Privacy Policy
Effective Date: October 18, 2026
Last Updated: October 18, 2026
Thorn & Associates, LLC (“Thorn & Associates,” “we,” “our,” or “us”) respects your privacy and is committed to protecting the personal information entrusted to us. This Privacy Policy explains how we collect, use, disclose, store, and protect information when you visit thornandassociates.com, contact us, request our services, or otherwise interact with our business.
Our services include bookkeeping, accounting support, payroll services, financial reporting, cash flow forecasting, sales tax support, QuickBooks assistance, and business consulting.
By using our website, you acknowledge that you have read this Privacy Policy.
1. Information We Collect
We may collect the following categories of information, depending on how you interact with us.
A. Personal and Contact Information
When you submit a contact form, request an estimate, schedule a consultation, or communicate with us, we may collect:
Name and business name
Email address
Telephone number
Business address and other contact details
Business entity type
Estimated monthly gross sales, if provided through our forms
Inquiry subject, message content, and service preferences
Other information you voluntarily provide
B. Business and Financial Information
If you engage our professional services, we may collect or receive business and financial information necessary to perform the agreed services, including:
Bookkeeping records and transaction details
Bank and credit card statements
Financial statements and accounting reports
Payroll records and employee-related information
Sales tax and related business records
Invoices, receipts, expense records, and supporting documents
Business tax-related information provided for bookkeeping or other agreed services
Information maintained in accounting platforms, including QuickBooks Online or other supported software
We collect this information only as reasonably necessary for the services requested, subject to applicable law and our agreements with clients.
Please do not submit sensitive financial records, Social Security numbers, banking credentials, or other confidential information through general website contact forms. Use the secure document-sharing methods we designate for client work.
C. Technical and Usage Information
When you visit our website, certain information may be collected automatically, depending on our website configuration and the technologies in use. This may include:
Internet Protocol (IP) address
Browser type and version
Device and operating system information
Pages visited and time spent on pages
Referring websites and navigation activity
Approximate location derived from your IP address
Website performance, diagnostic, and interaction data
D. Cookies and Similar Technologies
Our website or third-party services may use cookies, pixels, tags, or similar technologies to support website functionality, understand visitor behavior, measure marketing performance, and improve user experience.
You can manage cookies through your browser settings. Where legally required, we will provide appropriate consent mechanisms before using nonessential cookies or similar tracking technologies.
Disabling certain cookies may affect some website functionality.
2. How We Use Your Information
We may use collected information for the following purposes:
Responding to inquiries and requests for estimates
Scheduling consultations and communicating with prospective clients
Providing and managing bookkeeping, accounting, payroll, and consulting services
Reviewing and processing financial records and supporting documents
Preparing reports, reconciliations, forecasts, and other agreed deliverables
Managing client relationships, service agreements, and billing
Coordinating document exchange through authorized service providers
Maintaining website functionality, security, and performance
Understanding website traffic and improving our content and services
Sending service-related communications and, where permitted, marketing communications
Detecting fraud, preventing unauthorized access, and addressing security incidents
Complying with legal, regulatory, accounting, and recordkeeping obligations
Establishing, exercising, or defending legal claims
We will not use personal information for materially different purposes without providing any notice or obtaining any consent required by applicable law.
3. How We Share Information
We do not disclose client information indiscriminately. We may share information in the following circumstances.
A. Service Providers
We may share information with trusted providers that support our business operations, such as:
QuickBooks Online and other authorized accounting platforms
Dropbox, Google Drive, and other approved document-sharing services
Website hosting, maintenance, security, and technical support providers
Scheduling, communication, email, and customer relationship management platforms
Analytics and marketing service providers, where applicable
Professional advisers and other vendors assisting with our operations
These providers may access information only as appropriate for their services and subject to applicable contractual, confidentiality, and legal requirements.
B. Legal Requirements
We may disclose information when required by law, court order, subpoena, regulatory request, or other lawful process, or when disclosure is reasonably necessary to protect our rights, property, personnel, clients, or the public.
C. Business Transactions
If our business undergoes a merger, acquisition, restructuring, or sale of assets, information may be transferred as part of the transaction, subject to applicable privacy protections.
D. With Your Authorization
We may share information with third parties when you direct us to do so or provide the authorization required for the disclosure.
We do not sell personal information for monetary consideration. Whether our use of analytics or advertising technologies constitutes “sharing” under applicable privacy laws depends on the technologies and configurations actually in use. We will provide applicable opt-out rights where required.
4. Confidentiality of Client Financial Information
We understand that accounting and bookkeeping engagements involve confidential business and financial records.
We take reasonable administrative, technical, and organizational measures designed to protect information against unauthorized access, disclosure, alteration, and loss. These measures may include access restrictions, secure document-sharing procedures, confidentiality requirements, and appropriate security practices.
Client information is accessed only by authorized personnel and service providers who require it for legitimate business purposes.
No website, electronic transmission, or storage system can be guaranteed to be completely secure. We therefore encourage clients to use designated secure channels when sharing financial records and other confidential documents.
The confidentiality provisions in this Privacy Policy supplement, rather than replace, any applicable engagement letter, service agreement, nondisclosure agreement, or other contractual obligation.
5. Data Retention
We retain personal and business information for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, including providing services, maintaining business records, resolving disputes, enforcing agreements, and complying with legal or regulatory obligations.
Retention periods may vary depending on the type of information, the nature of the client engagement, applicable recordkeeping requirements, and any pending legal matters.
When information is no longer reasonably required, we will take appropriate steps to delete it, securely dispose of it, or de-identify it, subject to applicable law and legitimate retention obligations.
6. Your Privacy Rights
Depending on your location and applicable law, you may have rights concerning your personal information.
These rights may include the right to:
Access: Request information about the personal information we collect, use, or disclose about you.
Correction: Request correction of inaccurate personal information.
Deletion: Request deletion of personal information, subject to legal and other applicable exceptions.
Data portability: Request a copy of certain personal information in a portable format where required by law.
Opt out: Opt out of certain sales, sharing, or targeted advertising practices where applicable.
Limit certain uses: Request limits on the use or disclosure of sensitive personal information where provided by law.
Withdraw consent: Withdraw consent where our processing is based on consent, subject to applicable limitations.
Non-discrimination: Exercise applicable privacy rights without unlawful discrimination.
These rights are not absolute. For example, we may need to retain certain financial records to satisfy legal obligations, protect against fraud, complete a transaction, or establish or defend legal claims.
California Privacy Rights
If you are a California resident and the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”), applies to our processing of your information, you may have additional rights, subject to statutory exceptions.
These may include the right to know the categories and specific pieces of personal information collected about you, the sources of that information, the purposes for collecting it, and the categories of third parties to whom it is disclosed. You may also have rights to request deletion or correction, opt out of the sale or sharing of personal information, and limit certain uses of sensitive personal information.
We will honor applicable requests and recognize qualifying opt-out preference signals, including Global Privacy Control, where required by law.
We do not knowingly sell or share personal information of consumers under 16 years of age.
How to Exercise Your Rights
To submit a privacy request, contact us using the contact information in Section 13 or through the contact form on our website.
Please describe your request and provide sufficient information for us to identify the relevant records. We may request additional information to verify your identity or authority to make the request. We will use verification information only as permitted by applicable law.
An authorized agent may submit a request on your behalf where permitted by law. We may require proof of authorization and, where applicable, verification of your identity.
We will respond within the timeframe required by applicable law.
7. Email and Marketing Communications
We may send you service-related communications concerning consultations, engagement administration, document requests, and other matters relevant to your relationship with us.
Where permitted by law, we may also send business updates, educational content, or marketing communications.
You may unsubscribe from marketing emails by using the unsubscribe instructions included in the message or contacting us directly. Opting out of marketing communications will not prevent us from sending essential service-related messages.
8. Third-Party Websites and Services
Our website and service communications may contain links to third-party websites, platforms, or applications, including accounting and document-sharing services.
Those third parties maintain their own privacy policies and practices. We do not control their independent data collection or processing, and we encourage you to review their privacy policies before providing information.
Your use of third-party platforms may also be governed by separate service agreements and account settings.
9. Children’s Privacy
Our website and professional services are intended for businesses, business owners, and adults. We do not knowingly collect personal information directly from children under 13 through our website for general marketing or website use.
If we learn that we have collected personal information from a child in a manner that violates applicable law, we will take appropriate steps to address the information.
Business records provided to us by a client may incidentally contain information relating to minors. Such information will be handled only as reasonably necessary for the authorized engagement and in accordance with applicable law.
10. International Data Transfers
Thorn & Associates is based in the United States. Some of our technology and service providers may process or store information in other jurisdictions.
Where personal information is transferred across borders, we will take steps required by applicable law to protect the information and support appropriate handling of that data.
11. Data Breaches and Security Incidents
We maintain safeguards designed to reduce the risk of unauthorized access, use, or disclosure of personal information.
If a security incident affects personal information and applicable law requires notification, we will provide notice to affected individuals and relevant authorities as required by law.
We cannot guarantee that every security incident can be prevented, but we will take reasonable steps to investigate and respond to incidents within our control.
12. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our business practices, technology, services, or applicable legal requirements.
When we make changes, we will update the “Last Updated” date at the beginning of this policy. Where required by law, we will provide additional notice or obtain consent before implementing material changes.
We encourage you to review this page periodically.
13. Contact Us
If you have questions about this Privacy Policy, our information practices, or your privacy rights, please contact:
Thorn & Associates, LLC
3554 Round Barn Blvd., Suite 205
Santa Rosa, CA 95403
United States
Phone: 707-536-1002
Website: https://thornandassociates.com/
You may also submit your inquiry through our website’s Contact Us page.
Please do not include Social Security numbers, bank account details, passwords, or other sensitive financial information in general privacy inquiries.
This Privacy Policy describes our intended privacy practices and is not a substitute for legal advice. It should be reviewed against our actual data collection, advertising, analytics, vendor, and client-recordkeeping practices before publication.
