Privacy Notice

EC Portal is operated by Emplifi Consulting (“Emplifi”, “we”, “us”), the firm engaged to prepare R&D Tax Credit and Cost Segregation studies for its clients. For the information in the portal, Emplifi decides why and how it is used. This notice explains what the portal collects, what it is used for, who else handles it, how long it is kept, and what you can ask of us.

Your account. Your name, email address and password (stored only as a hash), or the identity Google provides when you sign in with Google; a profile photo if you add one; your notification, appearance and sound preferences.

The client and its people. The client company’s legal name, addresses, industry and website; the names, titles, email addresses and phone numbers of its contacts; who at the client is enrolled on which entity.

Documents. The files uploaded for a study — typically payroll and wage detail, employee lists, project lists and hours, contracts, financial statements and tax returns — with their names, sizes, who uploaded them and when. These often contain personal information about the client’s employees and owners.

Messages and activity. Messages written in the portal’s threads; what was asked for, uploaded, released, downloaded and finished, and when; which pages an account opened.

Correspondence. An Emplifi team member may keep an email exchanged with the client in the portal — its text, sender, recipients and attachments — so the engagement team can read it in one place. The portal itself sends no email.

Security records. Sign-ins and sign-in attempts, the IP address and browser used, download and upload events, and refused requests. These are kept to protect the portal and its users.

Usage measurements. Vercel Analytics and Speed Insights record page views and page performance in aggregate to help us keep the portal fast. They do not use advertising cookies.

• To perform the engagement: to receive the documents a study needs, prepare the study, and deliver it.
• To run the portal: to show each account only what it may see, to tell people what is waiting on them, and to keep a record of what happened.
• To keep the portal safe: to detect misuse, refuse malware, limit bulk downloads and investigate incidents.
• To meet our legal and professional obligations, including keeping the records a tax study requires.

Emplifi does not sell personal information and does not share it for advertising. The portal is built on services that process information on our behalf:

• Supabase — the database, sign-in and file storage, hosted in the United States (us-east-1). Files are encrypted at rest and in transit.
• Vercel — hosts the portal’s pages and provides the usage measurements above.
• Google — sign in with Google, when you choose it. Emplifi team members may also connect their own Gmail and Calendar to keep correspondence in the portal; a client account never connects a Google account.
• Resend — receives email that an Emplifi team member forwards to a client record’s portal address.
• Google Cloud — runs the virus scan on every uploaded file before it can be downloaded.
• Microsoft — shows Word 97–2003, Excel 97–2003 and PowerPoint files in the portal’s viewer: when one is opened there, the file is sent to Microsoft’s Office viewer through a link that expires in five minutes. Every other kind of file is shown by your own browser.

Within the portal, information about a client is visible to the Emplifi team members enrolled on that client, to Emplifi administrators, and to the client’s own enrolled contacts on the entities and items they are given. It is never visible to another client.

We may also disclose information where the law requires it, or to establish or defend a legal claim.

Documents and messages are kept for the life of the engagement and for as long as we are required to keep the records of a tax study after it is delivered. A document deleted in the portal is set aside and can be restored for a time; it is then removed with the study’s records at the end of that period.

An account that is deactivated keeps its name on the records of what it did, so the history of a study stays complete; it can no longer sign in. Security records are kept for as long as they are useful to investigate an incident.

• Every read and write is checked against what the signed-in account may see, by the database itself.
• A file can be downloaded only after it has passed a virus scan and has been released to the client.
• Downloads and sign-ins are rate-limited; unusual activity raises an alert and can lock an account until an administrator looks at it.
• Connections use TLS; files and the database are encrypted at rest by the hosting provider.
• Emplifi team members and administrators see only the clients they are enrolled on, and every action is logged.

The portal uses cookies that are necessary to keep you signed in and to remember your appearance, colour and sound preferences. The usage measurements above set no advertising cookies. You can clear cookies in your browser; you will be signed out.

You can see and change your name, photo and preferences under Settings, and switch each kind of notification off there. To see, correct or remove other information about you — or to ask what the portal holds — contact your engagement lead. Depending on where you live, you may have rights under privacy law to access, correct, delete or restrict the use of your personal information; we honour those requests within the time the law allows, subject to the records we must keep.

Personal information about a client’s employees in the documents a client uploads is provided by the client, which is responsible for having the right to share it. Requests about that information should go to the client, who can involve us.

We may update this notice. The effective date at the top changes when we do, and the current version is always at this address.

Questions about this notice go to your Emplifi engagement lead, or to Emplifi Consulting through the contact details on emplificonsulting.com. The Terms of Use set out the rules for using the portal.