Privacy Policy

Capstone Accounting Group, LLC, 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, United States, is the controller of the information described here. Privacy questions and requests go to info@capsacg.com or +1 312 604 5253.

• Identity and contact details: name, business name, email address, telephone number, postal address.
• Engagement information you send us: bookkeeping records, bank and card statements, payroll data, tax identifiers and returns, and supporting documents.
• Account information: portal sign-in identifier, authentication provider, role, and activity such as document downloads and booking requests.
• Billing information: services purchased, amounts, invoice and receipt records, subscription status and renewal dates.
• Enquiry information: what you type into our contact and consultation forms.
• Technical information: IP address, device and browser type, and pages requested, used to keep the site secure and working.

Card numbers, expiry dates and security codes are entered directly into our payment processor's hosted card fields. We never see or store them; we retain only the processor's reference, the last-four digits it returns, and the amount.

• To deliver the accounting, tax, payroll and advisory services you engage us for.
• To take payment, issue receipts and invoices, and manage subscriptions and renewals.
• To respond to enquiries, schedule consultations and support you through the client portal.
• To meet legal, tax and professional record-keeping obligations, and to prevent fraud.
• To secure, maintain and improve this website.

We do not sell your information, we do not rent it to third parties, and we do not use your engagement records for advertising.

We disclose information only where it is needed to run the service or where the law requires it, and always under confidentiality obligations:

• Our own partners and staff assigned to your engagement.
• Our payment processor, to take card payments, manage subscriptions and issue receipts.
• Our cloud hosting and database provider, which stores the site and your records.
• Our email delivery provider, to send confirmations, receipts and service notifications.
• Tax authorities and regulators where a filing, request or professional standard requires it.
• Professional advisers, insurers and auditors where necessary to protect our legal position.

• All traffic to and from this website is encrypted in transit with TLS.
• Client records are held in an access-controlled database with row-level security, so a signed-in client can retrieve only their own orders, invoices, bookings and subscription data.
• Billing and staff records are readable only by authorised personnel holding an internal staff role, verified on the server on every request.
• Records are created only by verified server-side processes, such as signature-verified payment events; the browser cannot write to billing records.
• Card data is out of scope of our systems by design, since it is captured by our PCI-compliant processor.
• Access is reviewed when staff join or leave, and credentials are held in a managed secret store, not in application code.

Engagement records, returns, invoices and supporting documents are retained for at least seven years to meet tax and professional requirements. Enquiry records are kept for up to twenty-four months if they do not lead to an engagement. Portal accounts are kept while active and removed on request unless retention is legally required.

You may ask us to give you a copy of the information we hold about you, correct it, delete it where no retention obligation applies, restrict how we use it, or object to a particular use. You may also withdraw consent to marketing at any time. Email info@capsacg.com and we will respond within thirty days. We never charge you for making a request and we will not treat you differently for making one.

We use only cookies and local storage that are strictly necessary: keeping you signed in to the client portal and completing a secure checkout. We do not use advertising or cross-site tracking cookies. Blocking necessary cookies will stop the portal and checkout from working.

Our services are for businesses and adults; we do not knowingly collect information from children. Our hosting, payment and email providers may process data outside your state or country under contractual safeguards that require an equivalent level of protection.

We update this policy when our practices change and post the new version here with a revised date. If you are not satisfied with how we have handled your information, contact us first at info@capsacg.com; you also have the right to complain to your applicable data protection or consumer authority.