ES EN
Back to home

Legal

Privacy policy

Last updated: October 5, 2026

This policy explains what data BMS of NC collects through bmsofnc.com, what we use it for, who we share it with, how long we keep it and what rights you have, whether you live in the United States, Latin America or Europe. If anything is unclear, write to us at info@bmsofnc.com and we will explain it.

In short

  • We only collect what you give us in the forms or when you contact us, plus technical data about your visit according to what you choose in the cookie notice.
  • We never pass your name, email, phone or anything you tell us about your tax situation to Meta, Google or any advertising platform.
  • We do not sell your data.
  • Your data is stored in the United States.
  • You can access, correct or delete it, or object to its use, by writing to info@bmsofnc.com, and change your cookies any time from “Cookie settings” at the bottom of every page.

Who is responsible

BMS of NC, a tax preparation, bookkeeping and company formation firm in North Carolina, United States, led by Katiuska Bustillos. Mailing address: 112 Argus Ln, Ste A #1046, Mooresville, NC 28117, United States. Contact for anything about your data: info@bmsofnc.com · WhatsApp and phone +1 786-491-9112.

What data we collect

  • Free consultation: name, email, phone, what you need, where you live, whether you already have a U.S. company, any comment you add, and the day, time and channel of the call.
  • IRS alerts: name, email, WhatsApp (optional), the profile you choose and language.
  • When you contact us on WhatsApp, by email or phone: whatever you tell us.
  • About the visit: which ad or search engine brought you here (for example, utm parameters) and, according to your choice in the cookie notice, technical browsing data (see “Cookies”).
  • Your cookie choice: what you accepted and when, with a random identifier that does not say who you are, so we can prove it.

We do not ask for, and you should not send us through this site, your Social Security number, your ITIN, income figures or tax documents. That information is requested later, from clients, through our secure portal, and is governed by the services agreement and our information security program.

To answer your inquiry we need at least your name and an email or phone number: without them we cannot help you. The other fields are optional or help us prepare the call.

What we use it for, and on what basis

Primary purposes, needed for what you ask us:

  • Answering your inquiry, booking and holding the free call and, if you decide to hire us, preparing the proposal. Basis: steps you request before entering into a contract.
  • Sending you IRS deadline and change alerts, if you subscribed. Basis: your consent, which you withdraw with one click in any alert.
  • Protecting the site against abuse (for example, limiting repeated submissions from the same connection). Basis: our legitimate interest in keeping it secure.

Secondary purposes, which you can decline without any change to the service:

  • Analytics: knowing which pages get visited and where people get stuck, to improve the site.
  • Advertising: knowing whether an ad led to a contact, to decide where to advertise.

For these two, the basis is your consent where the law requires prior permission (see “Cookies”), and elsewhere our legitimate interest in measuring our advertising, with the option to decline at any time. By sending a form you agree to processing for the primary purposes; to object to the secondary ones, use “Cookie settings” or write to us.

Your tax information is not used for advertising

As tax preparers, U.S. law (Internal Revenue Code section 7216) prohibits us from using or disclosing information you give us to prepare a return for any other purpose without your written, signed consent. That is why, when someone sends a form or contacts us from an ad, Meta and Google only receive the fact that a contact happened, together with technical browser identifiers; never your name, email, phone or what you tell us. We do not upload client lists to advertising platforms. And, as a financial institution under the Gramm-Leach-Bliley Act, we do not share our clients' nonpublic personal information with third parties for their own marketing.

Who we share it with

  • Hostinger (United States): hosts the site and stores what you send through the forms.
  • Google (Google Workspace, Google Analytics and Google Ads): the firm's email and appointment confirmations; and, if you allow it, analytics and ad measurement.
  • Meta (Meta Platforms, Inc.; in Europe, Meta Platforms Ireland Ltd.): if you allow it, its pixel and Conversions API measure whether an ad led to a contact. For that measurement, Meta also processes the data under its own policy: facebook.com/privacy/policy.
  • Microsoft (Microsoft Clarity): only if you accept analytics; it sees anonymously how the page is used and never what you type into forms.
  • Stripe (Stripe, Inc., United States): collects client invoices and, before a client signs their return, verifies their identity with a photo of their ID and a selfie (see "Biometric data"). Stripe also processes that data under its own policy: stripe.com/privacy.
  • CrossLink: the software we use to prepare and file clients' returns and with which they sign Form 8879.
  • Authorities, when a law requires it.

We do not sell personal data to anyone, under any circumstances.

Biometric data (client identity verification)

To protect our clients against identity theft, before they sign their return we ask them to verify their identity with Stripe Identity: a photo of their government ID and a live selfie. Stripe uses facial geometry (biometric data) only to check that the selfie matches the ID. We ask for written consent first, in the portal's service agreement, and Stripe asks again inside the verification.

  • Purpose: identity verification and fraud prevention. Nothing else.
  • Who sees it: facial geometry is processed only by Stripe on our behalf; we receive the result and, in our Stripe account, the ID and selfie images.
  • We do not sell, lease or trade it, nor share it except with Stripe for the verification or when the law requires.
  • Retention: Stripe deletes biometric data within 1 year at most. Images are kept up to 3 years as a record and deleted sooner when no longer needed or at the client's request, unless the law requires otherwise. They are never kept longer than applicable law allows (for example, Illinois, Texas or Washington).
  • Alternative: anyone who prefers not to use the selfie can verify their identity on a video call showing their ID.

Cookies and similar technologies

Where we ask before turning anything on: if your device is on the time zone of Europe (European Union, United Kingdom, Switzerland), Colombia, Peru, Ecuador, Chile, Brazil or the U.S. Pacific coast (California), no analytics or advertising cookie turns on until you accept. Elsewhere they turn on when you arrive and you can decline them in the notice or later. If your browser sends the Global Privacy Control signal, advertising starts off. Session recording (Microsoft Clarity) only turns on, in any country, if you accept it.

  • Essential — bms_consent (browser storage, BMS of NC): your cookie choice. 12 months; then we ask again.
  • Advertising, our own — bms_uid (browser storage): a random number to link your visit to our campaigns. Only with advertising permission; deleted if you withdraw it.
  • Measurement, our own — bms_origen (session storage): which ad or search engine brought you here. Deleted when you close the tab; only stored with analytics or advertising permission.
  • Analytics — _ga, _ga_* (Google Analytics): up to 2 years.
  • Analytics — _clck (1 year), _clsk (1 day) (Microsoft Clarity).
  • Advertising — _fbp, _fbc (Meta): 90 days. Meta may set others on its own domain.
  • Advertising — _gcl_au (Google Ads): 90 days.

To change or withdraw your consent, click “Cookie settings” at the bottom of any page: when you withdraw it, we stop measuring and delete the cookies that were set. Processing before the withdrawal remains valid.

Your data is stored in the United States

The firm and the server are in the United States. If you write to us from another country, your data travels there, to a country whose laws may not offer the same protection as yours. You send it to us directly for an inquiry you request; the providers that help us (Google, Meta, Microsoft) commit to protecting it with mechanisms recognized by European law, such as the EU-U.S. Data Privacy Framework or standard contractual clauses. These providers process data on our behalf, so these are not transfers that require your consent under Mexican law; and the Colombian authority (SIC) recognizes the United States as a country with an adequate level of protection.

How long we keep it

  • Inquiries sent through the site by people who do not become clients: 12 months.
  • Calls booked through the site by people who do not become clients: 12 months from the date of the call.
  • IRS alerts: until you unsubscribe.
  • Record of cookie choices: 3 years, so we can prove consent.
  • Technical log of conversion notices sent to Meta: 90 days.
  • Clients: the file is kept at least 3 years from the filing of each return, as the law requires of preparers (IRC §6107), and securely deleted no later than 2 years after its last use, unless another law requires keeping it longer.
  • Cookies: the period stated for each one.

After those periods, the data is deleted.

Your rights

Wherever you are, you can ask us for:

  • Access: what data we hold about you, and a copy in a commonly used format (portability).
  • Correction: fixing it if it is wrong or incomplete.
  • Deletion.
  • Objection and restriction: that we stop using it for a purpose, especially analytics and advertising.
  • Withdrawing your consent at any time, without affecting earlier processing.

Write to info@bmsofnc.com with your name, the email or phone you used and what you are asking for. We may ask for something more to confirm it is you. We reply within 10 business days to questions and 15 business days to requests for correction, deletion or objection, and apply them as soon as they are resolved. We do not make automated decisions or profiles with legal effects about you.

If you are not satisfied with our answer, you can complain to the data protection authority in your country. For example: in Spain, the AEPD; elsewhere in the European Union, your national authority; in the United Kingdom, the ICO; in Switzerland, the FDPIC; in Mexico, the Secretaría Anticorrupción y Buen Gobierno; in Colombia, the Superintendencia de Industria y Comercio (SIC); in Peru, the Autoridad Nacional de Protección de Datos Personales; in Ecuador, the Superintendencia de Protección de Datos Personales; in Argentina, the AAIP; and in Chile, the Agencia de Protección de Datos Personales.

If you live in the United States

We do not sell personal data. Using the Meta pixel and Google Ads to measure ads may be considered “sharing” data for advertising under some state laws: you can opt out any time from “Cookie settings” or by turning on Global Privacy Control in your browser, which we honor. In California we do not turn on the Meta pixel or session recording without your prior permission. We do not discriminate against anyone for exercising their rights.

Children

This site is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has sent us data, write to us and we will delete it.

Security

The site is always served over an encrypted connection (HTTPS). What you send through the forms is stored in a part of the server that is not reachable from the internet, with access limited to the firm. We follow a written information security program, as the FTC Safeguards Rule requires of tax preparers.

Changes to this policy

If we update it, the date above will change. If the change affects how we use your data or cookies, we will ask for your choice again in the cookie notice.

This policy describes our data practices on this website and does not replace the professional services agreement you sign with us as a client.