TaxNoticePilot Privacy Policy

1. Introduction

TaxNoticePilot (“TaxNoticePilot,” “we,” “us,” or “our”) provides an online service that helps tax professionals and their clients analyze IRS and state tax notices, identify deadlines, and generate structured response workflows. The documents you upload are among the most sensitive records a person has, and this policy is written to be specific about what happens to them rather than reassuring.

For a shorter, plain-English version written for tax professionals evaluating us, see How we protect your data.

2. Information We Collect

• Account information. Your name, email address, and authentication credentials when you create an account, join a waitlist, or are invited to a firm.
• Notice content. The PDFs and images you upload, the text extracted from them, and the fields derived from that text, agency, tax period, notice date, amounts, and deadlines. For a firm, this includes documents uploaded by your clients through an intake link you share with them.
• Client records. For firm accounts, the names, email addresses, phone numbers and notes you record about your clients.
• Case data. Risk scores, classifications, recommended next steps, generated drafts, and the notes and status changes you save.
• Billing information. Handled by Stripe. Card numbers never reach our servers.
• Usage and access data. Device, browser, IP address, and product events. This includes a record of who opened a notice or downloaded its files, and when, see section 6.

3. How We Use Your Information

• To process uploaded notices and produce the analysis, risk score, deadlines, and recommended next steps you asked for.
• To create and manage your account, cases, clients, and reminders.
• To process payments and provide receipts.
• To protect the service from fraud, abuse, and unauthorized access.
• To communicate with you about your account, product updates, and support requests.
• To improve the accuracy of our notice extraction and analysis. We do not train any model of our own on your documents. What we learn is how the product performs, which notice types we encounter, how often an analysis needs correcting, how long processing takes, and never the contents of a particular notice.

4. How We Share Information

We do not sell your personal information, and nothing from your documents or your clients’ records is ever shared for advertising. To measure and improve our own ads we use an advertising platform. Its pixel runs on our marketing website, never inside the product. When someone signs up for or subscribes to TaxNoticePilot Pro, we tell the platform so, with the email address and account id in hashed form, the IP address, the browser’s user agent, the platform’s own ad-click cookies, and the price of a subscription.

We rely on the following service providers, each used only for the purpose listed. Each of them is bound by a data processing agreement with us.

• Cloud infrastructure and storage, hosting our application, database, and the private storage that holds uploaded documents.
• Document processing and analysis, converting an uploaded scan into text and producing the analysis. These providers do not use your content to train or improve their models, do not make it public, and do not share it onward. They retain content only briefly, for security and abuse prevention, before deleting it.
• Payments, processing transactions and subscription billing.
• Email delivery, sending transactional and product email.
• Product analytics and error monitoring - understanding how the product is used and detecting faults. Product events are tied to your account and your email address, so we can see how a person uses the product over time. Session recordings are interaction events, not video: all text is hidden inside your browser before anything is sent, and the pages of a notice are left out of the recording entirely, so taxpayer names, balances and notice text are not included. Error reports are sent automatically and leave out what you submit, and have email addresses, sign-in and upload links, and the values in database queries removed. A problem report you choose to send us carries what you write in it, and your email address if you give one.
• Advertising measurement - learning which of our ads lead to sign-ups, as described above.
• Company email and workforce tools - the mailbox your messages to us arrive in, and the platform through which we engage our contractor, whose work-time tracking can capture their screen while they work on the service.

If you are a tax professional and need the identity of a specific provider to satisfy your own obligations, email us and we will tell you.

We also share information with your designated tax professional when you choose to send a case to them, and with authorities where required by valid legal process or to protect the rights, safety, or property of users and the public.

5. Data Retention

Deletion is scheduled, not something we do only when asked. The periods below are our retention schedule, and an automated job enforces it.

• A notice or client record you delete is removed from your account immediately and permanently erased, along with any uploaded files, 30 days later. The delay exists so an accidental deletion can be reversed.
• A closed firm account has its notices, client records, and files permanently erased 90 days after closure. The same applies to a closed individual account.
• Access records (section 6) are retained for two years.

Backups. We keep encrypted backups of our database so that your data can be recovered if our systems fail or become unavailable. A record erased under the schedule above may still exist in those backups for up to 35 days after its erasure, after which every backup containing it has itself been deleted. Backups are encrypted, held separately from the live system, and are read only to restore service.

You may ask us to delete your data sooner by emailing the address in section 10.

6. Security

Uploaded documents are held in private storage with no publicly reachable address. When a document is opened in the app we issue a signed link that expires after 15 minutes. Data is encrypted in transit and encrypted at rest by our storage and database providers. A firm’s notices and clients are scoped to that firm, and requests are checked against it on every read.

We keep a record of who opened a notice or downloaded its files, and when, including our own staff when they do so through the product. If you need to know who has viewed a particular notice, we can tell you. Access through our infrastructure providers’ own consoles is not recorded this way; it is limited to the two people who run TaxNoticePilot.

No system is perfectly secure. We are continuously investing in the security of the platform, and we are undergoing a SOC 2 Type II examination by an independent CPA firm. See How we protect your data for where that examination stands and a plain-English summary of the above.

7. Your Rights and Choices

Depending on where you live, you may have the right to access, correct, export, or delete the personal information we hold about you, and to object to or restrict certain processing. To exercise any of these, email us at the address in section 10. We will respond within the timeframes required by applicable law.

If you are a tax professional using TaxNoticePilot, note that for your clients’ personal information you are the controller and we act as your processor: we act on your instructions with respect to that data.

8. Children’s Privacy

TaxNoticePilot is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us and we will take steps to remove it.

9. Changes to This Policy

We may update this Privacy Policy as the product evolves. If we make material changes, particularly to retention periods or to the list of service providers in section 4, we will notify you by email or in the product. The “Last updated” date above reflects the most recent revision.

10. Contact Us

Questions about this policy, or a request regarding your data: b@taxnoticepilot.com.