Privacy Policy

• Account Information — When you create an account, we collect your email address and password. We store your password only as a salted, one-way hash; we never retain it in plaintext. If you sign in via Google OAuth, we receive your name and email address.
• Contact & Demo Information — When you request a demo, propose a collaboration, or otherwise contact us, we collect your name, email address, firm name, and any message you include, so we can respond and follow up.
• User Content — We collect the tax questions you submit, documents you upload, AI-generated responses, feedback you provide, and any notes or data you enter in products like Client Manager.
• Usage Data — We collect information about how you interact with the platform, including pages visited, features used, session duration, timestamps, and referring URLs.
• Device & Technical Data — When you use the Service, we and our analytics providers collect your IP address, browser type and version, and operating system. Our analytics tools also store a randomly generated identifier in your browser to distinguish visitors. We use this information to secure the Service, understand usage, and optimize performance.

• Provide & operate the Service — process your tax queries, generate AI responses with citations from documents you attach, and support client document intake, storage, and delivery through Client Manager.
• Improve our service — analyze usage patterns and query quality to improve the accuracy and relevance of AI-generated responses. We do not use any data you provide to train third-party AI models.
• Communicate with you — send transactional emails (password resets, account confirmations), respond to support requests, and deliver filing deadline reminders if you opt in.
• Ensure security — detect and prevent fraud, unauthorized access, and other harmful activity.
• Comply with legal obligations — respond to lawful requests from government authorities and enforce our Terms of Service.

We do not sell, rent, or trade your personal information. We do not share your identity or documents with AI providers for their own training. We do not let any third party use your data for their own purposes.

We share data only with service providers who help us run the platform (cloud hosting, AI processing, email, analytics) — bound by contract to use it solely on our behalf — and only as required by law, or as part of a business transfer (such as a merger, acquisition, or sale of assets), in which case we will notify you. Our subprocessors are listed in Section 4.

We engage a limited set of subprocessors to help us operate the Service. Each is bound by written agreement to protect your data, to use it only to provide services to us, and to maintain confidentiality and security safeguards consistent with this policy. Our current subprocessors are:

Infrastructure & hosting — Amazon Web Services, Cloudflare, Vercel, Pinecone

Analytics — PostHog

Research and technical support — Partnertax AI Pvt. Ltd., our research and technical support wing

For additional information on subprocessors, email us at support@partnertax.ai.

We retain personal data only as long as needed to provide the Service and to meet legal, tax, and security obligations:

• Account information — retained for the life of your account and deleted within 30 days of account closure.
• Documents attached to the AI tax assistant — A copy of the document's text with sensitive identifiers masked (see Section 7) is retained in encrypted storage so your documents can be restored to a chat session and is deleted when you delete the related chat session or close your account.
• Client Manager documents (client intake files and delivery documents such as K-1s) — retained for the life of your account or the related engagement, and deleted within 30 days of account closure unless you delete them sooner.
• Tax queries and AI responses — retained until you delete them or within 30 days of account closure.
• Usage and analytics data — retained for up to 14 months.
• Server and security logs — general server logs for 90 days; security/audit logs for 1 year.
• Support communications — approximately 24 months.
• Contact and demo information — retained until you ask us to delete it, or up to 24 months after our last interaction with you.
• Billing records — 7 years, to comply with applicable tax and financial-record laws.

De-identified or aggregated data may be retained indefinitely. Where the law requires, we may retain certain records longer, after which the data is deleted or irreversibly anonymized.

We use cookies and similar technologies for the following purposes:

• Essential Cookies — Required for authentication, session management, and security. These cannot be disabled.
• Analytics — To understand traffic and improve the Service, we use first-party product analytics on our pre-login pages, where it distinguishes visitors. Within the authenticated application we use only cookieless performance and traffic measurement. We do not capture the contents of form fields. On our public marketing and pre-login pages, we may record browsing sessions to improve the experience; all text and inputs are masked in your browser before anything is transmitted. We honor the browser Do-Not-Track signal.

We do not use advertising or third-party tracking cookies.

We implement industry-standard security measures to protect your data, including encryption in transit (TLS/SSL) and at rest, secure password hashing, role-based access controls, and regular security reviews.

• Encryption of stored documents — Uploaded documents are stored and encrypted at rest using AWS Key Management Service (KMS). The encryption keys are held within AWS KMS and are never exported from it; our systems use these keys only under strict access controls to process your documents. All data is transmitted over encrypted (TLS) connections.
• Document redaction — Before an uploaded document's contents are stored or sent to an AI model, we automatically detect and mask sensitive identifiers (such as Social Security, taxpayer, and bank-account numbers). This is a best-effort safeguard and does not guarantee the removal of all sensitive information, so we advise not to upload sensitive information.
• Breach Notification — In the event of a data breach involving your personal information, we will notify you and any applicable regulatory authorities without undue delay and as required by applicable state and federal law.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you.
• Correction — Request that we correct inaccurate or incomplete data.
• Deletion — Request that we delete your personal data and account.
• Export — Request a portable copy of your data in a machine-readable format.
• Objection — Object to processing of your data in certain circumstances.

To exercise any of these rights, please contact us at support@partnertax.ai. We will acknowledge your request within 10 business days and respond substantively within 30 to 45 days depending on the nature of the request and applicable law.

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"):

• Right to Know — You may request the categories and specific pieces of personal information we have collected about you, the sources of that information, our business purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Delete — You may request deletion of your personal information, subject to certain legal exceptions.
• Right to Correct — You may request that we correct inaccurate personal information.
• Right to Opt-Out of Sale/Sharing — We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information — We only use sensitive personal information (such as account credentials) as necessary to provide the Service.
• Non-Discrimination — We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To submit a request, contact us at support@partnertax.ai. We will verify your identity and respond within 45 days as required by law. You may also designate an authorized agent to make a request on your behalf.

Categories of Personal Information Collected: Identifiers (name, email, IP address); professional information (tax queries, uploaded documents); internet activity (usage data, session logs); geolocation (derived from IP). We collect these for the business purposes described in Section 2.

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws may have similar rights to access, correct, delete, and port their personal data, and to opt out of targeted advertising or profiling. To exercise these rights, contact us at support@partnertax.ai. We will process your request in accordance with applicable state law.

PartnertaxAI is not designed for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected data from an individual under 18, we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by email or by posting a notice on the platform. Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

PartnertaxAI
56 Broad St STE 44109
Boston, MA 02109
Email: support@partnertax.ai