Privacy Policy

Tax Alpha Solutions LLC ("Tax Alpha," "we," "us," or "our") operates a tax planning platform built for licensed tax professionals — CPAs, Enrolled Agents, and tax-focused financial advisors. Our service is not a consumer product and is not intended for individual taxpayers.

This Privacy Policy covers two distinct categories of information:

Website and marketing data — information you provide when requesting a demo, signing up for communications, or browsing taxalpha.us.

Platform data — client tax information that beta program subscribers upload and process through the Tax Alpha service. The full contractual terms governing platform data are set out in the Data Processing Agreement (DPA), available upon request by emailing support@taxalpha.us. This Policy provides a plain-language summary of those practices; the DPA controls in the event of any conflict.

What we collect

When you request a demo or contact us through our website, we collect:

• Name, business email address, phone number (if provided), firm name, and professional role
• Any message or notes you include with your inquiry
• Technical information: IP address, browser type, device type, pages visited, and referral source

We do not collect Social Security numbers, taxpayer identification numbers, financial account details, or client tax data through our website forms.

How we use it

• Scheduling and conducting your product demonstration
• Sending follow-up information about Tax Alpha's features and pricing
• Communicating updates relevant to tax professionals (new features, regulatory changes, and similar content)
• Analyzing aggregate website usage to improve our site
• Complying with applicable law

How long we keep it

If you become a customer, your contact information is retained for the duration of the relationship and for a reasonable period after. If you do not become a customer, we retain your information for up to three years from your initial inquiry unless you request deletion sooner.

What beta subscribers upload

Beta subscribers upload client tax returns (Form 1040, Form 1120-S, and related documents) and may add planning notes, goals, and other advisor inputs. This data includes tax return information as defined under Treasury Regulation section 301.7216-1(b)(3), as well as identifiers such as Social Security numbers, EINs, addresses, and financial account numbers that appear on tax documents.

How we process it

• Uploaded PDFs are validated and stored under randomized filenames. After text extraction is complete, the original unredacted PDF is deleted. The copy retained for in-app preview is visually redacted, with identifiers masked.
• Before any text is sent to an AI model, an automated redaction step removes Social Security numbers, EINs, email addresses, phone numbers, bank account and routing numbers, dates of birth, and similar identifiers. Redaction is automated and best-effort; an identifier in an unusual format may occasionally not be caught. Any data that reaches the AI layer remains protected by the commitments described below.
• Tax calculations — projected savings, liability, scenario modeling — are performed by a deterministic software engine built from IRS worksheets, not by AI. Numbers are reproducible and auditable.
• AI-assisted analysis (strategy suggestions, document Q&A, IRS guidance lookup) is performed via AWS Bedrock. Under AWS Bedrock's terms, inputs are not retained beyond transient processing and are not used for model training. We do not use client data to train or fine-tune any model.
• Extracted tax data is stored only in redacted, field-level encrypted form. Each firm's data is isolated; no data route in the application crosses firm boundaries.

Purposes for which we process platform data

We process client data only to provide, maintain, secure, and support the service; to diagnose errors and improve extraction and calculation accuracy (using redacted or de-identified data wherever practicable); and as required by law. We do not sell client data, use it for advertising, or disclose it to any third party other than the subprocessors listed in Section 5.

Retention

Subscribers can delete clients, returns, and individual records through the service at any time. On termination of a Beta Program Agreement, we delete all customer data within 60 days. Written confirmation of deletion is available on request.

Section 7216 and professional responsibility

Tax Alpha processes client data as a service provider to the subscribing firm. The firm is responsible for determining whether written client consents are required under Internal Revenue Code section 7216 and Treasury Regulation sections 301.7216-1 through -3 before uploading a client's tax return information, and for obtaining those consents in the form the law requires. The firm retains sole professional responsibility for all advice it provides to its clients.

All processing and storage is in the United States. Tax Alpha uses three infrastructure providers, each operating under confidentiality and data protection obligations:

No other third party receives client tax data. We provide at least 15 days' notice before adding or replacing a subprocessor that processes client data.

For website and marketing operations, we also use service providers for CRM, email delivery, scheduling, and analytics. These vendors are contractually limited to using your information only as directed by Tax Alpha.

Tax Alpha maintains administrative, technical, and physical safeguards appropriate to the sensitivity of tax return information, including:

• TLS encryption for all data in transit between users, the service, and subprocessors
• Database-level encryption at rest, plus additional field-level encryption (AES-128-CBC with HMAC) for extracted tax data, notes, and client identifiers
• Per-firm data isolation enforced at the application layer on every data route
• Single sign-on via Cloudflare Access, backed by your identity provider; the application refuses to start if authentication is misconfigured
• Automated redaction of PII before AI processing
• Production access limited to a small number of named individuals, with audit logging of data access events
• An automated test suite covering authentication, firm isolation, and encryption that runs before every deployment
• Encrypted automated database backups

We do not currently hold a SOC 2 attestation; it is on our roadmap. We will complete a reasonable security questionnaire annually on request from beta subscribers.

No security measure is foolproof. If you believe your account or any client data has been compromised, contact us immediately at support@taxalpha.us. In the event of a confirmed security incident affecting your data, we will notify you promptly with the information you need to meet your own obligations to clients and regulators.

Our website uses cookies and similar tracking technologies.

• Strictly necessary cookies are required for the site to function, including form submission and session management.
• Analytics cookies help us understand how visitors interact with our site. We use this data in aggregate.
• Marketing cookies may be used to support advertising campaigns. These are deployed only with your consent where required by law.

You can control cookies through your browser settings or any consent mechanism on our site. Disabling certain cookies may affect site functionality.

Tax Alpha does not sell, rent, or trade your personal information. We do not share it with any third party in exchange for monetary or other valuable consideration.

We may disclose information to our legal, accounting, and other professional advisors under appropriate confidentiality obligations. We may also disclose information if required by law, court order, or valid legal process, or in connection with a merger, acquisition, or sale of assets (with advance notice where feasible).

All users

You may unsubscribe from marketing emails at any time using the link in any message or by contacting us directly. Opting out of marketing does not affect transactional communications about your account or demo.

California residents (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we have collected about you and for what purposes; to request deletion of your personal information (subject to certain exceptions); to request correction of inaccurate information; and to opt out of the sale or sharing of personal information. Tax Alpha does not sell or share personal information for cross-context behavioral advertising. You also have the right to non-discrimination for exercising these rights.

To submit a CCPA/CPRA request, contact us at support@taxalpha.us. We will respond within 45 days, with a possible extension of an additional 45 days where reasonably necessary. We may verify your identity before fulfilling your request.

Nevada residents

Nevada residents may opt out of the sale of personal information by contacting us. As noted, we do not sell personal information.

European Economic Area and United Kingdom residents

If the GDPR or UK GDPR applies to our processing of your information, you may have rights of access, rectification, erasure, restriction, portability, and objection. Contact us to exercise these rights or for information on lodging a complaint with a supervisory authority.

Our website may link to third-party sites, including the IRS, professional associations, and similar resources. This Privacy Policy does not apply to those sites.

The Tax Alpha platform is designed exclusively for licensed tax professionals. We do not knowingly collect personal information from anyone under 18. If we learn we have done so, we will delete it promptly.

For privacy questions, rights requests, or to report a concern:

Tax Alpha Solutions LLC

support@taxalpha.us

We aim to respond within 10 business days.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date above and, where appropriate, provide additional notice by email or on our website. Continued use of our website or platform after any update constitutes acceptance of the revised policy.