what information the Service collects, how it is used, and the choices you have. Your Firm is responsible for the documents it exchanges with you and for how it uses your information; this policy covers the Service itself.
Information we collect
- Account information. Your name, email address, company name and phone number, provided by you or by the Firm that invited you, plus your password (stored only as a one-way hash) and any two-factor authentication settings.
- Files and messages. The documents you upload or receive, their titles, and any notes attached to them. These are visible only to you and to staff at your Firm.
- Usage and device information. IP address, browser type, sign-in times, and a record of file activity (uploads, downloads, deletions), which Firms can review for their own account.
- Email delivery information. Whether the notifications we send are delivered, bounced or reported, so we can stop sending to addresses that don't work.
How we use it
- To operate the Service: authenticate you, store and deliver files, and send transactional emails such as invitations, file notifications and password resets.
- To keep the Service secure: scan uploads for malware, detect abuse, rate-limit sign-in attempts, and investigate incidents.
- To support you and your Firm when you contact us.
We do not sell personal information and we do not use it for advertising. We only send marketing email to Firms that have asked for it, never to Firm clients.
Who we share it with
- Your Firm. Staff at the Firm that invited you can see your account details, the files you exchange and your file activity.
- Service providers that host and run the Service on our behalf: Amazon Web Services (hosting, file storage and email delivery, United States), Cloudflare (DNS and bot protection) and Sentry (error monitoring). They process data only to provide those services to us.
- Legal requirements. When required by law, subpoena or court order, or to protect the rights and safety of users, Firms or the public.
Cookies
The Service uses strictly necessary cookies only: a session cookie to keep you signed in and a CSRF token to protect forms. Sign-in pages use Cloudflare Turnstile to block automated abuse, which may set its own cookie. We do not use advertising or cross-site tracking cookies.
Retention
Files are kept until they expire, are deleted by you or your Firm, or the Firm's account is closed. Account information is kept while your account exists and for a limited period afterwards for security and backup purposes. Files that fail a malware scan are quarantined and removed.
Security
All connections to the Service use TLS. Files are stored encrypted at rest, every upload is scanned for malware before it can be downloaded, and two-factor authentication is available on every account. No method of transmission or storage is completely secure, so please keep your password private and contact your Firm immediately if you suspect your account has been accessed by someone else.
Your choices
- You can update your name, contact details and notification preferences from your profile after signing in.
- To correct or delete account information, or to close your account, contact your Firm — they administer the accounts in their portal.
- For anything else, contact us using the details below.
Children
The Service is intended for adults exchanging business and tax documents with their accountants. We do not knowingly collect information from children under 13.
Changes to this policy
We may update this policy from time to time. The effective date at the top will change when we do, and material changes will be announced within the Service.
Contact
Build Your Firm, Inc.
7 Orchard Park Rd., Suite 3
Madison, CT 06443
support@protectedxchange.com