Privacy policy

Taxerity.AI privacy policy.

Effective date: 2026-07-29

Your clients trust you with their financial data. This page explains what Taxerity.AI collects, how we use it, how Stripe payment data is handled when you upgrade to Pro, how long we keep it, and how to exercise your rights. We have tried to write it the way we would want to read it — plainly, with no surprises.

What we collect

Seven categories of data — and exactly where each one lives

We collect only what the platform needs to operate. Each row below names the existing record the data flows into, so you can verify scope end-to-end.

Account email
The email you use to sign in — and the address we tie to product updates, billing receipts, and security notifications. Stored in your Account.email record. Used for authentication, transactional email, and never sold or shared with third parties for marketing.
Preferred state
The state you tell us you prepare returns for. Drives the state-specific review templates, the public coverage roadmap, and region-aware product updates. Stored in your TrialAccount.preferredState record and editable from the in-product settings panel at any time.
Contact preference
Whether you opt in to product news and the early-access beta program. Stored alongside your account record as a boolean. You can flip it from the email footer of any product email we send (one-click unsubscribe, no login required) or from the in-product notification settings.
Uploaded documents
Source documents you upload for deduction review — receipts, prior-year returns, broker statements. Stored as UploadedDocumentrecords, scoped by the application's available access controls. Encryption, processing, retention, and model-training terms depend on the deployed service configuration and applicable agreements; review them before uploading taxpayer information. You can delete a document and its audit-log references at any time from the Documents dashboard where that workflow is available.
“Talk to us” intake
When you fill out the Talk-to-us panel on the pricing page, we save a Lead row (name, firmName, firmSize, email, optional message) and dedupe on email — re-submitting from the same address updates the same row in place so the first-seen timestamp is preserved. Honeypot hits are tagged status = ‘bot’ so the audit trail covers bot attempt volume alongside real leads. Operator-only (not used for marketing automation, not integrated with any third-party CRM).
Owner-Review Checklist progress
The per-engagement check/tick state against the printable six-step owner-review list on /checklist is written to window.localStorage only — on the device you tick on. No server round trip, no cross-device sync, no account. Clearing your browser's site storage clears your ticks; signing in from a different device starts a fresh list.
Email & notification paths
All app mail goes through our installed email module — composed in @/lib/email/templates and delivered via sendEmail() from @/lib/email/send, which routes through the platform email proxy. No vendor SDK is imported (no Postmark, SendGrid, Resend, Nodemailer, or SES), no vendor API key lives in this repo, no attachments, no cc/bcc, no custom From, and no inbound webhook is operated. Customer-facing transactional mail carries an unsubscribe footer where applicable; the operator-only Talk-to-us ping carries none.

How we use it

Two jobs — deduction research and reviewer-queued AI suggestions

Deduction research. Your account, preferred state, and uploaded documents drive the deduction research surface — IRC citation lookup, state-specific rule lookups, reviewer-queued suggestions, and an append-only audit log so the work your firm performs is traceable to the reviewer who accepted or rejected it.

AI generation. AI-flagged deductions, anomalies, and classifications are produced through the platform Agent API — Taxerity.AI does not import any third-party model SDK and we do not hold a vendor LLM key. Inputs and outputs are not retained once a suggestion is delivered to your firm's reviewer. Nothing leaves the platform Agent API boundary except the suggestion itself, the citation it cites, and the audit-log entry that records the reviewer's decision.

Operator notification paths. The Talk-to-us intake and other operator-facing pings land in a single team inbox resolved in the order POLSIA_BETA_LEADS_TO → POLSIA_COMPANY_EMAIL → POLSIA_OWNER_EMAIL (see src/app/api/pricing-contact/route.ts). Re-submissions dedupe on email and the row is written before the notification fires, so a transport hiccup logs but never loses a lead — the operator sees the submission on the next triage pass regardless of whether the email went through.

We do not present this page as a universal privacy, residency, or model-training guarantee. Review the deployed configuration, provider terms, and your firm's policy before submitting taxpayer information; contact us about applicable deletion or access requests.

Stripe payment data

Card data never reaches Taxerity.AI — or any third party on our behalf

When you upgrade to Pro, payment is handled server-side through the platform Stripe Connect module. The owner of this app never supplies a Stripe key, never embeds a card form, and never operates a Stripe webhook handler.

Card data is collected and processed by Stripe through a hosted checkout redirect. Neither Taxerity.AI nor any third party receives card PAN or CVV — the browser posts card details directly to Stripe's hosted page, and Stripe returns to the platform a verified payment record. Taxerity.AI only stores the buyer email, the plan you purchased, your subscription state (active, past-due, canceled), and the Stripe-issued identifiers (customer, subscription, checkout_session) we need to render your subscription state in-product.

The owner of this app never sees, stores, or transmits cardholder data, and no webhook handler is operated by Taxerity.AI — fulfillment is verified on the success page via the platform Stripe Connect module's server-side verification helper.

Retention

How long each category of data is kept

Account & uploaded documents. Retained for the life of your account plus a defined post-cancellation window so you can recover in case of an accidental cancellation. After that window, account records and uploaded documents are deleted from production storage.

Audit log.Append-only, timestamped records of every AI suggestion, reviewer decision, permission change, and export event are retained for an owner-configured retention period. The appropriate period and record sufficiency depend on the engagement and require qualified tax, legal, and privacy review. The log is exportable as a PDF from the in-product Security & Compliance dashboard.

AI inference inputs and outputs. Processing and retention depend on the configured service and applicable terms. Review the deployed configuration and provider terms before using taxpayer information; the public preview is not a clearance for real taxpayer data.

Stripe payment identifiers. Retained as long as your subscription is active, plus the same post-cancellation window as your account. Deleting your account deletes these identifiers with it.

Talk-to-us leads. The Lead row written from the /pricing Talk-to-us panel is operator-triage data — retained for an operator-defined triage window and deletable on request via the same mailto: address listed under Your rights. Bot-tagged rows are retained for the same window so the audit trail covers bot attempt volume.

Your rights

Access, correction, deletion, portability — all via one inbox

You can request access to the personal data we hold about you, ask us to correct inaccurate records, request deletion of your account and uploaded documents, or ask for a portable export of your firm's records. We respond to every request — typically within two business days.

Send your request to taxerity-ai@polsia.app with a short note describing what you need. We'll confirm the scope and walk through the next step.

Typical reply time: within two business days.

Changes to this policy

Material changes ship with an in-product banner and a changelog entry

If we make a material change to this policy — a new category of data, a new retention window, a new sub-processor — we announce it with an in-product banner in the firm dashboard and publish a changelog entry on the What’s new page. The updated effective date is shown at the top of this page, and previous versions are available on request.

Questions about a specific change? Email the team.