Privacy Policy — Version 3.6 (governs until December 7, 2026)

Version 3.6. Published October 27, 2026; effective December 1, 2026 (thirty (30) days’ notice under Section 17). Until then Version 3.4 (October 7, 2026) governs. This version replaces Version 3.5 (published October 23, 2026), which had not yet taken effect, and on the effective date replaces v3.4 in full, including its statements on deletion within 60 days of termination and on “anonymized” PostHog analytics. The descriptions of current practice in Sections 5.1, 5.6, 7.1 and 16 correct statements of fact and describe how the Services operate from publication. This version adds Sections 19–24, which cover the public tax-professional directory at taxscout.ai/cpa and the client requests sent through it, and makes related edits to Sections 1, 3, 7, 9, 11, 12, 13, 16 and 18.

1. Introduction

TaxScout.AI Inc. (“TaxScout.AI,” “we,” “us,” or “our”) is an AI-powered tax preparation platform designed for Certified Public Accountant (CPA) firms and their clients. This Privacy Policy describes how we collect, use, store, disclose, and protect personal information and tax return information when you use our services, including our website at www.taxscout.ai, our web-based platform, mobile applications, client portal, APIs, and any related services (collectively, the “Services”).

This Privacy Policy applies to all users of our Services, including CPA firm administrators, tax professionals (“Practitioners”), and taxpayer clients (“Clients” or “Taxpayers”) who interact with our platform through their CPA firm’s use of TaxScout.AI.

IMPORTANT: TaxScout.AI is a technology platform and service provider only. We are NOT a CPA firm, tax return preparer, enrolled agent, or tax advisor. We do not prepare, sign, or file tax returns. All tax preparation services and professional advice are provided solely by the CPA firm that has engaged you as a client.

TaxScout.AI processes sensitive tax return information subject to Internal Revenue Code (IRC) Section 7216 and Section 6713. We are committed to full compliance with all applicable federal, state, and international data protection laws.

This Privacy Policy also covers two groups who may never create an account: people who use our public directory of tax professionals at taxscout.ai/cpa and send a request through it (“visitors”), and the tax professionals and firms listed in that directory (“listed professionals”). Sections 19 through 24 are written for them. Where those sections differ from the rest of this policy, they control for directory and client-request information.

2. Definitions

“Tax Return Information” means any information furnished to or obtained by a tax return preparer in connection with the preparation of a tax return, as defined under IRC §7216 and Treasury Regulation §301.7216-1(b)(3).

“Personal Data” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual.

“Practitioner / CPA Firm” means a CPA, Enrolled Agent, tax preparer, or other authorized professional who uses TaxScout.AI to prepare or assist in preparing tax returns. The CPA Firm is the data controller for Client data.

“Client / Taxpayer” means an individual or entity whose tax return information is processed through the TaxScout.AI platform via their CPA firm.

“AI Processing” means the use of artificial intelligence, machine learning, natural language processing, and automated data extraction technologies to process, analyze, and organize tax-related documents and data. All AI outputs are preliminary drafts subject to mandatory human review.

“Customer” means the CPA firm or accounting practice that has entered into a subscription agreement with TaxScout.AI.

“AI Output” means any data extraction, form population, preparation note, anomaly flag, or other result generated by TaxScout.AI’s automated systems. AI Outputs may contain errors and require professional verification.

3. Information We Collect

3.1 Information Provided Directly by CPA Firms (Customers)

Firm registration information (firm name, EIN, PTIN, address, phone, email)

Practitioner account information (name, professional credentials, email, role)

Billing and payment information (processed via third-party payment processors)

Firm preferences, workflow configurations, and integration settings

Engagement letter templates and client intake configurations

3.2 Tax Return Information (Processed on Behalf of CPA Firms)

When CPA firms use our Services to prepare tax returns for their Clients, the following categories of tax return information may be processed through our AI systems:

Taxpayer identification information (names, Social Security Numbers, EINs, ITINs)
Financial information (income, wages, dividends, capital gains, deductions, credits)
Source documents (W-2s, 1099s, K-1s, receipts, bank statements, brokerage statements)
Tax organizer responses and preparation notes
Prior year tax return data for comparison and carry-forward purposes
Multi-state filing information

3.3 Information Collected Through the Client Portal

When Clients access the TaxScout.AI Client Portal at the invitation of their CPA firm:

Email address provided for portal access
Documents uploaded by the Client for tax preparation
Messages and communications with the CPA firm through the portal
Electronic signatures on engagement letters and consent forms
Portal activity (login times, document upload timestamps)
Mobile phone number (if provided for SMS notifications; see Section 4.4)
Your acceptance of the TaxScout.AI Customer Agreement, which incorporates our Terms of Service and this Privacy Policy: the version accepted, the date and time, a fingerprint of the exact text, your IP address and device information
Clients use the portal and upload links only after accepting the Customer Agreement on TaxScout.AI’s own screens; a new version must be accepted again before further use. After a CPA firm has cancelled its subscription, a Client may still download their own documents without accepting again. The CPA firm is responsible for ensuring appropriate client engagement agreements are in place.

3.4 Automatically Collected Information

Device information (browser type, operating system, device identifiers)

Log data (IP address, access times, pages viewed, referring URLs)

Usage analytics (features used, session duration, interaction patterns) — collected via PostHog and, on public pages, Google Analytics 4 (see Section 11)

Cookies and similar tracking technologies (see Section 11)

3.5 WISP Assessment Data

When users complete the TaxScout.AI WISP (Written Information Security Plan) assessment wizard, we collect the following categories of information:

Contact information (email address, name, firm name) provided during email capture
Firm security posture information (44 self-reported assessment questions covering: firm basics, security team, data inventory, hardware inventory, current security measures, employee policies, data retention practices, incident readiness, and state compliance)
Calculated security score and gap analysis derived from assessment responses
Generated WISP documents and certificates (for subscribers only)
E-signature records for WISP signing and employee acknowledgements (for subscribers only)
WISP assessment data does not include taxpayer PII (Social Security Numbers, tax return data, or financial information). The assessment collects information about the firm’s IT security practices and infrastructure only. All WISP assessment data is stored in encrypted databases within the United States.

3.6 Google Account, Gmail and Calendar Data

When a Practitioner connects a Google service, TaxScout.AI processes the account information and service data authorized for that connection. Gmail and Google Calendar are separate connections.

Gmail. TaxScout.AI uses inbox.dog as a service provider for the current hosted Gmail connection. inbox.dog handles Google authorization and provides mailbox access to TaxScout.AI. Both inbox.dog and TaxScout.AI process email data as needed to provide the connected-mailbox features. The permissions requested by that provider are shown during its Google consent flow.

Gmail data processed by TaxScout.AI includes account information; message metadata such as sender, recipients, subject, dates and message or thread identifiers; message bodies and attachments used in the email and document workflows; and outgoing email content when a Practitioner sends or replies through TaxScout.AI. Connection credentials and identifiers are used to maintain the authorized connection.

Google Calendar. TaxScout.AI connects directly to Google Calendar using its own OAuth client. The Calendar connection requests openid and userinfo.email to identify and display the connected account, and calendar.events to read and manage calendar events. This Calendar authorization flow does not request Gmail permissions.

Calendar data includes event identifiers, titles, start and end times, availability information, locations, meeting links and appointment details or attendees used by the scheduling features. TaxScout.AI reads event times to check availability and show upcoming meetings, creates events for appointments, updates them when appointments are rescheduled, and deletes the associated events when appointments are canceled. It can create Google Meet links and send native Google Calendar invitations when enabled by the Practitioner.

TaxScout.AI stores the Calendar connection tokens needed to maintain the authorized connection. These tokens are encrypted at rest. Practitioners can disconnect a service in TaxScout.AI or revoke its authorization through their Google Account. Data already imported into TaxScout.AI remains subject to the retention and deletion provisions of this policy.

3.7 Directory and Client-Request Information

Information about listed professionals comes from public sources, not from the professional, unless they claim their listing; see Section 19. Information a visitor types or uploads when asking for a report or for a tax professional is described in Section 20.

4. How We Use Information

4.1 Tax Return Preparation Services (Primary Purpose)

We use tax return information solely to provide our AI-powered tax preparation Services to CPA firms, including:

Automated extraction and classification of data from uploaded tax documents
AI-driven data entry into tax return forms and schedules
Generating reviewer-ready tax return drafts with AI preparation notes
Flagging anomalies, discrepancies, and potential issues for human review
Providing year-over-year comparisons and variance analysis
Supporting multi-state and complex return processing
All AI-generated outputs are preliminary drafts. The CPA firm’s Practitioner is solely responsible for reviewing, verifying, and approving all outputs before filing any tax return.

4.2 Service Improvement and Operations

Maintaining and improving the accuracy of our AI models and algorithms using only de-identified, aggregated data

Ensuring platform reliability, security, and performance

Providing customer support and technical assistance

Generating aggregated, de-identified analytics on platform usage

4.3 Legal and Compliance

Complying with applicable laws, regulations, and legal processes

Enforcing our Terms of Service and other agreements

Protecting against fraud, unauthorized access, and security threats

4.4 SMS/Text Message Communications

If you opt in to receive text message notifications from TaxScout.AI or your CPA firm through the TaxScout.AI platform, you consent to receive transactional SMS/text messages at the mobile phone number you provide. These messages may include:

Tax return status updates (e.g., return ready for review, return filed)
Document requests and missing information alerts
Payment reminders and invoice notifications
Engagement letter and e-signature requests
Appointment and deadline reminders
Message frequency varies based on your tax return activity and CPA firm communications. Message and data rates may apply. You may opt out of SMS communications at any time by replying STOP to any message. Reply HELP for assistance. Opting out of SMS does not affect your ability to use the Services or receive email communications. Carrier delivery is not guaranteed. SMS is not available in all areas.
Your mobile phone number is collected solely for the purpose of delivering these transactional messages and is not shared with third parties for marketing purposes, sold, or used for any purpose other than delivering the notifications described above, one-time sign-in codes for the Client Portal and, if your CPA firm enables it, automated replies to text messages you send. Phone numbers are kept with your client record under Section 9. When you opt out, we stop sending text messages and keep a record of the opt-out so that we do not text you again. For more information about how we handle your data, see Section 8 (Data Security) and Section 9 (Data Retention).

4.5 WISP Assessment and Compliance Services

We use WISP assessment data (described in Section 3.5) for the following purposes:

Calculating a security score and identifying gaps in the firm’s security posture based on a rule-based scoring engine
Generating a customized WISP document using AI (for subscribers only), tailored to the firm’s specific security measures and state compliance requirements
Sending assessment results via email to the email address provided during the assessment
Managing WISP document e-signatures, employee acknowledgements, and certificate generation for subscribers
Sending annual WISP review reminders and PTIN renewal-related notifications
Generating de-identified, aggregated statistics on security posture trends across tax professionals (no individual firm identifiable)
WISP assessment data is not used to train AI models. AI generation of WISP documents (for subscribers) uses the assessment responses as input context only and does not retain or learn from individual firm data.

4.6 Use of Google and Gmail Data

TaxScout.AI uses Google user data only to provide user-facing connected email features that are visible in the TaxScout.AI dashboard, including:

Connecting and authenticating a Practitioner’s Gmail or Google Workspace account
Displaying Gmail inboxes, email threads, messages, and attachments inside TaxScout.AI
Searching, organizing, and classifying emails for tax workflow purposes
Extracting tax-related attachments from emails and routing them into the CPA firm’s document workflow
Sending emails or replies from the connected Gmail account when initiated by an authorized Practitioner
Maintaining synchronization, audit logs, abuse prevention, security monitoring, and service reliability
TaxScout.AI does not use Google user data for advertising, retargeting, credit decisions, unrelated marketing, or sale to third parties. TaxScout.AI does not use Google user data to train, fine-tune, or improve generalized AI or machine learning models.

5. AI Data Processing, Accuracy, and Privacy by Design

TaxScout.AI is built with privacy at its core. Our AI systems are designed to protect taxpayer privacy throughout the document processing lifecycle.

5.1 Data Minimization and Security Controls

NOTICE: TaxScout.AI employs data minimization practices to protect sensitive information. Full Social Security Numbers and other taxpayer identification numbers are stored in an encrypted vault: each entry is encrypted under an application key and, when enabled for the firm, also under a per-firm AWS KMS key. Extracted data tables hold the last four digits of identifiers; for e-file, the full EIN or TIN of a form’s issuer (employer or payer) is also kept on that form’s record, encrypted under the application key. Uploaded documents, and the text read from them, are stored as uploaded, inside the encrypted storage described in Section 8. Full values are shown only to authorized users of the CPA firm, and are otherwise used only where a task needs the full number: identity verification for e-signature (Section 7.1), e-file and export data the firm prepares, and data exports the firm requests. Reveals and exports are recorded in an access log. Before a document is sent to an AI model, Social Security numbers, ITINs and EINs on PDFs whose every page has a text layer are blacked out except their last four digits; scanned documents, photographs and PDFs with scanned pages may be sent with the identifiers printed on them. Text that a Client types into portal chat, and the content of email and text messages, is sent to AI providers as written. The following security controls protect this data:

Data is transmitted between your browser and our services, and to AI providers, over TLS 1.2+ encrypted connections
AI processing is pinned to United States regions wherever the provider allows it
AI model providers are used, for the provider accounts TaxScout.AI holds, under enterprise or API terms that, as published by the provider, do not permit training on customer inputs
Access to processing systems is restricted to minimum necessary personnel

5.2 No Training on Client Data

CRITICAL COMMITMENT: TaxScout.AI does not use any individual taxpayer’s tax return information to train, fine-tune, or improve our general-purpose AI models. Your clients’ data is never used as training data for machine learning models that serve other customers. Any model improvement uses only de-identified, aggregated data that cannot be traced back to any individual taxpayer.

5.3 AI Output Accuracy Disclaimer

AI SERVICES & ACCURACY NOTICE: The Services utilize artificial intelligence and machine learning technologies (“AI Features”) to extract data from documents and generate preliminary tax return drafts, preparation notes, and suggestions. You acknowledge and agree that:

AI Features may produce inaccurate, incomplete, or erroneous results (“AI Errors”), including but not limited to incorrect data extraction, misclassification of income or deductions, mathematical errors, and incorrect form selection
AI-generated outputs are PRELIMINARY DRAFTS ONLY and are not final tax returns
All AI outputs require mandatory review, verification, and approval by a qualified tax professional (CPA, EA, or licensed preparer) before any reliance or filing
TaxScout.AI disclaims all liability for errors in tax returns, penalties, interest, or other consequences resulting from unverified AI output
The CPA firm and its Practitioners bear sole professional responsibility for the accuracy and completeness of all filed tax returns
Safe Harbor: TaxScout.AI employs commercially reasonable efforts to maximize AI accuracy, including multi-layer validation, confidence scoring, and automated anomaly detection. However, AI technology is inherently probabilistic and no AI system can guarantee 100% accuracy. TaxScout.AI’s liability is limited to ensuring commercially reasonable accuracy in its AI processing systems.

5.4 AI Processing Architecture

Our AI systems use a structured processing pipeline — documents are classified, segmented, and then processed by AI extraction models that output structured data validated against defined schemas. This approach provides auditability and traceability. Confidence scores are assigned to extracted data, and low-confidence results are automatically flagged for human review. Edge cases and ambiguous tax scenarios are escalated for Practitioner review.

5.5 Human-in-the-Loop Requirement

TaxScout.AI’s AI generates drafts and preparation notes, but all final review, judgment, and filing decisions must be made by qualified tax professionals. AI outputs are always subject to Practitioner review before any return is finalized or filed. No tax return is automatically filed without explicit human approval.

5.6 Third-Party AI Providers

TaxScout.AI utilizes third-party AI model providers for document OCR, data extraction, and natural language processing. The following safeguards are in place:

AI model providers are used, for the provider accounts TaxScout.AI holds, under enterprise or API terms that, as published by the provider, do not permit training on customer inputs
Processing is pinned to United States regions wherever the provider allows it
Full SSNs are held in the encrypted vault described in Section 5.1. Social Security numbers, ITINs and EINs on PDFs whose every page has a text layer are blacked out except their last four digits before a model call; a scanned document, photograph or PDF with scanned pages can reach the provider with an SSN printed on it, as can text typed into portal chat and the content of email and text messages

6. IRC Section 7216 Compliance

TaxScout.AI recognizes the critical importance of IRC §7216, which imposes criminal penalties on tax return preparers who knowingly or recklessly make unauthorized disclosures or uses of tax return information.

6.1 TaxScout.AI Is NOT a Tax Return Preparer

TAXSCOUT.AI IS NOT A REGISTERED TAX RETURN PREPARER, CPA FIRM, ENROLLED AGENT, OR TAX ADVISOR. TaxScout.AI provides software tools and AI-assisted technology services only. We do not prepare, review, sign, or file tax returns. We do not provide tax advice, legal advice, or accounting advice. The CPA firm that engages you as a client is your tax return preparer and bears all professional responsibilities associated with that role.

6.2 Our Role Under §7216

TaxScout.AI operates as an auxiliary service provider and technology platform that assists CPA firms (tax return preparers) in the preparation of tax returns. Under Treasury Regulation §301.7216-1(b)(2)(iii), our services qualify as auxiliary services provided in connection with tax return preparation.

Under Treasury Regulation §301.7216-2(d), disclosures to processors and auxiliary service providers for the purpose of tax return preparation generally do not require separate taxpayer consent, provided the information is used solely for return preparation purposes. TaxScout.AI’s processing of tax return information falls within this permissible use.

TaxScout.AI provides CPA firms with the following tools to ensure comprehensive compliance:

The default engagement letter template discloses TaxScout.AI as a third-party service provider; each CPA firm discloses this in its own words
Before a Client uses the Client Portal, TaxScout.AI obtains the Client’s acceptance of the TaxScout.AI Customer Agreement on its own screens and records the version accepted
TaxScout.AI provides tooling to record taxpayer consents under Treasury Regulation §301.7216-3 that a CPA firm obtains for a use or disclosure beyond return preparation; obtaining that consent, in the form Revenue Procedure 2013-14 requires, is the CPA firm’s responsibility
CPA firms are encouraged to obtain express §7216 consent from their clients where required under their specific circumstances, consistent with Revenue Procedure 2013-14

6.4 Data Use Restrictions

TaxScout.AI strictly adheres to the following §7216 restrictions:

We do not use tax return information for any purpose other than assisting in tax return preparation
We do not sell, rent, or lease taxpayer data to any third party
We do not use tax return information for marketing or solicitation of non-tax services
We do not disclose tax return information to any unauthorized third party
We do not share tax return information with advertising networks or data brokers; the analytics and error-monitoring tools described in Sections 7.1 and 11 are configured to mask on-screen text, other than interface labels, and form inputs
We do not use taxpayer data to train general-purpose AI models
We maintain audit trails of security-sensitive data access and processing activities

7.1 Categories of Recipients

We may share information with the following categories of recipients, solely as necessary to provide our Services:

CPA Firm Personnel: Tax return information is accessible only to authorized Practitioners within the subscribing CPA firm.
Cloud Infrastructure and Hosting Providers: We use Amazon Web Services (AWS) for application hosting, file storage and key management, and Supabase for database and authentication. Sub-Processors are engaged under written terms, which are either a data processing agreement or the provider’s standard enterprise, API or service terms, that require confidentiality and restrict use to providing the service. TaxScout.ai remains responsible for its Sub-Processors’ compliance with the obligations of the Data Processing Agreement, subject to Section 5.3 and the limitations in Section 12 of that agreement.
AI Model Providers: Data is transmitted to third-party AI models (Google Gemini through Google Cloud Vertex AI, models on AWS Bedrock, Anthropic Claude, OpenAI, and Groq for meeting transcription) for document processing under enterprise or API terms that, as published by the provider, do not permit training on customer inputs. See Section 5.6 for details on safeguards.
Background Job Processing: Inngest is used for asynchronous workflow orchestration (document processing, notifications) under written processing terms.
Payment Processors: Billing information is processed by PCI-compliant payment processors (Stripe). We do not store credit card numbers.
E-Signature Providers: Engagement letters and consent forms are processed through secure e-signature platforms (Documenso) with full audit trails.
Email Delivery: Transactional emails (OTP codes, notifications, invitations, directory reports and receipts) are sent via ZeptoMail (Zoho). Marketing emails, including directory outreach and visitor reminders, are sent via Resend. See Section 21 for directory and client-request email.
Identity Verification: When a CPA firm uses knowledge-based identity verification for e-signature, EVS (BlueAssure) receives the signer’s name, date of birth, address and SSN to verify identity.
SMS Delivery: Text messages are sent via AWS End User Messaging.
Logs and Support: BetterStack receives server logs; Chatwoot hosts support chat; Linear receives product feedback; Slack receives internal operational alerts.
Connected Services: When a CPA firm connects them, Google or Microsoft mailbox and calendar APIs, and Intuit (QuickBooks).
Security and Performance: Cloudflare provides CDN, DDoS protection, and bot mitigation. Sentry provides error monitoring. These services process access metadata and error traces.
Product Analytics: PostHog collects product analytics tied to the identity of the CPA user (user ID, email, name, role, organization ID and name), including session replays with text masked (see Section 11). This data is not anonymous. PostHog also records usage events and masked session replays on the Client Portal and public pages, linked to a browser identifier rather than to the Client’s name.
Professional Advisors: Our legal counsel, auditors, and compliance consultants, bound by confidentiality obligations.

Advertising networks or ad technology companies

Data brokers or information resellers

Any tax professional or firm, before a visitor has asked us to share their request (Section 20.3)

Social media platforms

Any entity for purposes unrelated to tax return preparation

Any public or general-purpose AI chatbot (ChatGPT, Gemini, etc.) in their consumer-facing forms

7.3 Google API Services User Data and Limited Use

TaxScout.AI’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell, rent, or transfer Google user data to advertising platforms, data brokers, information resellers, or social media platforms. We do not use Google user data for serving ads, retargeting, personalized advertising, or determining creditworthiness.

We transfer Google user data only as necessary to provide or improve the user-facing connected email features described in this Privacy Policy, to maintain security, to comply with applicable law, or with the user’s explicit consent. For example, Gmail attachments that a Practitioner routes into the tax document workflow may be processed by our secure infrastructure and approved service providers solely for tax document extraction, classification, storage, and workflow automation.

Human access to Google user data is restricted to authorized personnel and only when necessary to provide support requested by the Customer, investigate security or abuse issues, comply with law, or maintain the Services.

7.4 Legal Disclosures

We may disclose information when required by law, regulation, subpoena, court order, or governmental request, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

7.5 Subpoena and Legal Hold Procedure

Upon receipt of a valid legal process requiring disclosure of Customer data, TaxScout.AI will: (a) promptly notify Customer unless legally prohibited from doing so; (b) limit disclosure to the minimum information required by the legal process; and (c) cooperate with Customer’s efforts to obtain a protective order or other appropriate remedy.

8. Data Security

8.1 Infrastructure Security

All data is hosted on Amazon Web Services (AWS) and Supabase within the United States

Data is encrypted in transit between your browser and our services using TLS 1.2+

All data is encrypted at rest using AES-256 server-side encryption

Role-based access controls (RBAC) with row-level security, designed to give least-privilege access and to keep each firm’s data separate

Multi-factor authentication (MFA) available for all administrative and practitioner access

Automated vulnerability scanning via CI/CD pipeline (Snyk, OWASP ZAP, dependency audits)

TaxScout.AI uses IRS Publication 4557 (Safeguarding Taxpayer Data) as a reference framework for its security controls.

8.2 Application Security

Secure development lifecycle (SDLC) practices with automated linting, security scanning, and CI/CD pipelines

DDoS mitigation and bot protection via Cloudflare

Audit logging of security-sensitive data access events, including document downloads, exports, and PII operations

HSTS enforcement with preload for all client-facing interfaces

CSRF protection for all state-changing API endpoints

8.3 Organizational Security

Access to production systems is limited to personnel TaxScout.AI authorizes, who must keep Client data confidential

Documented incident response and disaster recovery runbooks covering roles, escalation, containment and investigation; CPA firms are notified of a breach as described in Section 15

8.4 GLBA and the FTC Safeguards Rule

Tax return preparers may be considered “financial institutions” under the Gramm-Leach-Bliley Act (GLBA) and the FTC Safeguards Rule (16 CFR Part 314), and TaxScout.AI acts as a service provider to them. The technical safeguards described in this Section 8 are in place; the organizational controls are being formalized in a written information security program aligned with the Safeguards Rule. TaxScout.AI has not completed an independent security examination or certification, such as a SOC 2 report.

9. Data Retention and Deletion

During the subscription, the retention periods in Section 9.1 apply. After termination, Section 9.2 applies: data is kept until the CPA firm requests its deletion; it is not deleted automatically. On request it is deleted as described in Section 9.2, except records the law requires us to keep.

9.1 Retention Periods

Tax Return Information: Retained for the duration of the CPA firm’s subscription, unless the firm deletes it sooner.

Engagement Letters & Signatures: Retained with their audit trail (signer identity, IP address, timestamp, device information) for at least the period the law requires the firm to keep them, and not deleted while a retention lock applies.

Account Information: Retained for the duration of the account.

Usage and Log Data: Retained for up to two (2) years, except the security access log (the record of who accessed Client data), which is kept as an audit record.

Billing Records: Retained for seven (7) years for tax and audit compliance.

WISP Assessment Data: Assessment responses and security scores are retained for the duration of the account. For free (non-subscriber) assessments, data is retained for three (3) years from the date of the assessment or until deletion is requested. Generated WISP documents and certificates are retained for the duration of the subscription. WISP version history is retained alongside the current document.

Client Requests (directory): Kept for twenty-four (24) months after the last activity on the request, then automatically deleted or stripped of anything that identifies the visitor (Section 20.6).

Documents Uploaded by a Visitor for a Report, and the text extracted from them: Automatically deleted one hundred eighty (180) days after the last activity on the request, or sooner on request (Section 20.6).

Directory Listings: Kept while the public record shows the practice and the listing has not been removed. Removal and correction records: at least four (4) years.

Consent Records for sharing a request, for claim-code texts and for deletion requests: Four (4) years.

9.2 Deletion and Data Portability

After account termination, TaxScout.AI retains the CPA firm’s data for reactivation and legal-hold purposes until the firm requests its deletion. On the CPA firm’s written request:

Tax return information will be exported (if requested) and securely deleted within sixty (60) days
Backup copies expire on the backup retention cycle after deletion
Excluded are write-once deliverables kept under a retention lock, records under legal hold, and records the law requires us to keep, such as signed e-file authorizations for the ERO retention period and the record of agreement acceptances; operational logs and the security access log, which is kept as an audit record; and copies a Sub-Processor keeps in its own logs, caches or backups under its retention terms
For data encrypted under the firm’s per-firm AWS KMS key, deletion also includes destruction of that key (cryptographic erasure); data held under other encryption, including the application-key copy of each vault entry, is deleted, not crypto-shredded
Written confirmation of data deletion provided upon request

9.3 Google Account Disconnection, Revocation, and Deletion

Practitioners may disconnect a Gmail or Google Workspace account from TaxScout.AI at any time through the TaxScout.AI dashboard. When an account is disconnected, TaxScout.AI deletes the stored OAuth tokens for that account and stops accessing new Gmail data.

Users may also revoke TaxScout.AI’s access through their Google Account permissions page at https://myaccount.google.com/permissions.

Upon written request by the CPA firm, TaxScout.AI will delete cached Gmail message data and related metadata, subject to legal, tax, security, backup, and contractual retention requirements described in this Privacy Policy. Tax documents or attachments imported from Gmail into a client tax workflow become Tax Return Information and are retained or deleted according to the Tax Return Information retention rules in Section 9.1.

10. CPA Firm Responsibilities

As the data controller for their Clients’ tax return information, the CPA firm agrees to:

Execute an appropriate engagement letter with each Client before uploading their data to TaxScout.AI that discloses, in the firm’s own words, its use of TaxScout.AI as a third-party service provider (TaxScout.AI separately obtains the Client’s acceptance of the TaxScout.AI Customer Agreement)
Obtain any additional §7216 consents required under the CPA firm’s specific circumstances
Review and verify all AI-generated outputs before filing any tax return
Maintain appropriate professional liability (E&O) insurance
Comply with all applicable professional standards (AICPA, state boards)
Notify TaxScout.AI promptly of any suspected data breach or unauthorized access
Ensure that only authorized personnel within the firm access Client data
Maintain the confidentiality of all account credentials and access tokens
Implement reasonable security practices within the CPA firm’s own systems and networks
The CPA firm shall indemnify, defend, and hold harmless TaxScout.AI from and against any claims, losses, damages, liabilities, and expenses (including reasonable attorneys’ fees) arising from or related to: (a) the CPA firm’s unauthorized or unlawful processing of Personal Data; (b) any claim by a data subject or regulatory authority resulting from the CPA firm’s failure to obtain required consents or authorizations; or (c) the CPA firm’s failure to review and verify AI-generated outputs before filing.

11. Cookies and Tracking Technologies

Essential Cookies: Required for platform functionality, authentication, session management, security (CSRF tokens), and Cloudflare verification. Cannot be disabled.

Analytics (PostHog): We use PostHog for product analytics and session replay. Events are linked to the identity of the signed-in CPA user: we send the user ID, email address, name, role, and the organization's ID and name, so this data is not anonymous. On the Client Portal and public pages, events and replays are linked to a browser identifier, not to the Client’s name. Pages opened through a link that itself grants access are not replayed; when such a page is reached by navigating inside the app, only activity events carrying its address with the access token removed are reported. Session replays mask form inputs and all on-screen text except interface labels (navigation, buttons, tabs, form labels, table headers), in which digits are still masked, so that tax return information and Client PII are not intentionally captured. PostHog data is used solely to improve and support the platform and is not shared with third parties for advertising. Server-side product events identify records by internal identifiers and may include the CPA firm’s name; they do not carry Client names.

Analytics (Google Analytics 4): Public, WISP, marketplace and firm landing pages use Google Analytics 4, which receives page addresses including query strings, and device and usage data. It is not used in the CPA dashboard or the Client Portal. Google processes this data under its analytics terms.

The directory at taxscout.ai/cpa and the request form at taxscout.ai/quote are public pages for this purpose. Cloudflare Turnstile runs on the request and removal forms to block bots; it sets a verification cookie and sees your IP address.

Preference Cookies: Store user preferences (theme, layout). Can be disabled.

We do NOT use advertising cookies, tracking pixels, or third-party cookies for behavioral advertising.

12. Your Rights and Choices

12.1 Rights for All Users

Access: Request a copy of personal data we hold about you

Correction: Request correction of inaccurate or incomplete data

Deletion: Request deletion, subject to legal retention requirements

Data Portability: Request data in a structured, machine-readable format

Opt-out: Opt out of non-essential communications

SMS Opt-out: Reply STOP to any text message to immediately stop receiving SMS notifications. You may also contact us at privacy@taxscout.ai to opt out.

Google Account Revocation: Disconnect a connected Gmail or Google Workspace account from TaxScout.AI and/or revoke TaxScout.AI’s access through your Google Account permissions page.

12.2 CPA Firm Rights (Data Controllers)

Direct TaxScout.AI to delete all Client data upon request

Receive the compliance documentation described in Section 9 of the Data Processing Agreement

Receive thirty (30) days’ notice of a new Sub-Processor and object to it, as described in Section 5.2 of the Data Processing Agreement

Terminate data processing at any time with data return or deletion

12.3 California Residents (CCPA/CPRA)

Right to know what personal information is collected and used

Right to delete personal information

Right to opt out of sale/sharing (Note: TaxScout.AI does not sell personal information)

Right to non-discrimination

Right to correct inaccurate personal information

We do not sell or share personal information as California law defines those terms, so this policy has no “Do Not Sell or Share My Personal Information” link. If that changes we will add one and honor Global Privacy Control signals. Directory listings are drawn from publicly available government records and public business listings, which California law excludes from “personal information”; we honor removal requests for them anyway (Section 19.6).

12.4 State Privacy Rights

Residents of states with comprehensive privacy laws — including California (CCPA/CPRA), New Jersey (NJDPA), Delaware (DPDPA), Colorado (CPA), Connecticut (CTDPA), Virginia (VCDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), and other states that have enacted consumer privacy legislation — have rights similar to those described in Section 12.3, which may include:

Right to access, correct, and delete personal data
Right to data portability
Right to opt out of targeted advertising (Note: TaxScout.AI does not engage in targeted advertising)
Right to opt out of sale of personal data (Note: TaxScout.AI does not sell personal data)
Right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects
Right to appeal a denial of a privacy rights request
To exercise any of these rights, contact us at privacy@taxscout.ai. We will respond within the timeframe required by your state’s applicable law (typically 30–45 days). We do not discriminate against users who exercise their privacy rights.

Massachusetts has not enacted a comprehensive consumer privacy law; Massachusetts residents are protected by G.L. c. 93A and 201 CMR 17.00, with which we comply. Directory visitors and listed professionals: see Section 22.

EU/EEA residents have additional rights under GDPR, including the right to lodge a complaint with a supervisory authority.

12.6 Exercising Your Rights

13. Children’s Privacy

Our Services, including the public directory and the client-request form, are designed for tax professionals and adult taxpayers and are not directed at individuals under 16. We do not knowingly collect personal information from children.

14. International Data Transfers

TaxScout.AI stores and processes data primarily within the United States. Tax return information is stored in the United States and processed in the United States wherever the provider allows region pinning. We do not intentionally transfer SSNs or taxpayer identification numbers outside the United States. Certain infrastructure providers (such as Cloudflare) may process access metadata at global edge nodes for performance and security purposes.

15. Data Breach Notification

Affected CPA firms notified within seventy-two (72) hours of confirming a breach, to the extent TaxScout.AI has sufficient information to provide meaningful notification

Detailed information about breach nature and scope

Regulatory authorities notified as required by law

Cooperation with CPA firms in notifying affected Taxpayers

Immediate containment, investigation, and remediation

Post-incident report with root cause analysis

16. Sub-Processors

Sub-Processors are engaged under written terms, which are either a data processing agreement or the provider’s standard enterprise, API or service terms, that require confidentiality and restrict use to providing the service. TaxScout.ai remains responsible for its Sub-Processors’ compliance with the obligations of the Data Processing Agreement, subject to Section 5.3 and the limitations in Section 12 of that agreement.

Sub-Processor	Purpose	Data Processed	Location
Amazon Web Services (AWS)	Application hosting (EC2), file storage (S3), key management (KMS)	Documents, PDFs and all platform data (encrypted at rest)	US (us-east-1)
AWS Bedrock	AI models	Tax document content, contextual tax data; a document a directory visitor uploads for a report	United States (cross-region inference profiles)
AWS End User Messaging	SMS delivery	Phone numbers, message content	United States
Supabase	Database, authentication	All structured platform data	United States
Google Cloud (Gemini)	Document OCR, AI extraction	Tax document content; a document a directory visitor uploads for a report	United States
Google Cloud Storage	Meeting audio staging for transcription	Meeting audio recordings	United States
Anthropic (Claude)	AI-assisted chat, reasoning	Contextual tax data summaries; a document a directory visitor uploads for a report	United States
OpenAI	AI-assisted chat, reasoning	Contextual tax data summaries; a document a directory visitor uploads for a report	United States
Groq	Meeting transcription (primary in production)	Meeting audio	United States
Inngest	Background job orchestration	Document and entity metadata	United States
Stripe	Payment processing	Billing information only	United States
ZeptoMail (Zoho)	Transactional email delivery	Email addresses, notification content	United States
Resend	Marketing and landing-page email	Email addresses, message content	United States
Documenso	E-signatures	Engagement letters, signatures	United States
EVS (BlueAssure)	Identity verification for e-signature	Name, date of birth, address, SSN	United States
Cloudflare	Security, CDN, bot protection; Turnstile bot check on directory forms; Worker serving taxscout.ai/cpa	Access metadata, IP addresses	Global (edge)
BetterStack	Server logs	Server log events, request metadata	United States
Sentry	Error monitoring, session replay (text masked)	Error traces, request metadata, masked replays	United States
PostHog	Product analytics, session replay (text masked)	CPA user identity (user ID, email, name, role, organization ID and name) and product usage events (not anonymous); portal and public-page usage linked to a browser identifier	United States
Chatwoot	Support chat	Support conversations, contact details	United States
Linear	Product feedback tracking	Feedback text submitted by users	United States
Slack	Internal operational alerts	Alert content, record identifiers	United States
Google / Microsoft (when the firm connects them)	Mailbox and calendar integration	Email messages and calendar events of connected accounts	United States
Intuit (when the firm connects QuickBooks)	Accounting integration	Accounting data of connected companies	United States
Google Analytics 4	Website analytics on public and marketplace pages	Page URLs including query strings, device and usage data	United States
inbox.dog	OAuth broker for connected Gmail accounts (active)	OAuth tokens for connected Gmail accounts	United States
Dropbox (when the firm connects it)	Cloud document import	Files the firm chooses to import	United States
Microsoft OneDrive (when the firm connects it)	Cloud document import	Files the firm chooses to import	United States
GrowSurf	Firm referral programme	Name, email address	United States
Tavily	Web-search fallback for approved queries	Search query text	United States

17. Changes to This Privacy Policy

We will notify CPA firms of material changes at least thirty (30) days in advance via email and/or platform notice. Continued use after the effective date constitutes acceptance.

18. Contact Information

TaxScout.AI Inc.

160 Alewife Brook Pkwy, Cambridge, MA 02138

Attn: Privacy Officer

Email: privacy@taxscout.ai

Directory listings, removals and client requests: support@taxscout.ai

Website: www.taxscout.ai/privacy

19. Professional Directory (taxscout.ai/cpa)

19.1 What the directory is. taxscout.ai/cpa is a free public directory of tax preparers and firms. Anyone can read it. A firm can claim its listing for free. Being listed means a practice appears in the public records described below; it is not a rating, an endorsement or a recommendation by TaxScout. We do not vet listed firms. Confirm a preparer’s credentials yourself before hiring them.

19.2 Where listing information comes from. Every listing starts from a public record. We use three sources:

The IRS public list of return preparers. The IRS publishes, under the Freedom of Information Act, the name, business name, business mailing address, business phone, business website and professional credential (CPA, enrolled agent, attorney, or Annual Filing Season Program participant) of every holder of a Preparer Tax Identification Number (PTIN). The IRS updates this file about twice a year. We leave out attorney-only records and national chains. We show the credential exactly as the IRS file states it and never infer one.
Google Maps business listings. We match each practice to its Google Maps listing to show the phone number, address, opening hours, overall rating and number of reviews. We do not copy or display the text of Google reviews. A practice found only on Google Maps, with no matching IRS record, is shown without an IRS credential.
The firm’s own website. Where a firm has a website, we read its home page and up to three obvious pages (about, contact, services), respecting robots.txt, and keep only what the firm says about itself: the services it names, the languages it advertises, a contact email address and how long it has been in business. We do not write bios or taglines for firms and we do not add information from any other source.

19.3 What a listing shows. Firm name, address, phone, website, credential, services, languages, hours, Google rating and review count, and the date of the IRS file the listing is based on. A person’s name appears when the practice is named after that person or when the IRS record names them as the preparer at that practice. We do not show home addresses, personal mobile numbers, personal email addresses, Social Security numbers or PTINs.

19.4 How often it changes. Every week we check for a new IRS file and, when there is one, add new practices and update unclaimed listings. Every month we re-check a batch of listings against Google Maps for rating, review count, phone, website and whether the business is still open; a business shown as permanently closed is taken off the directory. Listings a firm has claimed are never overwritten by these updates.

19.5 Claiming or correcting your listing. Open your firm’s page and choose “Claim this listing”. Claiming is free, lets you correct your details and choose what is shown, and is confirmed by a code sent to an email address at your firm’s domain or by text to the business phone already on the listing (Section 21.3). If you only want something fixed and do not want an account, use the correction form at taxscout.ai/cpa/report.

19.6 Removing your name or your listing. Anyone can ask us to remove their name from a listing, or to take a whole listing off the directory, with no account needed, at taxscout.ai/cpa/report (also linked as “Remove my information” at the bottom of every directory page). We act on every request within 2 business days and confirm by email to the address you give us. We keep a short record of the request (date, the email it came from, what was removed) so that the next IRS or Google update does not put the listing or your name back, and so we can show what we did if asked. We do not need you to prove who you are to remove a name or an unclaimed listing. Removing a listing from TaxScout does not change the IRS public file or your Google listing; to change those, contact the IRS (Form W-12 or your PTIN account) or Google.

19.7 What we do with listing information. We publish it in the directory, use it to match a visitor’s request to firms in their area (Section 20), and use the business email address and business phone to tell a firm about its listing, a client request or TaxScout’s services (Section 21). We do not sell listing information, license it, export it to third parties, use it for advertising, or combine it with purchased data.

19.8 Questions. support@taxscout.ai. More detail, kept current with our pipeline, is at taxscout.ai/cpa/about-the-data.

20. Client Requests

20.1 What you give us. When you use the “get a report” or “connect me with a professional” form on taxscout.ai (taxscout.ai/quote and the forms on directory pages), we collect what you type and upload:

the kind of help you need (a letter from the IRS or a state, a prepared return to check, or getting your taxes done), your state, the tax year, and, if you ask for a professional, a short description of your situation;
your email address; your name if you give it; your phone number if you give it;
one document, if you choose to upload one: the letter you received, a prepared return, or last year’s return;
the directory page you came from, if any, and the usual technical data in Section 3.4.

We ask you not to type Social Security numbers into the form. A document you upload may contain one; see 20.3.

20.2 The report. If you upload a document we read it with the AI providers listed in Section 7.1, under the same safeguards as Section 5, and email you a report: what the document says, what to gather and what to ask a professional. The report is information, not tax advice; TaxScout is not a tax preparer (Section 6.1). Your document and report are available to you through a link we email you; the upload link works for 24 hours and a report link for 7 days, after which you can ask for a fresh one by email.

20.3 Sharing your request with tax professionals — only when you ask. We send your request to tax professionals only after you tick the consent box (“Share my request with up to 3 tax professionals near me who use TaxScout, so they can contact me”) or press “have a professional contact me” on your report. Nothing is sent at the moment you submit the form. When you do ask:

We send your request to up to 3 tax professionals who have claimed their TaxScout listing, are accepting new clients, and are in your city, or, if none, the nearest in your state.
A professional who receives your request sees your name, email address and phone number (if given), your city and state, the tax year, the kind of help you need, your description, and, for a report, the summary facts from it: the agency and type of notice, the response date printed on it, your quiz answers (such as filing status and income types), an estimated price range and the number of findings.
Your uploaded document and your report are never sent to a firm. Only you can open them.
Firms that have not claimed their listing may receive a notice that “a taxpayer in [town] needs help with [kind of help]”. That notice never contains your name, contact details or documents.
The professional contacts you directly. Any work they do for you is between you and them; TaxScout is not a party to it and does not see what you share with them afterwards.

20.4 What else we do with your request. We use it to produce your report, to match firms, to email you about your request (Section 21.1), to answer your questions, to prevent spam and abuse (a Cloudflare bot check runs on the form), to keep the records the law requires, and to measure how the directory is used in aggregate.

20.5 We do not sell your information. We do not sell, rent or license client-request information to anyone. We do not share it with advertisers or data brokers. Firms do not buy your information: a firm that receives your request pays TaxScout for its own TaxScout plan, not per person, and only after you have asked us to share your request.

20.6 How long we keep it. We keep a client request for 24 months after the last activity on it (your last visit to the report, an email from you, a professional’s reply, a document you upload), then automatically strip it of anything that identifies you: your name, email address, phone number, city and ZIP code, your answers and your report summary. What remains is the state, the month of the request, how you found us and the price estimate, which we use for statistics. A request has no “closed” state we can rely on, so an uploaded document, and the text we extracted from it, are automatically deleted 180 days after the last activity on the request, unless you ask us to delete them sooner. Records of your consent to share, and of a removal or deletion request, are kept for 4 years as evidence of what you asked us to do; they do not include the document. Email delivery logs follow Section 9.1.

20.7 Deleting your request. Press “Delete my data” in your report or email support@taxscout.ai from the address you used. We confirm the request by email right away, remove the request, your document and report, and tell you when it is done. If we have already sent your request to a professional at your instruction, we tell that professional you withdrew it; what they keep is governed by their own practice.

21. Email and Text Messages

21.1 Email to visitors. When you send a request we email you about it: the report, a “we received your request” note, a fresh report link when you ask for one, and a confirmation if you ask us to delete your data. These are service emails and are sent as long as your request is open. Separately, we may send marketing email: a reminder a few days later if you did not finish, a seasonal note during tax season, and, after a professional has helped you, an invitation to review them on TaxScout. Every marketing email has an unsubscribe link that works with one click and is honored immediately for all TaxScout marketing email; you can also reply “unsubscribe” or email support@taxscout.ai. Unsubscribing from marketing does not stop the service emails about an open request.

21.2 Email to listed professionals. We may email a firm at the business address on its listing or its website:

about its listing: that a visitor nearby asked for a tax professional, that its page has been viewed, that another firm claimed its page, or that its information may need correcting, with an invitation to claim the listing. These are advertising for TaxScout and follow the CAN-SPAM Act: they say who they are from, carry our postal address and a working unsubscribe link, and we honor an unsubscribe within 10 business days (in practice immediately). They may be sent from taxscout.ai, taxscout.pro or taxscout.help; all three belong to TaxScout.AI Inc., and one unsubscribe or reply asking us to stop applies to all of them and to any follow-up. We send at most one introduction and one follow-up per firm.
about a claim or an account: the claim code, “we received your claim”, “your profile is live”, monthly profile statistics for claimed firms, and requests from visitors who asked to be contacted. These are service messages. A firm can turn off request alerts and statistics in its settings or by the link in the email.

We do not send email to addresses collected from a website that says its addresses may not be used for this purpose, and we remove an address from every list on request.

21.3 Text messages. We send texts in only two cases:

A claim code. When a firm asks to claim its listing and chooses “text me the code”, we send one code to the business phone number already on the listing, never to a number typed into the form. We record the date, the number, the channel and the page the request came from. The text contains the code and nothing else.
Request alerts to claimed firms. A firm that has claimed its listing can turn on text alerts for new client requests in its account settings. These go only to the number the firm entered and only while the setting is on.

We do not text visitors from the directory and we do not send marketing by text. Reply STOP to any message to stop texts to that number and HELP for help. Message and data rates may apply; delivery depends on your carrier. Texts are sent through AWS End User Messaging (Section 24).

22. Your Choices and Rights — Directory and Client Requests

22.1 Everyone. Whether or not your state’s privacy law applies, you can ask us to:

tell you what information we hold about you and where it came from;
correct it;
delete it, or in the case of a directory listing, remove your name or the listing (Section 19.6);
stop marketing email or text messages (Section 21);
send you a copy of the information you gave us, in a common file format.

22.2 If you are a listed professional. Use taxscout.ai/cpa/report to fix, remove or de-name a listing (done within 2 business days, confirmed by email), or claim the listing to control it yourself. To stop our emails, use the unsubscribe link in any of them or reply asking us to stop.

22.3 If you sent a client request. Press “Delete my data” in your report or email support@taxscout.ai from the address you used. To stop follow-up email, use the unsubscribe link.

22.4 State privacy rights. Residents of California (CCPA/CPRA), New Jersey (New Jersey Data Privacy Act), Delaware, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws may have the rights to access, correct, delete and obtain a copy of their personal data, to opt out of its sale, of targeted advertising and of certain profiling, and to appeal if we refuse a request. Many of these laws do not apply to information that is publicly available from government records, such as the IRS preparer list, or to businesses below certain size thresholds, which TaxScout is below today. We honor the requests in 22.1 for everyone regardless. We do not sell or share personal information as those terms are defined in state privacy laws, we do not use it for targeted advertising, and we do not profile anyone for decisions with legal or similar effects, so there is no “Do Not Sell or Share My Personal Information” link; if that ever changes we will add one and honor Global Privacy Control signals. Massachusetts has no comprehensive consumer privacy law today; our practices there are governed by the Massachusetts consumer protection law (G.L. c. 93A) and data security regulation (201 CMR 17.00), with which we comply.

22.5 How we handle a request. Email support@taxscout.ai (or privacy@taxscout.ai). We respond within 30 days, or sooner where this policy promises it (2 business days for a listing removal). We may ask you to confirm the request from the email address on file; we will not ask for more than we need to find your record. We do not charge for a request and we do not treat you differently for making one. If we decline a request we tell you why and how to appeal to us; you may also complain to your state Attorney General.

22.6 Contact. support@taxscout.ai for directory listings, removals and client requests. privacy@taxscout.ai for everything else in this policy. Post: TaxScout.AI Inc., 160 Alewife Brook Pkwy, Cambridge, MA 02138, Attn: Privacy Officer.

23. Not a Consumer Reporting Agency

TaxScout is not a consumer reporting agency under the Fair Credit Reporting Act (FCRA), and nothing on taxscout.ai is a consumer report. The directory, listing information, Google ratings and any rating, score or ranking shown on TaxScout exist so that a person can find a tax professional to hire. They may not be used, in whole or in part, to decide anyone’s eligibility for credit, insurance, employment, housing, a government license or benefit, or for any other purpose covered by the FCRA. We do not sell or supply directory information to employers, background-check companies or tenant screeners, and we do not describe any professional as “verified”, “vetted” or “trusted” unless this policy or the page says exactly what was checked.

24. Service Providers for the Directory and Client Requests

Section 16 lists every company that processes data for the TaxScout platform. The ones that handle directory listings and client requests are below, each engaged under terms that require confidentiality and restrict use to providing the service.

Provider	What it does for the directory and client requests	Data it handles
Amazon Web Services (AWS)	Hosts the directory and the application that processes requests; stores uploaded documents; sends text messages (AWS End User Messaging)	All directory and request data, encrypted at rest; phone numbers and the text of claim codes and alerts
Supabase	Database for listings, claims and client requests	Listing records, claim records, client requests
Cloudflare	Serves taxscout.ai, protects it from attacks and bots, runs the bot check (Turnstile) on the request and removal forms	IP addresses, request metadata
ZeptoMail (Zoho)	Sends service email: reports, receipts, claim codes, removal confirmations	Email addresses, message content
Resend	Sends marketing email: visitor reminders, listing outreach, review invitations, each with an unsubscribe link	Email addresses, message content, unsubscribe status
AI model providers listed in Section 7.1	Read a document a visitor uploads to produce the report	The document’s content, under the Section 5 safeguards
Google Analytics 4	Measures use of directory pages	Page addresses including query strings, device and usage data; no names
PostHog	Product analytics and masked session replay on directory pages	Usage events tied to a browser identifier, not a name; form inputs and on-screen text masked
Sentry	Error monitoring for the application that processes requests	Error traces, request metadata
Stripe	Payments by firms for TaxScout plans; visitors never pay and never give Stripe anything	Firm billing details
Slack, Linear	Internal handling of removal, correction and claim requests	The request as submitted, including the email address you gave

We do not use Twilio or any other text-message provider for the directory. We do not share directory or request data with advertising networks, data brokers or social media platforms.