Privacy notice

• Your account: your email address (for sign-in links and reminder emails), the practice name and the practice size you declare.
• Your client roster, attributes only: each client’s name and your own reference code, entity type and tax classification, states, fiscal year-end, payroll and deposit schedule, registrations, elections, categorical bands and the other attestations you record. Never a Social Security number, an EIN, a financial figure or a document — the importer drops those columns and notes refuse those shapes.
• What you do with the calendars: done and extended marks, notes, reminder settings, calendar-feed versions and when a calendar app last fetched them, and an audit trail of rule changes you applied or undid.
• Billing status: plan, status and renewal date. Card details go to Stripe and never reach us.

We use this to run the service for you and for nothing else. We do not sell or rent it, and we do not use it for advertising.

Only in one place, and only if the operator has configured it: when you import a roster, the importer may send the column headers and de-identified category spellings (such as “S Corp” or “semi-weekly”) to Anthropic’s API to suggest how they map. It never sends a client name, a code, an identifier, an amount or a row. Values that look like an email address or a long number are dropped before sending. You confirm every suggestion before anything is saved, and manual mapping works without it. No model computes, proposes or edits a due date.

An event log records product events — page views, calendar downloads and feed fetches, sign-up, roster imported, first calendar generated, subscription started — with counts and ids only: never a client name, an email address, an IP address or a user agent. To count unique visitors per day without storing who they are, the log keeps a hash of the IP address and browser under a secret that changes every day, so two days cannot be joined. It also records a coarse referrer class (search, AI assistant, direct, outreach, other).

If error monitoring (Sentry) is enabled, error reports are scrubbed before they leave the server: sign-in and feed tokens, keys, email addresses, roster fields and known client names are removed, and a report that cannot be scrubbed is dropped.

• Sign-in session cookies, while you are signed in.
• On the public calendar pages, a random subscriber token when you copy a feed URL (kept a year), so repeat copies reuse one address.
• A campaign code if you arrive from one of our outreach links (kept 90 days). It names the campaign, not you.

No advertising or cross-site tracking cookies are set.

• Supabase — the database and sign-in.
• Vercel — hosting; it keeps short-lived request logs.
• Stripe — subscription payments.
• Postmark — email delivery for sign-in links and reminder emails.
• Anthropic — import mapping suggestions, as described above, only if configured.
• Sentry — error monitoring, only if enabled, scrubbed as described above.

Each handles the data only to provide its service to us.

The roster, calendars, marks and notes are kept while the account exists, including after a subscription ends, so you keep read and export access. You can delete any client from the Clients page at any time; that removes the client from the database. To delete the whole practice account, write to us at the address below and we will delete the account, roster, calendars and settings within 30 days, except billing records we must keep for tax purposes. Database backups roll off on the hosting provider’s schedule.

The event log holds no names or contact details and is kept to measure how the service is used. Reminder-email records keep the date sent, the number of obligations named and which ones, so the same reminder is not sent twice; they are deleted with the client or the account.

We keep the reasonable safeguards New York’s SHIELD Act requires: access limited per practice in the database itself, secrets scrubbed from the application’s own logs and error reports, and calendar-feed tokens stored only as hashes. If a breach affects private information about a New York resident, notice follows as New York General Business Law § 899-aa requires — in the most expedient time possible and without unreasonable delay — and as other state and federal breach-notification laws require.

The effective date above moves when the wording does. If what is collected changes, this notice changes first. The terms of service cover everything else about using the service.

By mail: Lyra Ventures LLC, 348 4th Avenue Ste 1031, Brooklyn, NY 11215, United States.

By email: support@filingdates.com.