Privacy Policy1. Introduction
This Privacy Policy describes how DECA Analytics LLC ("DECA," "we," "us," or "our") collects, uses, stores, and manages information provided by users ("you" or "your") when accessing and using the DECA Portal (the "Portal").
The Portal is a secure digital platform designed to support DECA's services, including but not limited to incentives, compliance, advisory, and access to capital engagements. This Privacy Policy applies to all Portal users, including clients, authorized representatives, and DECA personnel.
The Portal may use AI-assisted tools to help prepare preliminary drafts, organize information, and support DECA's internal review process. AI-generated content is not final unless reviewed and approved by DECA personnel.
2. Information We Collect
2.1 Information Collected
We collect and store information (including personal information) through the Portal and other sources, which may include:
| Category | Examples |
|---|---|
| Identity and contact information (individuals) | Names, addresses, phone numbers, and email addresses for users, company owners, officers, resident agents, authorized signatories, and DECA staff |
| Identity information related (entities) | Legal name, entity type, EIN, government registration numbers, Act 60 decree numbers, and industry codes |
| Ownership and control | Ownership percentages, beneficial ownership structure, social security number, management qualifications, resumes, and background check results (Act 60) |
| Financial information (entities) | Financial statements, revenue, payroll, capital expenditures, banking information, and pricing and fee data |
| Financial information (individual) | Individual tax returns and IRS Form 8898 (bona fide residence certification) |
| Tax and compliance filings | Sales and use tax, professional services returns, volume of business, property tax, annual reports, incentive income tax returns, and federal tax returns |
| Incentive applications and R&D data | Business plans, R&D expense records, personnel qualifications, and technical descriptions of qualifying activities |
| Tax credit transactions | Buyer and seller information, substantiation evidence, transaction documentation for R&D, and tourism credit transfers |
| Prospect and pre-contract data | Company profile, service interests, compliance status, pricing proposals, uploaded documents (financial projections, corporate deck), questionnaire responses, supporting documentation, and files uploaded through the Portal |
| Contract and commercial | Signed service agreements, scope, fees, amendments, and electronic signature records |
| AI workflow data | Client inputs sent to the AI, AI-generated preliminary draft content, reviewer edits and approvals. |
| User accounts and audit logs | User identity, role, login events, session data, login and authentication credentials, two-factor authentication records, and audit trail of all significant actions across every module |
To the extent required by applicable law, you may have the right to request access to or delete your personal information. If you wish to do any of these things, please contact support@deca.pr. We will review your request, determine if any additional documents or information is required, and process your request to the extent required by applicable law.
2.2 Who Provides that Information
We collect the information described in Section 2.1 from several sources, including:
- Clients and authorized users, such as information submitted through the Portal, including intake details, uploaded documents, financial records, tax information, R&D descriptions, and certifications
- DECA Business Development, such as prospect and pre-contract information, including company profiles, service interests, pricing proposals, questionnaires, and submitted documents
- DECA staff, such as internal assignments, status updates, reviewer edits, approvals, and workflow information
- Service providers and external sources, such as information generated or received through service providers and external sources, including service providers, public databases, and government agencies
2.3 Automatically Collected Information
When you access or use the Portal, we may automatically collect certain technical information, including:
- IP address
- Browser type and device information
- Operating system
- Log data and usage activity
This information is used to maintain security, system performance, and operational monitoring.
The Portal does not currently respond to browser "Do Not Track" signals or similar automated privacy preference signals. The Portal may use cookies, log files, analytics tools, and similar technologies provided by DECA or third-party service providers to collect technical and usage information, maintain security, monitor performance, troubleshoot issues, and improve Portal functionality. These technologies may collect information such as IP address, device identifiers, browser type, operating system, referring pages, pages viewed, session activity, and other usage data. Third-party service providers may process this information on DECA's behalf subject to contractual obligations. However, the Portal does not permit third parties to use Portal tracking technologies to collect personal information for their own advertising or direct marketing purposes, and does not allow third parties to track clients' online activities across different websites.
3. How We Use Information
We use collected information to:
- Provide and support DECA services, including Act 60 applications, R&D tax credit reports, tax filings, foundational registrations, and related deliverables
- Facilitate intake, workflows, document management, reporting, and cross-module reuse of information for the same client, where appropriate
- Communicate with users regarding the Portal, their engagement and DECA services, including status updates, document requests, password resets, and security verification messages
- Prepare, submit, and support applications, filings, reports, and communications with government agencies, as authorized
- Generate structured outputs and draft materials, including AI-assisted content, subject to human review
- Maintain, secure, and improve the Portal, including audit logs of significant actions
- Comply with legal, regulatory, and contractual obligations
DECA does not sell or disclose your information to third parties unless required by law or authorized by you.
By using the Portal and expressly and voluntarily agreeing to its Terms of Use in writing, you provide consent for us to use your personal information for marketing actions, such as, for example, sending you promotional emails and materials from DECA.
4. Sharing Information with Third Parties
We may share collected information with third parties when necessary to operate the Portal, provide DECA services, complete client engagements, comply with applicable requirements, or as otherwise authorized by you. Third-party access is limited to what is reasonably necessary for the applicable service, workflow, legal requirement, business purpose, or authorized client direction. We may share collected information with the following categories of recipients:
| Category | Purpose |
|---|---|
| AI and automation service providers | Support AI-assisted drafting, structuring of information, workflow automation, and related internal review processes |
| Cloud hosting, infrastructure, and technology providers | Host, store, secure, maintain, troubleshoot, and support the Portal, including databases, file storage, application infrastructure, and related systems |
| Communications and authentication providers | Send transactional emails, status updates, document requests, password resets, security notices, and two-factor authentication codes |
| Electronic signature and document workflow providers | Support execution, tracking, storage, and management of service agreements, engagement documents, and other signed materials |
| Project management, intake, and workflow platforms | Support client onboarding, engagement tracking, internal task management, reporting, and transition of workflows into or out of the Portal |
| Professional advisors and service providers | Including accountants, consultants, financial institutions, tax credit buyers, legal advisors, auditors, and other advisors or service providers when directed by the client or necessary for the applicable service |
| Government agencies, regulators, and public authorities | When applications, filings, reports, certificates, supporting documentation, or other materials must be submitted or received as part of the contracted service or legal obligation |
| Affiliates, related entities, and authorized personnel | Support DECA's business operations, internal administration, service delivery, compliance, and client relationship management |
| Entities involved in a business transaction | Including parties and advisors involved in an actual or potential merger, acquisition, financing, restructuring, sale of assets, reorganization, or similar corporate transaction, subject to appropriate confidentiality protections |
The Portal may integrate with third-party service providers, such as AI tools, cloud hosting, authentication, analytics, or communication tools, to support its functionality. These providers are engaged under contractual obligations designed to protect confidentiality and security. Their use of information is governed by their own privacy policies, and DECA is not responsible for their independent practices.
We do not sell personal information or disclose it with third parties for their direct marketing purposes.
5. User Responsibilities and Information Accuracy
Users are responsible for ensuring that information submitted through the Portal is accurate, complete, and timely.
- DECA is not responsible for delays, errors, or outcomes resulting from incomplete or inaccurate information provided by users.
Use of the Portal does not alter or replace client responsibilities under any applicable service agreement with DECA.
6. Use of Artificial Intelligence
Certain features of the Portal may use AI and AI-assisted tools to help structure information, generate drafts, or improve consistency and efficiency. Client inputs and documents may be shared with OpenAI and/or other AI service providers for this purpose, including structured form data and, where applicable, the content of uploaded documents such as financial statements or tax materials. These providers are engaged under contractual obligations designed to protect confidentiality and security. AI-generated drafts are stored in the Portal, labeled as preliminary, and do not constitute final work product.
- AI tools do not make eligibility determinations, approvals, or final decisions.
- All outputs are reviewed, revised, validated, and subject to approval by DECA personnel.
- Client data is used solely to support the applicable engagement and is not used to train public or external AI models.
7. Data Security
DECA implements administrative, technical, and organizational safeguards designed to protect information from unauthorized access, disclosure, alteration, or destruction. These safeguards include:
- Encryption of data in transit and at rest
- Role-based access controls
- Secure authentication mechanisms
- Ongoing system monitoring
While we take security seriously, no system can be guaranteed to be completely secure. Users are responsible for protecting their login credentials and notifying DECA of any suspected unauthorized access.
8. Access and Confidentiality
Access to information in the Portal is restricted to:
- Authorized users associated with the applicable organization
- Authorized DECA personnel assigned to the engagement
Information submitted through the Portal is treated as confidential as per the applicable non-disclosure or services agreement and is managed as described in this Policy.
9. Generated Content and Proprietary Materials
The Portal may generate reports, templates, workflows, or other outputs as part of DECA's services.
- Client-provided data remains confidential.
- Certain materials, methodologies, templates, and workflows generated through the Portal may constitute proprietary intellectual property of DECA.
- Use of the Portal does not grant ownership or license rights to DECA's proprietary materials beyond the scope of the applicable engagement.
Please refer to the Terms of Use intellectual property provisions.
10. Platform Monitoring and Acceptable Use
DECA may monitor Portal activity for security, compliance, system integrity, and performance purposes.
- Monitoring is conducted to protect users and the platform, not for surveillance.
- Unauthorized access, misuse, or attempts to compromise the Portal may result in restricted access or other appropriate actions.
11. Data Retention
Information is retained for as long as necessary to:
- Support active and historical engagements
- Meet legal, regulatory, and contractual obligations
- Maintain appropriate business records
Retention periods may vary depending on the nature of the information and applicable requirements.
12. Governing Law
This Privacy Policy is governed by the laws of the Commonwealth of Puerto Rico, without regard to conflict-of-law principles.
13. Relationship to Client Agreements
This Privacy Policy governs use of the Portal only.
It does not replace, amend, or supersede any services agreement, engagement letter, or other contractual arrangement between DECA and its clients. In the event of a conflict, the applicable services agreement shall control.
14. Changes to This Privacy Policy
We reserve the right to modify or update this Privacy Policy at any time to reflect changes in the Portal, applicable laws, or business practices. These updates will be posted within the Portal and/or notified through other appropriate communication, including email, and will be effective immediately upon notification.
Continued use of the Portal after changes are notified constitutes acceptance of the updated Privacy Policy.
15. Contact Us
If you have any questions about this Privacy Policy or how your information is handled, please contact us at support@deca.pr.
By accessing or using the DECA Portal, you acknowledge that you have read, understood, and agree to this Privacy Policy.