Privacy Policy

1. Who we are

Caramel Advisors LLC ("Caramel Advisors", "we", "us" or "our") provides virtual finance and accounting services, including bookkeeping and accounting, audit support, tax services, client accounting advisory services, and advisory services (valuation and transaction support), to business owners, CPA firms and fractional CFO firms in the United States. Caramel Advisors LLC is a limited liability company with its principal office at 45 E City Ave #1940, Bala Cynwyd, Pennsylvania 19004, USA.

We respect your privacy and are committed to protecting your personal information. This Privacy Policy explains what personal information we collect through www.CaramelAdvisors.com (the "Website"), how we use and share it, and the choices and rights available to you.

2. Scope of this policy

This policy applies to personal information we collect through the Website, by email and phone, at events, and when we recruit staff. It does not apply to third-party websites, services or applications, even if you reach them through a link on our Website.

Website visitors, prospects and job applicants. For information we collect directly from you, we decide how and why it is used, and we are responsible for it.

Client data. When we provide services to our clients, we may receive financial records, payroll data, tax information and other personal information about our clients' owners, employees, customers and vendors. We process that information only on our client's instructions, as their service provider, under the engagement letter or service agreement with that client and applicable professional confidentiality obligations. Where a client chooses our remote or cloud access model, we work within the client's own systems and its data does not leave its environment (see Section 10). If your information reached us through one of our clients, please direct privacy requests to that client in the first instance; we will assist them in responding.

3. Information we collect

Information you give us through the Website

Information from other sources. When recruiting, we may collect professional details of prospective employees from job portals and professional networks such as LinkedIn and Naukri. We may also receive business contact details from referral partners, event organizers and publicly available sources.

Information collected automatically. When you visit the Website, we and our service providers may automatically collect technical information such as your IP address, approximate location (city or country), browser type and version, device and operating system, referring website, pages viewed, time spent on pages and the date and time of your visit. See Section 5 on cookies.

4. How we use your information

We use personal information to:

• respond to your enquiries, requests for proposals and call-back requests;
• provide, manage and improve our services, and perform our contracts with clients, suppliers and partners;
• send invoices, statements and payment reminders, and collect payments;
• send newsletters, insights and marketing communications you have requested or that we are allowed to send (you can opt out at any time);
• evaluate job applications, recruit and onboard employees, including background verification where permitted by law;
• operate, secure and improve the Website, understand how visitors use it, and prevent fraud, misuse and unauthorized access;
• comply with our legal, regulatory, tax and professional obligations; and
• establish, exercise or defend legal claims.

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

5. Cookies and similar technologies

Cookies are small text files placed on your device when you visit a website. We use:

• Strictly necessary cookies: required for the Website to function and to keep it secure. These cannot be switched off.
• Analytics cookies: set by web analytics tools, which help us understand how visitors use the Website so we can improve it. These collect information in aggregated or pseudonymized form.

Where required by law, we will ask for your consent before setting non-essential cookies. You can also block or delete cookies through your browser settings; some parts of the Website may not work properly if you do.

6. SMS and text messaging

All text messages are sent under the name Caramel Advisors LLC.

Opt-in. If you provide your mobile number through our Website and tick the SMS consent box, you agree to receive text messages from Caramel Advisors LLC about service updates, appointment reminders, account notifications, billing alerts and customer support. Consent is not a condition of purchasing any service.

Frequency and charges. Message frequency varies with your engagement and account activity. Message and data rates may apply, depending on your mobile carrier plan.

Opt-out and help. Reply STOP to any message to unsubscribe; you will receive one confirmation message and no further texts unless you opt in again. Reply HELP for help, or contact us at privacy@carameladvisors.com or +1 267-416-9800.

No sharing of mobile information. We do not sell, rent or share your mobile phone number or SMS opt-in consent with third parties or affiliates for their marketing or promotional purposes. We share it only with service providers, such as our SMS delivery platform, that send messages on our behalf.

7. How we share information

We share personal information only as described below:

• Our team and affiliates: with our employees and group or affiliated entities, to the extent needed for the purposes in this policy and subject to confidentiality obligations.
• Service providers: with vendors who host our Website and systems, provide email, CRM, SMS, analytics, secure file-sharing, IT support and background verification services. They may use your information only to perform services for us and must protect it.
• Legal and safety reasons: where required by law, regulation, subpoena or court order, or where reasonably necessary to protect the rights, property or safety of Caramel Advisors, our clients or others, or to prevent fraud.
• Business transfers: in connection with a merger, acquisition, financing or sale of all or part of our business, subject to this policy or equivalent protections.
• With your consent or at your request.

We may share aggregated or de-identified information that cannot reasonably identify you for research and analysis.

8. Where we process information

Caramel Advisors is based in the United States, and our services and this Website are intended for users in the United States. We store and process personal information in the United States. Where any of our team members or service providers access personal information from outside the United States, we require them to protect it in line with this policy and our security standards.

9. How long we keep information

We keep personal information only as long as needed for the purposes for which it was collected, including to meet legal, tax, accounting and professional record-keeping requirements. For example, we keep enquiry and marketing data until you ask us to delete it or it is no longer needed, and unsuccessful job applications for up to 12 months. When information is no longer needed, we securely delete or de-identify it.

10. How we protect information

We use reasonable administrative, technical and physical safeguards designed to protect personal information from loss, misuse and unauthorized access, disclosure or alteration. These include encryption in transit and at rest, role-based access controls, multi-factor authentication, secure client portals, monitoring for threats and vulnerabilities, and employee confidentiality and security training. Our information security program is ISO/IEC 27001 certified and independently audited under SOC 2 Type II.

Remote and cloud access model. For clients who prefer that their data never leaves their own environment, our team can work directly within the client's own systems, such as its cloud accounting, tax and document management platforms or its virtual or remote desktop environment, using access the client grants and controls. In this model, client data is not downloaded to, copied to or stored on Caramel Advisors systems. Where an engagement does require data to be transferred to us, it is held only within our controlled network, which is covered by our ISO/IEC 27001 certification and SOC 2 Type II audit, and is handled under the terms of the engagement letter.

No method of transmission over the internet or of electronic storage is completely secure, so we cannot guarantee absolute security.

11. Your rights and choices

Depending on the U.S. state you live in (for example, California, Virginia, Colorado or Connecticut), you may have the right to:

• Know and access: ask what personal information we hold about you and receive a copy;
• Correction: ask us to correct inaccurate or incomplete information;
• Deletion: ask us to delete your information, unless we must keep it by law;
• Opt out: opt out of direct marketing and, where applicable, targeted advertising (we do not sell personal information);
• Portability: receive your information in a portable format;
• Appeal: appeal our decision if we decline your request; and
• Non-discrimination: we will not treat you differently for exercising your rights.

To exercise these rights, email privacy@carameladvisors.com. We may need to verify your identity before responding, and we will respond within the time required by applicable law. You can unsubscribe from marketing emails at any time using the "unsubscribe" link in any email.

12. Children's privacy

Our Website and services are intended for businesses and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has given us personal information, please contact us and we will delete it.

13. Third-party websites

Our Website may contain links to third-party websites and services, such as social media platforms. We do not control them and are not responsible for their privacy practices. Please review their privacy policies before sharing information with them.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and change the "Last updated" date. If we make material changes, we may also notify you by email or a notice on the Website.

15. Contact us

If you have questions or concerns about this Privacy Policy or our privacy practices, please contact: