Privacy Policy

1. Information we collect

• Account data: name, email, password (hashed), preferred language, phone (optional), 2FA secret (encrypted).
• Tax data: Social Security Number (encrypted at rest with AES-256), date of birth, address, dependents, employer information, W-2 and 1099 figures, deductions, credits.
• Documents: W-2s, 1099s, receipts and other files you upload to your document vault.
• Payment data: handled exclusively by Stripe. We never store credit card numbers.
• Usage data: IP address, browser type, pages visited, timestamps.

2. How we use your information

• Prepare and generate your tax return.
• Process payments and send receipts.
• Send transactional emails (account verification, password reset, payment confirmation, CPA approval).
• Provide customer support.
• Improve our software (using aggregated, anonymized data only).
• Comply with legal obligations (tax record retention).

3. How we share your information

We do NOT sell your personal information. We share data only with:

• Stripe — for payment processing.
• OpenAI — when you use OCR to auto-fill data from uploaded W-2/1099 documents. The image is sent to OpenAI Vision API and not retained by OpenAI per their API data policy.
• Assigned CPA (only if you request CPA review) — your CPA sees the tax return data necessary to perform the review.
• Email providers — for sending transactional emails.
• Law enforcement — only when legally compelled by valid subpoena.

4. Data security

• All sensitive data (SSN, EIN, financial figures) is encrypted at rest using AES-256.
• All connections use HTTPS/TLS 1.2+.
• Passwords are hashed using bcrypt with 12 rounds.
• Two-factor authentication (Google Authenticator) is available and recommended.
• Servers are located in the United States.
• Database backups are encrypted and rotated daily.

5. Data retention

We retain tax-related data for 7 years after the tax year for which the return was prepared, as required by U.S. tax law (IRC §6501). Account data is retained until you delete your account or 7 years after your last activity, whichever is later.

You may request deletion of your account at any time by emailing privacy@usataxes.com, subject to legal retention obligations.

6. Your rights

You have the right to:

• Access your personal data and download a copy.
• Correct inaccurate data.
• Request deletion (subject to legal retention obligations).
• Opt out of non-essential email communications.
• If you are a California resident, you have additional rights under the CCPA — visit our CCPA notice.

7. Cookies

We use only essential cookies required for authentication and session management. We do not use third-party tracking or advertising cookies. Optional analytics (Plausible — privacy-respecting, cookie-free) measures aggregate page views only.

8. Children

USA Taxes is not directed to children under 18. We do not knowingly collect data from minors.

9. Changes to this policy

We may update this Privacy Policy. Material changes will be communicated by email with at least 30 days notice.