US Privacy Policy

CORAA drafts audit and review working papers for US CPA firms from the books a client already keeps. The firm reviews the papers and signs its own reports; CORAA does not sign or issue anything. For personal data that forms part of a client’s financial records, the CPA firm decides why and how the data is used and CORAA processes it on the firm’s instructions.

• Your data is yours. The firm keeps all right, title and interest in the customer data it sends us.
• We do not use customer data to train any machine learning models.
• You have a right to deletion. You can ask us to delete your data at any time.
• We respond to data subject requests. Contact privacy@coraa.ai.

We act as a processor of customer data and as a controller for our own operational data.

• Firm waitlist. Your name, work email, firm name, role, state and the size of your firm.
• Reviewer application. Your name, email, qualification, years of experience on US files and your LinkedIn profile address.
• Sent with each form. The page you were on, the page that referred you, the campaign tags (UTM parameters) on your link, your browser and device details, and the pages you opened in that browser session before sending the form.
• Site usage. Pages viewed, clicks, approximate location and device information through analytics tools, including whether a form was viewed, started or sent (never what you typed). Some analytics tools record how a page is used, such as clicks and scrolling.
• Engagement data. When a CPA firm engages us, it sends financial records of its clients: ledgers, trial balances, bank statements, source documents and the working papers and audit trails produced in the service. We process that data only on the firm’s instructions under a written agreement with the firm, which governs it in place of this policy.
• Support data. Communications with our team.

• To provide, secure and improve the services.
• To reply to you, send a confirmation email, set up calls and run the waitlist or reviewer selection.
• To understand which pages and campaigns are useful, and to improve the site.
• To prevent abuse, keep the service reliable, comply with law and enforce our agreements.

The CORAA team members who handle the waitlist, reviewer selection and client files. A copy of each form submission is emailed to our team and added to our lead record. We do not give waitlist entries or applications to other firms or to other reviewers. We use vetted service providers that act on our instructions, in these categories: business productivity and record keeping (including spreadsheets), email delivery, site analytics and cloud infrastructure. We enter data protection terms with them and apply appropriate safeguards for any international transfers. They may only use the information to provide their service to us.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use customer data to train AI models.

We use technical and organizational measures appropriate to the risk, including encryption in transit and at rest, access controls, multi-factor sign-in for administrative access and audit logging, and we limit access to authorized personnel. CORAA is ISO/IEC 27001:2022 certified. Before a firm uploads any client file we give it our security and data-handling pack in writing.

We keep customer data as long as the firm’s account is active or as needed to provide the services and meet legal obligations. On termination or on the firm’s request we delete or return it as the agreement with the firm sets out. Waitlist entries and applications, with the emails we exchange about them, are kept while the program or the reviewer pool is active and then deleted, or earlier on request. Analytics data follows each analytics tool’s own retention settings.

Depending on where you live, you may have rights to access, correct, delete, restrict, object to the processing of, or move your personal data. To use any of them, write to privacy@coraa.ai from the email address you gave us and say what you want: a copy of what we hold, a correction, deletion, or no more contact. We will verify your request and reply to confirm what we did. To stop only the emails, reply “stop” to any email from us.

State privacy laws, for example in California, may give residents further rights, such as knowing what we collect, correcting it, deleting it and opting out of sale or targeted advertising. We do not sell your information or use it for targeted advertising, and we will not treat you differently for using these rights. Use the email above to make a request.

A CPA firm is responsible for the lawfulness of the client data it sends us, including giving any notices to, and obtaining any consents from, the individuals the data is about.

Our services are for business use and are not directed to children under 18. We do not knowingly collect personal data from children.

We may update this policy to reflect operational, legal or regulatory changes. We post the updated policy with a new date and, if the changes are material, give additional notice.

• Privacy requests: privacy@coraa.ai
• Support: audit@coraa.ai
• Cause Connect Pte. Ltd. (UEN 202517084E), 68 Circular Road, #02-01, Singapore 049422

Do you use customer data to train models?

No. We do not use customer data to train any machine learning models.

How can I request deletion?

Email privacy@coraa.ai. We will verify your request and delete the data as required.

Who is the data controller?

Cause Connect Pte. Ltd., operating under the brand CORAA, for the personal data described in this policy. For client financial records, the CPA firm is in control and we act on its instructions.