Privacy Policy

Taxably, Inc. ("Taxably", "we", "us", "our") provides software services to licensed tax professionals and the firms that employ them. This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights.

This Privacy Policy applies to:

• The Taxably marketing website at taxably.ai
• The Taxably web application at app.taxably.ai
• The Taxably forms, investor and administration websites at forms.taxably.ai, investors.taxably.ai and admin.taxably.ai
• The Taxably Connect desktop application
• Related APIs and services

This Privacy Policy does not apply to information about individual taxpayers that our customers ("Firms") process using the Services. That information is governed by the Firm's own privacy practices, by applicable tax confidentiality law (including IRC § 7216), and by our Data Processing Addendum with the Firm. See Section 1.3 below for how taxpayer document data is handled.

The Services are intended for use by licensed tax professionals located in the United States. We do not direct the Services to users outside the United States.

By using our Services, you agree to the practices described in this Privacy Policy.

1. Information We Collect

1.1 Information you provide

• Account information: name, email address, password, organization (firm) name, professional credential type (EA, CPA, JD, other), and role.
• Billing information: your payment method is collected and held by our contracted payment processor. We receive transaction metadata (amount, status, plan, last four digits of the card) but not full card numbers.
• Communications: the contents of support requests, feedback, and other messages you send us. If a client's tax document reaches us by email, we do not keep or use it: we delete it and tell the sender, as described in Client Documents Sent to Taxably by Email.
• Profile and preferences: firm settings, device names, notification preferences, and similar configuration data.
• Applications and forms: what you enter into a form on our websites, such as a Founders Edition request or a contact form, and any file you attach to an application, such as proof of professional practice or a credential. Attached files are held in our cloud storage (Amazon Web Services) for the review of the application. Attach only your own credential documents, never a client's tax document.
• Demonstration requests: your name, email address and answers when you book a product demonstration through the scheduler on taxably.ai/demo, which is provided by Calendly.

1.2 Information collected automatically

• Usage data: features used, pages viewed, actions taken in the web app and the Taxably Connect desktop application.
• Device and technical data: operating system version, application version, machine identifier (a non-reversible fingerprint), browser type, screen resolution.
• Log data: IP address, timestamps, request paths, error codes, and similar diagnostic information.
• Cookies and similar technologies: see Section 6.

1.3 How taxpayer document data is handled

Taxably is not a system of record for taxpayer documents. The current installer defaults to the individual-document reading path:

• The document stays on the Firm's own computer. To be read, its pages are transmitted over encrypted connections from that computer directly to a contracted document-processing Subprocessor under the processing restrictions in our Data Processing Addendum, including the prohibition on using customer tax content to train models. The current provider is identified in our Subprocessor List.
• Taxably's own cloud infrastructure is not on that path and holds no copy of the document.

Bulk processing is off by default. Where separately enabled, document content is temporarily held in United States storage administered by Taxably for the job. Authorized personnel may have administrative access during that period; cleanup requirements and safeguards are described in Section 3.2 of the Data Processing Addendum. This temporary processing is not a document archive or backup service. The AI & Model Training Policy distinguishes no-training restrictions from provider-retention settings and conditional abuse-monitoring retention. This explanation does not waive or reduce Taxably's obligations under the Data Processing Addendum.

The structured operational records on Taxably's services are separate from source documents. These hosted records reference clients through opaque tokens generated on the Firm's own systems rather than by name, and identifier fields such as Social Security Numbers, taxpayer identification numbers, and dates of birth are removed before a hosted structured record is stored. The full working records and generated prep sheets remain on the Firm's computer.

Long-term retention of source documents is not a feature of the Services. Firms cannot opt in to a server-side document archive.

1.4 Connected AI assistants

A Firm may connect an AI assistant to the Taxably Connect application on the Firm's own computer. The assistant asks Taxably Connect on that computer, which answers from the records it keeps there, only about clients whose prep sheet the Firm has built, and an answer can contain client information from the Firm's records. Questions and answers do not pass through Taxably's servers. The assistant may suggest an action, such as an answer to a question, a note, a rebuild or an export; Taxably Connect does nothing with a suggestion until a person at the Firm approves it. Taxably no longer offers a connection through the Firm's Taxably account or from outside the Firm's computer. The assistant's own provider is chosen by the Firm, and its terms govern what it does with the information it receives. See the AI & Model Training Policy.

2. How We Use Information

We use information to:

• Provide, operate, and maintain the Services
• Authenticate users (including multi-factor authentication) and protect accounts against fraud and unauthorized access
• Process payments, manage subscriptions, and prevent payment fraud
• Send transactional communications, including account verification emails, security notices, billing receipts, and service announcements
• Provide customer support
• Monitor and improve performance, reliability, and security
• Develop new features and understand product usage in aggregate
• Comply with legal obligations and enforce our Terms of Service

We do not use your information to train machine learning models without your explicit consent. We do not sell personal information. We do not engage in cross-context behavioral advertising.

3. How We Share Information

3.1 Service providers (Subprocessors)

We share limited information with third-party vendors (Subprocessors) who help us operate the Services across categories such as cloud infrastructure, document processing, authentication, payment processing, transactional communications, error monitoring, security, product and website analytics, and demonstration scheduling. A complete, current list of our Subprocessors, including their specific functions and processing locations, is published in our Subprocessor List.

Changes to that list remain subject to the notice and objection requirements in the Data Processing Addendum, where applicable. Referencing the list here does not remove any notice required for a material change to our privacy practices under Section 10.

Each Subprocessor is contractually bound to use information only to provide services to Taxably and to protect it consistent with this Privacy Policy.

3.2 Legal compliance

We may disclose information when we believe in good faith that disclosure is required by law, legal process, or to protect the rights, property, or safety of Taxably, our customers, or others. Where legally permitted, we will notify the affected customer before disclosure.

3.3 Business transfers

If Taxably is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred to the successor entity. We will notify you of any such transfer and your choices.

3.4 With your direction

We share information with third parties when you direct us to do so, for example when you connect a third-party integration to your account.

4. Data Retention

• Account information is retained for as long as your account is active and only as specified below after closure. Our retention policy limits account records needed for legal, tax, accounting, or dispute matters to up to seven years after account closure; other identifiable account data remains subject to the 90-day deletion requirement below. Billing records are retained for seven years from the transaction. A longer period applies only where required by law or for a documented legal hold, and only for the records needed for that purpose.
• Usage and log data is retained for up to 13 months in identifiable form. After that, it is aggregated or deleted.
• Backups are retained for up to 35 days.
• Applications and attached files are kept while the application is reviewed and the program it applies to is administered. There is no automatic deletion of attached files today; you may ask us to delete an application and its attachments at legal@taxably.ai.
• Closed accounts: our retention schedule requires deletion of identifiable account data from active systems within 90 days of account closure, subject to the limited records exceptions above. Account closure and deletion are separate steps; you may request confirmation of deletion at legal@taxably.ai.

5. Security

We implement administrative, technical, and physical safeguards designed to protect information against unauthorized access, alteration, disclosure, and destruction. These include:

• TLS 1.3 encryption in transit
• AES-256 encryption at rest
• Multi-factor authentication (authenticator app, passkeys, backup codes) available on all customer accounts
• Least-privilege access controls and audit logging
• Vulnerability management and code review; independent penetration testing is a documented requirement, with no completed report currently available
• Documented incident response procedures
• Documented personnel requirements for security training, confidentiality, and background checks where lawful
• SOC 2 preparation; no issued SOC 2 Type II report is currently available. Current assurance status and requests for materials are addressed in the Security & Compliance Overview

No system is perfectly secure. We cannot guarantee absolute security.

6. Cookies and Similar Technologies

We use cookies and similar technologies for three purposes:

• Strictly necessary: required for the Services to function, including authentication, session management, and security.
• Functional: to remember your preferences and settings.
• Analytics: to understand how the Services are used in aggregate. Non-essential analytics and session replay are off by default and activate only after you accept analytics in the cookie consent banner. Session replay applies client-side masking to inputs and on-screen text, with additional restrictions on recorded attributes, media, and network content. We do not use cross-site tracking cookies. The Cookie Policy describes the tools and choices, and the Subprocessor List identifies the providers.

You can change your analytics choice at any time from the "Cookie preferences" link in the site footer or on the Cookie Policy page at taxably.ai/cookies, which lists every cookie we set. You can also control cookies through your browser settings. Disabling strictly necessary cookies may prevent parts of the Services from working.

7. Your Rights and Choices

7.1 All users

You may:

• Access information we hold about you
• Correct inaccurate information
• Delete your account and associated information
• Export your account data
• Object to or restrict certain processing
• Opt out of non-essential marketing communications

To exercise these rights, contact legal@taxably.ai or use the controls in your account settings.

7.2 California residents (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect and how we use it
• Request deletion or correction of your personal information
• Limit our use of sensitive personal information
• Opt out of the sale or sharing of personal information (we do not sell or share, but the right is yours regardless)
• Be free from retaliation for exercising your rights

To submit a request, contact legal@taxably.ai. We will verify your identity before responding. You may designate an authorized agent to act on your behalf, subject to verification. For requests to know, correct, or delete information, agents must provide your signed authorization; we may also ask you to verify your identity or confirm the authorization directly, as permitted by law. A valid power of attorney is accepted where applicable, but is not required to appoint an agent.

7.3 Other US state residents

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and other states with comprehensive consumer privacy laws have substantially similar rights. To exercise them, contact legal@taxably.ai.

8. United States Operations

Taxably operates from and stores all data in the United States. The Services are offered to users located in the United States only.

9. Children's Privacy

The Services are intended for use by licensed tax professionals. We do not knowingly collect information from anyone under the age of 18. If you believe a minor has provided us with personal information, contact legal@taxably.ai and we will delete it.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or in-app notice at least 30 days before the changes take effect. The "Last Updated" date at the top of this Privacy Policy reflects the most recent revision.

11. Contact Us

Privacy questions and requests: legal@taxably.ai General contact and support: support@taxably.ai Security incidents: security@taxably.ai

Taxably, Inc., a Delaware corporation
Registered office: 131 Continental Dr, Suite 305, Newark, DE 19713, USA

Mailing address:
Taxably, Inc.
4539 N 22ND ST #7547
PHOENIX, AZ, 85016, USA