Privacy Policy — Aprilis

APRILIS LLC

Effective date: June 21, 2026

This Privacy Policy explains how Aprilis LLC (“Aprilis,” “we,” “us,” or “our”) collects, uses, discloses, and protects information in connection with the Vee application, related websites, support channels, APIs, documentation, and other services that link to this Privacy Policy (collectively, the “Service”).

Vee is designed to assist accounting and finance professionals with technical accounting analysis, documentation, and workpaper preparation from financial and other source data supplied by customers. Because customers may upload confidential client information, financial statements, contracts, lease schedules, transaction data, audit-support materials, and similar business records, this Policy distinguishes between information about users and “Customer Content” uploaded or generated through the Service.

1. Scope and roles

This Policy applies to personal information we process in connection with the Service and our website. It does not apply to third-party websites, platforms, or services that are not controlled by Aprilis, even if they are linked from the Service.

For account information, website information, billing administration, marketing communications, security logs, and similar business operations, Aprilis may act as a business/controller. For Customer Content that customers upload or direct us to process for their own clients, Aprilis generally acts as a service provider/processor under the customer’s instructions, subject to the applicable order form, subscription agreement, data processing agreement, or similar written agreement.

If you are an individual whose personal information appears in Customer Content submitted by one of our customers, please contact that customer directly for privacy requests unless applicable law requires otherwise. We will reasonably assist our customer in responding to such requests when required by law or agreement.

2. Information we collect

2.1 Information you provide directly

Account and profile information, such as name, business email address, company name, role, password or authentication credentials, and multi-factor authentication settings.
Administrative and billing information, such as plan information, billing contact, payment status, invoices, purchase orders, tax-exemption information, and related correspondence. Payment card information, when used, should be processed by our payment processor and not stored by Aprilis in full.
Customer Content, including source documents, spreadsheets, accounting records, contracts, lease data, prompts, instructions, notes, workpapers, memoranda, CPA Check submissions and comments, outputs, exports, and other files or information submitted to or generated through the Service.
Support and communications information, such as messages sent to support, feedback, bug reports, onboarding notes, sales inquiries, customer-success communications, and recordings or transcripts when you agree to a recorded meeting.
Integration information, such as metadata, authorization tokens, account identifiers, imported files, or other data made available when a customer connects Vee to a third-party system or storage location.

2.2 Information collected automatically

Usage data, such as pages or features accessed, actions taken in the Service, timestamps, workflow status, error reports, document-processing events, and feature-performance metrics.
Device, network, and log information, such as IP address, browser type, operating system, device identifiers, referral URLs, approximate location derived from IP address, sign-in events, session data, security events, and audit logs.
Cookie and similar technology data. We may use session cookies and similar technologies that are necessary to operate the Service, keep users signed in, remember preferences, secure accounts, and understand website performance. Where required, we will provide appropriate notice and choices.

2.3 Information from third parties

Information from identity, authentication, hosting, analytics, customer-relationship, payment, communications, and security service providers.
Information from business partners, referrals, professional networks, events, or publicly available sources when used for ordinary business-to-business sales, support, and account administration.
Information provided through integrations or authorized third-party systems at a customer’s direction.

2.4 Sensitive or regulated information

The Service is intended for business and professional accounting use. Customer Content may contain confidential business information and may incidentally contain personal information. Unless expressly authorized in a written agreement with Aprilis, customers should not upload protected health information, full payment-card numbers, consumer credit reports, government identification numbers, children’s information, export-controlled technical data, or other categories of regulated data that require specialized handling not described in the applicable order or data processing agreement.

3. How we use information

Provide, operate, maintain, host, secure, and improve the Service.
Process Customer Content as instructed by the customer, including generating technical accounting analyses, workpapers, summaries, schedules, outputs, explanations, and related artifacts.
Perform, administer, document, supervise, and support an optional CPA Check when requested by a customer, including providing limited access to authorized CPA Check personnel.
Administer accounts, authenticate users, manage permissions, provide support, troubleshoot issues, and communicate about the Service.
Monitor and protect the Service, including detecting, investigating, and preventing fraud, abuse, unauthorized access, security incidents, policy violations, and technical problems.
Analyze usage, performance, reliability, and product adoption in order to improve the Service, develop features, and measure customer success, using aggregated or de-identified information where appropriate.
Send transactional notices, security alerts, support messages, service updates, and administrative messages.
Send business-to-business marketing communications where permitted by law. You may opt out of marketing emails, but we may still send non-marketing service communications.
Comply with legal obligations, enforce agreements, protect rights and safety, and respond to lawful requests.

4. AI processing and model training

The Service may use artificial intelligence models and other automated systems to process Customer Content and generate outputs. Customer Content, prompts, context, retrieval materials, metadata, and outputs may be transmitted to Aprilis subprocessors, including AI inference providers, only as needed to provide, secure, and support the Service.

Aprilis does not sell Customer Content. Aprilis does not use Customer Content to train or improve generalized foundation models, and does not permit AI subprocessors to do so, unless the customer expressly agrees in writing or the applicable provider terms and customer agreement allow such use. Aprilis may use aggregated, statistical, or de-identified information to operate, analyze, and improve the Service, provided it is not reasonably capable of identifying the customer, the customer’s clients, or any individual.

AI-generated outputs may include or reflect information from Customer Content. Customers are responsible for controlling who can access their workspace, reviewing outputs, and determining whether outputs may be shared with their clients or third parties.

5. CPA Check and limited human access

If a customer requests a CPA Check, Aprilis may provide an authorized individual engaged by Aprilis and identified as a licensed Certified Public Accountant with access to the Customer Content, Outputs, instructions, supporting documents, and related account context reasonably necessary to perform the requested check.

CPA Check personnel may be Aprilis personnel or independent contractors. Aprilis requires them to be subject to confidentiality, data-protection, security, and limited-use obligations. Their access is limited to information reasonably necessary to perform, document, supervise, quality-check, or support the requested CPA Check.

CPA Check personnel may create comments, questions, annotations, notes, suggested revisions, or other work product. That information is treated as Customer Content or Output, as applicable, and is retained and deleted in accordance with this Privacy Policy, the applicable Order, and any Data Processing Agreement.

Information accessed for a CPA Check will not be sold or used by CPA Check personnel for unrelated purposes. The customer remains responsible for ensuring that it has all permissions, authorizations, consents, notices, and legal bases required to disclose client, employee, financial, or other information to Aprilis and to CPA Check personnel.

6. How we disclose information

We disclose information only as described in this Policy, as instructed by the customer, or as otherwise permitted or required by law.

Subprocessors and service providers. We use vendors that help us operate the Service, such as cloud hosting, infrastructure, storage, AI inference, authentication, logging, analytics, security, DNS/edge protection, source control, communications, customer support, and payment processing. We require service providers to process information only for authorized purposes and to protect it appropriately.
CPA Check personnel. When a customer requests a CPA Check, we may disclose the Customer Content and related information reasonably necessary for the check to authorized CPA Check personnel, including qualified independent contractors, subject to confidentiality and limited-use obligations.
Customer organizations. If your account is associated with an organization, account administrators and authorized users may access information associated with that workspace, including user activity, Customer Content, outputs, and account settings.
Professional advisers. We may disclose information to attorneys, accountants, auditors, insurers, bankers, and other professional advisers when reasonably necessary for business operations, compliance, or legal purposes.
Legal and safety reasons. We may disclose information to comply with law, court order, subpoena, regulatory request, or other legal process; to protect the rights, property, and safety of Aprilis, customers, users, or others; and to enforce our agreements and policies.
Business transactions. We may disclose or transfer information in connection with a merger, financing, acquisition, reorganization, sale of assets, due diligence, bankruptcy, or similar transaction, subject to appropriate confidentiality protections.
With consent or direction. We may disclose information when the customer or user instructs us to do so, such as by connecting an integration, exporting a workpaper, inviting a user, or requesting support.

7. Subprocessors

A current list of subprocessors and relevant professional-services providers is available upon request or at a location designated by Aprilis. The list may include cloud, infrastructure, storage, AI inference, authentication, logging, analytics, security, communications, support, payment, and CPA Check providers, and should identify the provider name, service category, processing location when available, and purpose of processing. Customers with a written data processing agreement may have additional notice or objection rights regarding new subprocessors.

8. Data security

We use administrative, technical, and organizational safeguards designed to protect information against unauthorized access, loss, misuse, alteration, and disclosure. These safeguards may include encryption in transit and at rest, access controls, least-privilege permissions, multi-factor authentication, credential management, vulnerability management, security logging, backup procedures, and vendor due diligence.

No method of transmission or storage is completely secure. Customers are responsible for configuring their workspaces, selecting authorized users, protecting credentials, enabling available security features, maintaining secure devices and networks, and ensuring that Customer Content uploaded to the Service is appropriate for processing under the customer’s policies and professional obligations.

9. Security incidents

If Aprilis becomes aware of a security incident affecting Customer Content or personal information, we will investigate and provide notice to affected customers as required by applicable law or written agreement. Notices may include the nature of the incident, categories of information involved, steps taken, and recommended customer actions, to the extent known and lawful to disclose.

10. Data retention, deletion, and export

We retain information for as long as reasonably necessary to provide the Service, comply with legal obligations, resolve disputes, enforce agreements, maintain security, and support legitimate business purposes. Retention periods may vary based on account status, customer instructions, legal requirements, backup schedules, security needs, and the type of data involved.

Upon termination or valid request, we will delete or return Customer Content in accordance with the applicable agreement, data processing agreement, and our then-current technical capabilities. Deletion from active systems may occur before deletion from encrypted backups, which are retained for a limited period and protected from ordinary production access until overwritten or securely deleted.

11. Customer responsibilities for client information

Customers, including CPA firms, accounting firms, consulting firms, and finance departments, are responsible for determining whether they have the right to upload, process, and disclose Customer Content through the Service. This includes obtaining any required client authorizations, consents, engagement-letter permissions, confidentiality waivers, or internal approvals; complying with professional standards and state board requirements; and ensuring that use of the Service is consistent with the customer’s obligations to clients, employers, regulators, and other stakeholders.

12. Privacy choices and rights

Depending on where you live and how you interact with Aprilis, you may have rights to access, correct, delete, or obtain a copy of personal information; to opt out of certain processing; to withdraw consent where processing is based on consent; and to appeal certain privacy-rights decisions. These rights may be subject to limitations and exceptions under applicable law.

To submit a request, contact [email protected]. We may need to verify your identity and authority before responding. If your information is contained in Customer Content controlled by an Aprilis customer, we may direct you to that customer or work with that customer to respond.

Aprilis does not sell personal information for money. Aprilis also does not use Customer Content for cross-context behavioral advertising. If our practices change, we will update this Policy and provide required choices.

13. California and U.S. state privacy notice

Where applicable, the categories of personal information we may collect include identifiers; commercial information; internet or electronic network activity information; professional or employment-related information; inferences related to service use; and sensitive personal information only to the extent included in account security information, authentication data, or Customer Content submitted by a customer. We use and disclose these categories for the purposes described above. We do not knowingly sell or share personal information as those terms are defined under applicable California privacy law. State privacy rights may not apply to all business-to-business or employment-context information, and exceptions may apply.

14. International processing

Aprilis is based in the United States and the Service is primarily operated from the United States. If you access the Service from outside the United States or submit information about individuals outside the United States, you understand that information may be processed in the United States and other countries where Aprilis and its subprocessors operate. Where required, cross-border transfers will be handled under appropriate transfer mechanisms or contractual commitments.

15. Children

The Service is not directed to children and is intended for professional and business users. We do not knowingly collect personal information from children through the Service. If you believe a child has provided personal information to Aprilis, contact [email protected] so we can take appropriate action.

16. Changes to this Policy

We may update this Policy from time to time. When we make changes, we will revise the effective date and, when appropriate, provide additional notice. Continued use of the Service after an updated Policy becomes effective means the updated Policy applies to your use of the Service.

17. Contact

Questions or requests about this Privacy Policy may be sent to [email protected] or to Aprilis LLC at the business address identified in the applicable order form, subscription agreement, or website contact page.