Privacy Policy

Usual is a client document collection service for accounting and bookkeeping firms. It is operated by Agentic Flow LLC, a Texas limited liability company ("Agentic Flow", "we", "us"). This policy explains what information we handle, why, and the choices you have.

1. Two kinds of information, two roles

Firm and website information. When a firm signs up, when its team uses Usual, and when anyone visits usual.so, we decide how that information is used. This policy governs it.

Client Data. Firms use Usual to collect information and documents from their own clients: answers to checklists, uploaded files, signatures, and sometimes Social Security numbers, EINs or bank account numbers. We handle Client Data only as a service provider to the firm, to run Usual for that firm and as our Terms of Service allow. The firm decides what it asks for and how long it keeps it, and the firm's own privacy notice applies to it. If you are a client of a firm, please contact your firm about your information; we will help the firm respond.

2. What we collect

From firms and their team

Account details: name, work email address, password (stored only as a one-way hash) and, if turned on, two-step verification settings.
Firm details: firm name, web address on usual.so, time zone, branding, sending domain, team members and their roles.
Billing details: plan and payment status. Card details are entered with Stripe and never reach our servers.
Support messages you send us.

Client Data, on a firm's behalf

Names, email addresses and phone numbers of the firm's client contacts.
Answers, uploaded documents, comments and e-signatures. For a signature we keep the signer's name, the time, IP address and browser as evidence of signing.
Identifiers a firm chooses to ask for, such as Social Security numbers, ITINs, EINs and bank account numbers.

From visitors who ask for updates or download the guide

If you sign up for updates on a usual.so page, we keep your email address, the page you signed up on, when you signed up, and the words you agreed to.
When you request the Month-End Field Guide, we keep your email address and the time of your first request in a separate download record.

From people who chat with us

If you start a chat on usual.so or in the app, we keep the messages, the name and email you give or are signed in with, and the page you were on, to answer you.

Automatically

Service records: IP address, browser type, the time of a request, and errors, kept to run and secure Usual.
An activity record of what happens in a firm's account (for example, who sent a request, who accepted a document, who viewed a full tax ID), which the firm can see.
On usual.so marketing pages, we use Cloudflare for visits, page interactions, guide downloads and visits to the email tool from the guide. These events can include approximate country, region and city. We use a random tab identifier to count activity within a visit and connect a trial link to completed signup. The analytics records contain the public path and referring domain, with no visitor-identification cookie, stored IP address, email, or account identifier in plain text. We do not track activity inside your workspace or the client portal for marketing.

3. Cookies

Our team can explicitly mark a browser as a team device. That browser saves a one-year preference cookie so our own visits and tests can be reported separately from other website visits. Clearing the site's cookies removes that preference.

For sign-in, we use a cookie that keeps staff signed in and one that remembers a client has verified their email on a device for up to 30 days. We use no advertising cookies and no third-party trackers. If you start a chat with us, our chat provider, Crisp, sets its own cookies to keep that conversation going; it loads only after you press the chat button.

4. How we use information

To provide Usual: hosting checklists and files, sending the requests, reminders and sign-in codes a firm sets up, scanning uploads for viruses, and showing firms what came in.
To run the firm's account: security notices, billing emails and, during the trial, a few emails about getting started (each person can turn these off).
To send the updates you asked for on usual.so: when a checklist you signed up on changes, and about once a month with new checklists and templates. Every one has an unsubscribe link.
To grant access to the Month-End Field Guide and keep a record of requests for it. The updates list has its own sign-up.
To keep Usual secure, prevent abuse, fix problems and answer support requests.
To meet legal obligations and enforce our Terms.

We do not sell personal information, share it for cross-context behavioral advertising, or use Client Data for marketing. We do not use Client Data to train artificial intelligence models.

5. Social Security numbers, EINs and bank account numbers

These are encrypted before they are stored, with a key unique to each firm. Usual shows only the last four digits. A full number is shown only to a firm member the firm has allowed to see it, who has two-step verification turned on, one number at a time, and every view is recorded in the firm's activity record. We never put these numbers in emails, text messages, web addresses, logs or analytics.

We share information only as described here:

The firm. Client Data belongs to the firm, and the firm's team members can see it according to the roles the firm sets.
Service providers that run parts of Usual for us, under contracts that limit their use of the data to providing their service:
- Cloudflare, Inc.: hosting, file storage, network security, virus-scanning infrastructure and website analytics.
- Neon (Databricks, Inc.): the database.
- ActiveCampaign, LLC (Postmark): email delivery.
- Stripe, Inc.: payments and subscription billing.
- Crisp IM SAS: support chat, only for conversations you start with us.
The firm's own cloud drive. When a firm connects its Google Drive or OneDrive, Usual copies the documents the firm accepts into a Usual folder in that drive, at the firm's direction. Usual can only see the files it creates there, never anything else in the drive. Usual's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements; it is used only to copy the firm's documents and never for advertising or to train AI models.
Legal reasons, when we believe in good faith that the law, a court order or a valid legal process requires it, or to protect the rights, safety or property of our customers, their clients, the public or us. Where the law allows, we tell the affected firm first.
A business transfer, if Agentic Flow or Usual is merged, acquired or sold, in which case this policy continues to apply to the information transferred.

We will tell firms before adding a service provider that handles Client Data, by updating this list.

7. Where information is kept

Usual is built for firms in the United States. Information is stored and processed in the United States. The one exception is support chat: Crisp, our chat provider, keeps chat conversations in the European Union, so please don’t share client documents, tax IDs or account numbers in chat.

8. How long we keep it

Client Data stays as long as the firm keeps it in Usual. Files a firm deletes go to its trash and are removed permanently after 90 days.
When a firm closes its account, it has 30 days to download its files and ask us for an export of the rest. We then delete its Client Data within 90 days of closing, except what the law requires us to keep.
Backups are kept for up to 8 weeks and then overwritten, so deleted data leaves backups within that time.
An updates sign-up is kept until you unsubscribe. After that we keep only the address and the date you unsubscribed, so we don't write to you again.
Account, billing and activity records are kept while the account is open and afterwards as long as needed for legal, tax and security purposes.

9. Security

We protect information with encryption in transit and at rest (each stored file under its own key, derived from a key unique to its firm), separate encryption of sensitive identifiers, isolation of each firm's data in the database, virus scanning of every upload before staff can open it, optional or firm-required two-step verification, role-based access and an activity record. The details are on our Security page. Many of our customers are financial institutions under the Gramm-Leach-Bliley Act; our safeguards are designed to support the requirements the FTC Safeguards Rule places on their service providers.

No system is perfectly secure. If we learn of a security incident affecting Client Data, we will notify the affected firms without undue delay and give them the information they need to meet their own obligations, and we will make any notices the law requires of us.

10. Your choices and rights

Firm members can update their account details in Usual, turn off non-essential emails in their notification settings, and ask us for a copy of their information or to delete it. Anyone on the updates list can leave it from the link in any update email, or by writing to support@usual.so.

Depending on where you live (for example California, Colorado, Connecticut, Virginia, Texas and other states), you may have the right to know what personal information we hold about you, to get a copy, to correct it, to delete it and to opt out of its sale or targeted advertising (we do neither). Email support@usual.so to make a request. We will confirm your identity, answer within 45 days, and not treat you differently for asking. An authorized agent may make a request for you with your written permission. If we decline a request, you may appeal by replying to our answer.

For Client Data, we pass requests to the firm that collected it and help the firm answer them.

11. Children

Usual is a service for businesses and is not directed to children. We do not knowingly collect information directly from children under 13. A firm may store information about its clients' dependents as part of Client Data; that information is handled under the firm's instructions as described above.

12. Changes to this policy

We will post any change on this page with a new date. If a change materially affects how we handle personal information, we will tell firm owners by email before it takes effect.

13. Contact

Agentic Flow LLC, Texas
Email: support@usual.so