The protection and privacy of your data, including personal data, is very important to Holistiplan ("Holistiplan" or "we"). This Privacy Policy discloses our privacy practices and the possible uses of the information that we gather through Holistiplan's websites and applications (collectively, the "Site") or which you otherwise submit to Holistiplan as part of our platform or service (collectively our "Services").
By using the Site or Services, you acknowledge that you have read and understood this Privacy Policy. Where required by applicable law, we will obtain your consent prior to processing your Personal Information (for example, for certain cookies or marketing communications). By default we use cookies where necessary in providing you our Services, for analytics, and for marketing purposes. If you do not agree to the terms and conditions of this Privacy Policy, including having your personally identifiable information ("Personal Information" as defined below) used in any of the ways described in this Privacy Policy, you may not be able to use certain parts or features of our Services, and in some instances, this may necessitate the revocation of your subscription or use of the Services. If you are using the Site or Services on behalf of a third party, you must separately obtain their consent before providing Holistiplan with their data.
This Privacy Policy is part of our Terms of Use, and all other terms governing use of our Site or Services. Please also visit our Terms of Use establishing your consent to the use, disclaimers, and limitations of liability governing the use of the Site or Services.
Holistiplan may assign you a user ID and a password as part of your participation and access to the Services. Your user ID and password may only be used by you. You may not share your user ID and password with anyone else and you are solely responsible for maintaining and protecting the confidentiality of your user ID and password. You are fully responsible for all activities that occur under your user ID and password.
You may also be provided a unique URL or link to upload files or documents ("Files") to Holistiplan's platform for processing by the platform and use by the firm or professional you work with. Such files may include Personal Information which is processed and used in accordance with this Privacy Policy. You may also receive a link from the firm or professional you work with to view data or a report from them.
"Personal Information" refers to information that identifies, relates to, describes, or could reasonably be linked to an identifiable individual, as defined by applicable privacy laws, such as your name and email. By voluntarily providing us with Personal Information you are consenting to our use of your Personal Information in accordance with this Privacy Policy. Submitted Data, as defined below, may include Personal Information.
"Submitted Data" means the financial, tax, estate, insurance, and related information and documents submitted through Holistiplan's Services for processing, regardless of who submits it or that person's relationship, if any, to the individual the information concerns. Submitted Data is stored and accessed exclusively within the United States.
"Subscriber Information" is Personal Information that consists of Subscriber account information — such as Subscriber names, email addresses, and phone numbers — may be accessed by authorized Holistiplan personnel and shared internally through approved operational tools in order to operate and support the Services, manage accounts, and carry out ordinary business activities. Such access is limited to personnel with a legitimate business need and is governed by Holistiplan's Access Control, Acceptable Use, and Acceptable Use of AI policies, as further described in the "Internal Operations and Tooling" section below. This internal access and use applies to Subscriber account information only; it does not extend to Submitted Data, which is handled as described above. Subscriber Information — specifically names and email addresses — may be accessed or processed outside the United States where authorized Holistiplan personnel use approved operational tools, as described in the "Internal Operations and Tooling" section below. Where required by law, we will implement appropriate safeguards for any such international transfers or access.
Holistiplan collects Personal Information in various ways, such as, by your voluntary submissions, through use of the Services, from third parties with your consent, and through cookie and other tracking technology. Holistiplan collects the following information:
We collect your Personal Information that you voluntarily provide as part of your registration process, uploading Files, or from use of the Site and Services.
If you are a firm or individual that subscribes to the Services and, for purposes of applicable data protection laws, acts as the data controller ("Subscriber"), we collect only your name, email address, phone number, firm name and logo file, in addition to the names and email addresses of any employees or other individuals you designate to access the Services under your account (each, an "Authorized User" — for example, a financial advisor, CPA, paraplanner, or member of your administrative or support staff). We may also ask for optional contact details or firm-related information to help customize our Services for you.
If you are a client of a Subscriber or are using the Service directly, we collect financial, estate, and insurance-related information that you or the firm or professional you work with submits through the Site or Service including, but not limited to: (i) tax documents, Files, or other relevant financial documents; (ii) estate planning information including wills, trusts, beneficiary designations, estate-distribution instructions, legacy preferences, and other related or similar records; and (iii) insurance data including policy numbers, coverage details, claims history, premium amounts, insurance declaration statements, and other similar or related documentation (Submitted Data). Holistiplan takes security of this data very seriously. Submitted Data does not need to include Personal Information, but it may include Personal Information depending on what you or the firm or professional you work with uploads. We do store names and non-identifying tax, estate, and insurance-related data so we can produce customized reports. While addresses are not stored in our database, scanned images of the tax, estate, and insurance-related files you uploaded do remain on the server unless manually deleted by the firm or professional you work with or automatically deleted in the event of a canceled subscription or application setting. When Submitted Data is deleted, all associated data related to the Submitted Data is also deleted from our database.
We will not sell your Personal Information or any information in the Submitted Data to any third party. We would only share Personal Information or Submitted Data for the specific circumstances outlined in the "How Information is Shared" section below.
We do not collect or store billing information directly. We use Stripe, Inc., a third-party billing processor which collects and stores your billing information and processes payments for the Services. You can review Stripe's privacy policy here: https://stripe.com/privacy-center/legal
We use the information we collect for: (1) personalizing your experience; (2) communication, advertising, marketing and marketing measurement; (3) research and development of features and products; (4) safety and security; (5) legal rights and business interest; and (6) where you provide consent for a specific purpose. How we use the information we collect also depends in part on which Services you use, how you use them, and any preferences you have communicated to us. Below are the specific purposes for which we use the Personal Information we collect about you.
Submitted Data. Submitted Data (i.e., client tax return information) is not disclosed to any outside party by Holistiplan. Sharing of such data occurs only under the following circumstances:
Personal Information. Personal Information other than Submitted Data, is not disclosed to third parties, except when one or more of the following conditions is true:
Holistiplan uses the following third-party service providers in connection with the operation of the Site and Services. These providers receive or process Personal Information as part of delivering services to Holistiplan:
To support our internal business operations, including customer support, account management, and service delivery, limited Personal Information, specifically Subscriber names, email addresses, and phone numbers may be accessed by authorized Holistiplan personnel using approved internal collaboration and productivity tools. Such access is limited to personnel with a legitimate business need and is governed by Holistiplan's Access Control, Acceptable Use, and Acceptable Use of AI policies. Examples of such tools are listed below:
When Subscribers initiate data sharing through Holistiplan, client information may be transmitted to the following third parties:
Our Site and Services contain links to third-party applications and websites operated by parties other than Holistiplan. Holistiplan does not control such other sites and is not responsible for their content, their privacy policies, or their use of any information. Holistiplan does not support or endorse any third party unless Holistiplan expressly states such support or endorsement. Any information submitted by you to these third parties is subject to that third party's privacy policy. In addition, if you click on links, which take you to third party websites or applications, you may be subject to the third parties' privacy policies and terms of use. While we support the protection of our customer's privacy on the Internet, Holistiplan expressly disclaims any and all liability for the actions of third parties, including but without limitation to actions relating to the use and/or disclosure of Personal Information by third parties.
In addition to internal use of AI tools described above, we use generative artificial intelligence ("AI") technologies to power features across our platform, including extracting and summarizing Submitted Data explaining concepts and answering questions through an AI chat capability, and in certain features, performing actions within the application on your behalf (such as updating records or drafting communications for your review and approval). These features are powered by AWS services – Amazon Textract for document data extraction and Amazon Bedrock for generative capabilities – which process Submitted Data within Holistiplan's AWS environment in the United States. Submitted Data processed through these services is not used to train or improve AWS, model provider, or other machine-learning models, and is not shared with model providers.
AI-generated content — including summaries, explanations, and drafted text — is provided for informational purposes only and does not constitute legal, tax, or other professional advice. Where AI proposes communications or document language, those drafts are presented for your explicit review and approval before any action is taken.
Subscribing firms may disable certain AI-powered features — including the AI chat capability and agentic features — for their Authorized Users through their account settings. The use of AI for document data extraction is integral to core platform functionality and is not subject to this opt-out.
To deliver and improve our platform, we process the data you and your clients submit (such as tax documents, financial details, and questions posed through our AI features) in accordance with our agreements with subscribing firms and applicable law. We may observe usage patterns and representative interactions in an aggregated or de-identified manner to inform product design and improve the quality of AI features. We do not use Submitted Data to train third-party AI models. This processing is subject to the same security measures described elsewhere in this Privacy Policy.
As a Subscriber or Authorized User, both you and your clients are data subjects and data owners. Under applicable data protection laws, you and your clients may have certain rights with respect to Personal Information, including the right to:
These rights are commonly referred to as "data subject rights" or "Personal Rights."
Holistiplan acts as a processor of Personal Information. This means that we process Personal Information on behalf of our Subscribers, who are the controllers of that data.
Accordingly, any request to exercise your Personal Rights must be made directly to the firm or professional you work with (the Subscriber), who will validate and manage the request as the controller. Holistiplan will cooperate with and support our Subscribers in responding to such requests in accordance with applicable data protection requirements and our contractual obligations.
Where permitted by law, Subscriber or Authorized User may submit requests. We may require verification before processing requests. If you contact Holistiplan directly with a request, we will notify the appropriate Subscriber (your data controller) so that they may respond to you in accordance with applicable law.
This Privacy Policy does not provide for individual exceptions. Our processing activities are governed by applicable law and our agreements with Subscribers.
Questions or concerns about this Privacy Policy may be directed to support@holistiplan.com