Data Privacy Policy · CSI Group

1. Who We Are and What This Policy Covers

This Data Privacy Policy explains how CSI Group Business Solutions, LLC and its affiliated entities serving the CSI Member Portal, namely CSI Group Advisors, LLC, CSI Retirement Services, LLC, and CSI Group Law Firm, P.C. (collectively, "CSI," "we," "us"), collect, use, share, protect, and retain information about you when you use the CSI Member Portal (the "Portal") and when you receive services from the CSI Entities in connection with the Portal.

CSI Entities are financial institutions for purposes of the Gramm-Leach-Bliley Act ("GLBA"), and CSI Group Advisors, LLC is a registered investment adviser that delivers its own privacy disclosures. CSI Group Law Firm, P.C. additionally owes you duties of confidentiality under the Rules of Professional Conduct, which are broader than privacy statutes and are not diminished by anything in this Policy. Where a professional confidentiality duty, GLBA, or Internal Revenue Code Section 7216 provides you more protection than this Policy, the stronger protection controls.

2. Information We Collect

Depending on which CSI Entities serve you and how you use the Portal, we collect:

Identity and contact information: name, address, email, phone, date of birth, Social Security number and other government identifiers, and household and beneficiary information.
Tax Return Information: all information furnished in connection with preparing your tax returns, including returns, source documents, and organizer responses. This category receives the special treatment described in Section 5.
Financial information: income, assets, liabilities, account numbers and balances, custodial account data, transaction history, retirement plan data, and the financial intake and planning information collected in CSI 360 sessions.
Legal Matter Content: information you share with CSI Group Law Firm, P.C. within an engagement, handled under Section 6.
Health-related information where relevant to estate, long-term care, or protection planning you request.
Payment information processed by our payment processors; we do not store full card numbers.
Communications and AI interactions: messages, meeting notes, where disclosed at the time recordings or transcripts of meetings, and your interactions with Ask Peter, which are retained and used as described in Section 4.
Device and usage information: IP address, device and browser type, log data, session and last-login tracking, and Portal activity, collected through cookies and similar technologies used for authentication, security, and Portal analytics. The Portal does not use advertising or cross-context behavioral tracking technologies.

We collect information directly from you, automatically through your Portal use, and from third parties such as custodians (including Charles Schwab), the IRS and state tax authorities, plan recordkeepers, and identity verification services.

3. How We Use Information

To provide the Professional Services you engage and operate your accounts;
To operate, secure, maintain, and improve the Portal, including authentication, fraud prevention, and troubleshooting;
To coordinate integrated planning across the CSI Entities you work with, including CSI 360 reviews, subject to the limits in Sections 5, 6, and 7;
To provide and personalize our AI features as described in Section 4, which does not include model training on your data;
To communicate with you about your engagements, appointments, deadlines, and Portal features;
To send you information about CSI services that may interest you, which you may opt out of at any time, and which for Tax Return Information occurs only with a valid Section 7216 consent;
To comply with law, professional rules, regulatory examinations, and legal process, and to establish or defend legal claims.

We do not sell your personal information, and we do not share it with third parties for their own marketing or for cross-context behavioral advertising.

4. AI Features

The Portal includes AI-assisted features. Ask Peter can answer your questions about your accounts, documents, and CSI's services, and CSI personnel use AI-assisted tools to prepare for and follow up on your meetings.

4.1 No Model Training on Your Data

CSI does not use your personal information, documents, or interactions with Ask Peter to train or fine tune any AI model. Our AI infrastructure providers process member data for inference only, meaning solely to generate a response to a request, and do not use it to train their models. There is no training pipeline that member data enters.

4.2 Personalization and Memory

To improve response quality over time, Ask Peter maintains a working knowledge base and progressively refines its own instructions based on interactions. This personalization data is held within CSI's own environment, is used only to serve CSI and its members, does not modify any underlying AI model, and is deleted when the associated member data is deleted.

4.3 If Training Is Ever Introduced

If CSI decides in the future to use member interactions to train internal AI models, we will notify you in advance and obtain your affirmative acceptance before your data is used; your Tax Return Information will be excluded unless you sign a separate IRC Section 7216 consent specifically authorizing that use; Legal Matter Content will remain permanently excluded; and you will be able to decline or opt out without affecting your services.

4.4 Processing Safeguards

Purpose limitation. AI processing occurs only to respond to a request from you or from CSI personnel serving you, under CSI's written AI policy.
Access controls. AI features respect the same entity-level and matter-level access restrictions that apply to CSI personnel, including the legal workspace segregation described in Section 6.
Infrastructure. The Portal is hosted on U.S. infrastructure; member data is stored in the United States, encrypted in transit and at rest, and processed by a limited set of infrastructure providers (currently cloud hosting and AI model inference) under confidentiality and data processing terms. No new subcontractor is given access to member data without advance notice to CSI.

5. Tax Return Information (IRC Section 7216)

Federal criminal and civil law (Internal Revenue Code Sections 7216 and 6713) restricts how tax return preparers use and disclose Tax Return Information. CSI's tax practice uses and discloses your Tax Return Information only:

to prepare and file your returns and provide the related services you engaged;
as permitted without consent by Treasury Regulation Section 301.7216-2, for example disclosures required by legal process or to contracted preparers assisting with your return under confidentiality obligations; or
with your prior written consent, obtained through a separate standalone consent document that complies with Treasury Regulation Section 301.7216-3 and Revenue Procedure 2013-14. Separate consents are used for disclosure to affiliated CSI Entities and for use in offering you non-tax services. If AI training is ever introduced as described in Section 4.3, a further separate consent would be required before any Tax Return Information could be used for it.

Accepting this Policy or the Terms of Service is not a Section 7216 consent. You may decline any consent without affecting your tax engagement or Portal access.

6. Legal Matter Information and Privilege

Information you share with CSI Group Law Firm, P.C. within an engagement is protected by the duty of confidentiality and, where applicable, the attorney-client privilege and work product doctrine. Legal matter workspaces in the Portal are segregated: they are accessible only to CSI Group Law Firm, P.C. personnel and individuals you authorize. Legal Matter Content is not shared with other CSI Entities, is not used for cross-entity planning or marketing, will never be used to train AI models (including under any future training program), and is not surfaced by Ask Peter outside the legal workspace, unless you give informed consent or disclosure is required or permitted by the Rules of Professional Conduct.

7. How We Share Information

Among CSI Entities. We share information among the CSI Entities to serve you in an integrated way, to administer the Portal, and for compliance, subject to the hard limits in Sections 5 and 6. Federal law gives you the right to limit certain sharing among affiliates; the GLBA privacy notices delivered to you describe any sharing you may limit and how to exercise those choices.

Service providers. We share information with providers that build, host, and support the Portal and our systems, including our platform development partner, U.S. cloud hosting infrastructure, an AI model inference provider, and tax software, e-signature, scheduling, communications, payment, and security vendors. Providers are bound by confidentiality obligations, may use your information only to provide services to CSI, and do not use your information to train their own models. Third-party integrations are configured to the most restrictive available data settings.

Custodians and counterparties. We share information as needed to execute your instructions, for example with Charles Schwab as custodian, plan recordkeepers, and federal and state taxing authorities when filing your returns.

Legal and safety. We disclose information in response to subpoenas, court orders, regulatory examinations, and other legal process, to defend legal claims, and to protect the rights, property, and safety of CSI, our clients, and the public, in each case consistent with professional confidentiality duties, which for legal clients may require asserting privilege before any disclosure.

Business transitions. If a CSI Entity is involved in a merger, acquisition, or sale of assets, information may be transferred to the successor subject to this Policy, applicable professional rules governing transfer of client files, and required notices and consents.

8. Data Security and Incident Response

CSI maintains a written information security program with administrative, technical, and physical safeguards designed to protect customer information consistent with GLBA, including the safeguards requirements applicable to each CSI Entity under the FTC Safeguards Rule or SEC and state investment adviser regulations, as applicable. The program includes:

encryption of data in transit and at rest, multi-factor authentication, role-based and entity-based access controls, and logging and monitoring;
a written incident response program to detect, respond to, and recover from unauthorized access to or use of customer information;
due diligence and oversight of service providers; and
recordkeeping documenting our compliance.

If a breach of security involving your sensitive customer information occurs, or is reasonably likely to have occurred, we will notify you as soon as practicable and no later than 30 days after we become aware of the incident, except where a law enforcement delay applies, and we will make all regulator notifications required by law, including under the New Jersey Identity Theft Prevention Act, the New York SHIELD Act, the FTC Safeguards Rule breach reporting requirement, and the breach notification laws of the other states where our members reside.

No system is perfectly secure. Protect your credentials, enable multi-factor authentication, and notify us immediately of suspected unauthorized access.

9. Data Retention

We retain personal information for as long as needed to serve you and as required by law and professional rules. Retention periods differ by entity: tax workpapers and returns, investment advisory books and records, retirement plan records, and legal client files each carry their own regulatory or ethical retention requirements. The Ask Peter personalization data described in Section 4.2 is deleted when the associated member data is deleted. When retention periods expire, we dispose of customer information securely, and upon any platform vendor transition, member data is returned to CSI and deleted from vendor and subcontractor systems. Closing your Portal account does not by itself delete records we are required to keep.

10. Your Rights and Choices

Access and correction. You may access most of your information directly in the Portal and may ask us to correct inaccurate information or provide copies of records to which you are entitled, including your legal client file.
Deletion. You may request deletion of information we are not required to retain; we will explain what must be kept and why.
AI training. Your data is not used for model training today. If training is ever introduced, you will have the notice, acceptance, and opt-out rights described in Section 4.3.
Marketing opt-out. You may opt out of marketing communications at any time using the unsubscribe link or by contacting us. Servicing and compliance communications will continue.
Affiliate sharing and GLBA opt-outs. Your GLBA privacy notices describe any sharing you may limit and how to exercise those choices.
Section 7216 consents. You may decline any tax information consent and may revoke a previously given consent prospectively by written notice.
Text messages. Reply STOP to opt out of non-essential texts.

We will verify your identity before acting on a request and will respond within the time required by applicable law, and in any event within 45 days for routine requests. We will not discriminate against you for exercising a privacy right.

11. State-Specific Disclosures

CSI serves members in nearly all U.S. states. Most of the personal information we handle is collected in connection with financial products and services and is therefore subject to GLBA rather than state comprehensive privacy laws, which generally exempt GLBA-regulated data or GLBA-regulated entities. Where a state comprehensive privacy law nonetheless applies to information we hold about you, you may exercise the rights that law provides, including rights of access, correction, deletion, and portability, by contacting us as described in Section 13.

California. The California Consumer Privacy Act exempts information collected subject to GLBA at the data level, not the entity level. For any California personal information we hold outside that exemption, California residents may exercise CCPA rights, including the right to know, delete, and correct. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use or disclose sensitive personal information for purposes requiring a right to limit.

New Jersey. The New Jersey Data Privacy Act exempts financial institutions subject to GLBA at the entity level. CSI nonetheless honors the practices in Section 10 for New Jersey residents as a matter of policy.

New York. CSI complies with the New York SHIELD Act's reasonable safeguards and breach notification requirements for New York residents' private information.

12. Children

The Portal is not directed to children, and only adults may hold Portal accounts. We collect information about minors, such as dependents and beneficiaries, only as provided by their parent or guardian in connection with the services, and we do not knowingly collect information directly from children under 13. Information about minors would be permanently excluded from any future AI training program.

13. Changes and Contact

We may update this Policy from time to time. We will post the updated Policy in the Portal with a new effective date and will notify you of material changes in advance through the Portal or by email. Material changes that expand how we share your information or how we use it for any future AI training will not apply to previously collected information without any consent applicable law requires.

Privacy questions, requests, and complaints: CSI Group Business Solutions, LLC, Attn: Privacy Officer, 1599 NJ-34, Suite 2, Wall Township, NJ 07727; inquiry@csicpa.com; (732) 224-3990. If you are a legal services client, you may also contact your attorney directly regarding confidentiality of your matter.

14. Important Disclosures

Securities offered through LPL Financial LLC, a FINRA/SIPC member broker/dealer. Advisory services offered through CSI Group Advisors, LLC, a registered investment advisor. LPL Financial LLC and CSI Group Advisors, LLC are unaffiliated separate legal entities. Contents are for information purposes and do not constitute an offer to buy or sell securities nor is it investment advice. All investments involve the risk of loss including the entire principal amount invested. Past performance is not indicative of future results. Prior to investing, please consult with a qualified professional who is familiar with your financial objectives, risk tolerance, and investment time horizon. CSI Group Advisors, LLC does not provide tax or legal advice, such services are provided through separate affiliated entities under common control. An engagement with CSI Group Advisors, LLC does not establish a privileged attorney-client relationship.

CSI Retirement Services LLC is a licensed insurance agency offering insurance and annuity products; guarantees are subject to the claims-paying ability of the issuing insurer. Annuities are not FDIC/NCUA insured, are not bank guaranteed, are not a deposit, are not insured by any federal government agency, and may lose value.

CSI Group Law Firm, P.C. is a separate legal entity providing legal services only in jurisdictions where its attorneys are properly licensed. No attorney-client relationship exists unless a written retainer agreement is executed. If you are a client of an affiliated CSI entity, you are not a client of CSI Group Law Firm, P.C. unless you have signed a retainer agreement. Legal information is stored separately and is not shared with other CSI entities.

Each of the aforementioned entities utilizes the trade name “CSI Group” in its marketing; however, each entity is legally and operationally separate, maintains separate books and records, and requires a separate engagement agreement. Engaging one CSI entity does not require or imply engagement of any other CSI entity. The use of the term “member” in marketing materials is descriptive only and does not create any obligation to engage additional services, nor make you part of any program or collective club or organization. You are free to use any professional or service provider of your choosing. “CSI” is a trade name and stands for Confidence, Service, Integrity. CSI Group® is a registered trademark. CSI Group® and its associated logo are protected intellectual property. Unauthorized use is prohibited.