This policy explains how Infinite Office LLC ("Infinite Office", "we", "us") collects, uses, stores and protects information across the Infinite Office website, Command Center, and ClientBox.
Our products are used by accounting firms and businesses to manage records that often belong to their clients. That creates two distinct relationships, and different rules apply to each.
If you are a client of a firm that uses ClientBox and you have questions about your documents, contact that firm directly — they control the record. We will support them in responding.
ClientBox exists to process documents, so it is worth being explicit about what that means. Documents sent into ClientBox — by upload, by email to an intake address, by photograph, or by text message — commonly contain financial and personal information, including bank statements, invoices, receipts, tax documents, insurance policies, and correspondence.
We process this material in order to:
We do not sell document data. We do not use customer documents or their contents to train artificial intelligence models, and we do not permit our service providers to do so. Any automated classification is performed solely to deliver the service to the customer whose document it is.
AI-assisted classification is an optional premium add-on. It is off unless a customer chooses to enable it.
Where the add-on is not enabled, document contents are never sent to a third-party AI provider. Classification runs without document content leaving our infrastructure.
Where a customer does enable it, document contents are sent to Anthropic's commercial API for the sole purpose of proposing a classification. Under Anthropic's commercial terms, those inputs and outputs are not used to train models. A customer can disable the add-on at any time, after which no further document content is sent to that provider.
We do not sell personal information, and we do not share it for cross-context behavioural advertising.
Where a customer enables text-based document intake, we collect the mobile number enrolled, the content of messages sent to and from the program number, any documents or images attached to those messages, and a record of consent and opt-out status.
Consent. By texting a document to the ClientBox program number, you agree to receive automated replies from ClientBox regarding your submission and your account. Consent to receive text messages is not a condition of purchasing any product or service.
Message frequency varies based on document activity. Message and data rates may apply.
HELP and STOP. Text HELP for support information. Text STOP at any time to unsubscribe; you will receive one confirmation message and nothing further.
We do not sell or share mobile numbers or SMS consent information with third parties or affiliates for their own marketing purposes. Mobile numbers collected for text messaging are used solely to operate document intake and are not used for promotional messaging.
Full messaging terms, including the exact HELP and STOP replies and carrier disclaimers, are set out in our SMS Terms & Conditions.
The primary copy of every document is held on infrastructure we operate. This is a deliberate design choice: it keeps the service independent of any single storage provider, so a customer can connect the storage system they prefer and change it later without rebuilding their filing.
As documents are filed, they are delivered into the customer's chosen storage system in real time, correctly named and in the correct folder. The result is that a complete, organized copy of the record always sits in a system the customer controls, alongside the primary copy we hold.
Data is stored in the United States, on infrastructure operated by Supabase (US West, Oregon) and delivered through Cloudflare.
We share information only in these circumstances:
We do not sell personal information to anyone.
We rely on a small number of providers to operate the service. These currently include categories such as cloud hosting, storage integration, messaging delivery, email delivery, payment processing, and error monitoring.
| Provider | Purpose | Data it may process |
|---|---|---|
| Supabase, Inc. | Application database, authentication and file storage | Account data, document metadata, document files |
| Cloudflare, Inc. | Website and application delivery, DNS, network security | IP addresses and request data in transit |
| Google LLC | Delivery of filed documents into customer storage (Google Drive) | Filed documents and their filenames |
| Telnyx LLC | SMS message delivery for text-based document intake | Mobile numbers, message content, attached documents |
| Twilio Inc. | SMS message delivery for text-based document intake | Mobile numbers, message content, attached documents |
| Anthropic PBC | AI-assisted classification — optional add-on only, not used unless the customer enables it | Document contents, only for customers who have enabled the add-on |
Artificial intelligence processing. AI-assisted classification is an optional premium add-on and is disabled by default. Where a customer enables it, processing is performed through Anthropic's commercial API under a paid commercial account. Anthropic's Data Processing Addendum, including Standard Contractual Clauses, is in force as part of those commercial terms, and under them the inputs and outputs sent through that API are not used to train models. Customers who do not enable the add-on have no document content sent to this provider at all.
We maintain data processing terms with the providers listed above where those providers process personal information on our behalf. Customers may request confirmation of these arrangements at privacy@infinite-office.com.
We will update this list before adding a new provider that processes customer data.
We retain documents and account data for as long as the customer's account is active, because the point of the product is a durable record.
Within the product, deletion is deliberately reversible: trash, archive, and hidden document types can all be restored. Permanent deletion is not the default path.
After an account closes, the following schedule applies:
| Data | Retention |
|---|---|
| Documents and account data | Retained for the duration of the subscription |
| After an account closes | Retrievable for 30 days, then deleted within 90 days |
| Backup copies | Overwritten on the normal backup cycle, within approximately 35 days |
| Billing, tax and accounting records | Retained for 7 years, as required by law |
| Mobile numbers and SMS consent records | Retained while enrolled; opt-out records kept as proof of compliance |
Because filed documents have already been delivered into the customer's own storage, closure of an account does not deprive the customer of their records.
Customers are not locked in. Filed documents have already been delivered into the customer's chosen storage system, correctly named and organized, as part of normal operation. If a customer stops using ClientBox, we are removed and the organized archive remains in place. There is no export request to submit and no bulk data dump to reconstruct.
No system is perfectly secure. If we become aware of a breach affecting personal information, we will notify affected customers and any regulators as required by law, without undue delay.
Standard text messaging is not encrypted end-to-end. See our SMS Terms before sending sensitive material by text.
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing.
If you are a user of a customer's account, or a client of a firm that uses ClientBox, please direct your request to that organization — they control the record, and we act on their instructions. If you contact us directly, we will forward your request to them and support their response.
To exercise rights in respect of information for which we are the controller, contact us using section 16. We will not discriminate against you for exercising your rights.
Residents of California, Virginia, Colorado, Connecticut, Utah and other states with comprehensive privacy laws have specific rights, including the right to know what personal information is collected, the right to delete it, the right to correct it, and the right to opt out of sale or sharing.
Infinite Office LLC is not a "business" as defined by the California Consumer Privacy Act. The CCPA applies to for-profit entities that meet at least one of three thresholds: annual gross revenue above the statutory figure (currently $26,625,000), buying, selling or sharing the personal information of 100,000 or more California consumers or households, or deriving 50% or more of annual revenue from selling or sharing personal information. We meet none of these.
The disclosures in this section are provided voluntarily, in the interest of transparency and to assist customers who are themselves subject to these laws. They are not an admission that the CCPA applies to us.
We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is no opt-out to exercise on that basis. You may still make access, correction, and deletion requests as described above, and we will honour them regardless of whether we are legally required to.
The following summarises what we collect, why, and how long we keep it, provided voluntarily as a notice at collection.
| Category | Purpose | Sold or shared? | Retention |
|---|---|---|---|
| Identifiers (name, work email, account ID) | Provide and secure the service; support; billing | No | Duration of account, then per section 9 |
| Commercial information (plan, billing contact, transactions) | Billing and financial recordkeeping | No | 7 years |
| Internet and device activity (IP, browser, usage and audit logs) | Security, reliability, audit history | No | Duration of account, then per section 9 |
| Mobile number and message content | Operate document intake by text | No | While enrolled; opt-out records retained |
| Document contents, which may include financial account information | Classify, name, file, lock and deliver documents on the customer's instructions. Disclosed to a third-party AI provider only where the customer has enabled the optional add-on | No | Duration of account, then per section 9 |
We do not use or disclose sensitive personal information for purposes other than providing the service, so no "Limit the Use of My Sensitive Personal Information" link is required.
You may use an authorized agent to submit a request on your behalf. We will ask for written proof of the agent's authority and may ask you to verify your identity directly.
Where a customer is itself subject to the CCPA or a comparable state privacy law, Infinite Office acts as a service provider in respect of the personal information it processes on that customer's behalf. We process that information only to perform the services, we do not retain, use, or disclose it for any other purpose, and we do not sell or share it. We will enter into the data processing terms such customers are required to put in place with their service providers.
Our services are business tools and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.
We may update this policy. The effective date above reflects the most recent revision, and we will notify customers of material changes before they take effect.
Infinite Office LLC
1500 N Grant St, Ste N
Denver, CO 80203
privacy@infinite-office.com · (858) 585-6855
