1. Who we are and our role
AnalytixData provides software to tax preparers ("Customers"). For the information a Customer puts in the portal about its own clients ("Client data"), such as bank statements, tax documents, signed consents and contact details, AnalytixData acts as the Customer's service provider: it processes that information only to provide the portal to the Customer, under the Customer's instructions, our Terms of Service and Internal Revenue Code §7216. The Customer's own privacy notice tells its clients how the Customer uses and shares their information. If you are a preparer's client and have questions about your information, contact your preparer first.
For the information we collect about visitors to our website and about Customers (for example, when you contact us or open an account), AnalytixData decides how it is used, as described below.
2. Information we collect
From visitors: what you send us through the contact or consultation form (name, email, phone, company, message and preferred time).
From Customers: account details (name, firm, email, phone, business address and, if entered, PTIN, EIN and EFIN, which are stored encrypted), staff accounts, and security settings (two-step verification and trusted devices). Stripe processes card payments; we never receive or store the full card number.
Client data, as a service provider: what the Customer or its client uploads or types, such as bank statements and other documents, organizer answers, consents and their signature record (typed name, date, IP address and device), and contact details.
Automatically: server logs (IP address, browser, date and time, page requested) and an audit log of sign-ins, downloads and changes, kept for security. Cookies: only those needed to keep you signed in and to remember a trusted device; your language and display preferences are saved in your browser. We do not use advertising or analytics cookies, and we do not track you across other websites.
3. How we use it
To provide, secure and support the portal; to read and organize bank statements for the Customer; to send the portal's emails (sign-in codes, documents and reminders); to bill subscriptions; to answer inquiries; and to comply with the law and protect against fraud and security incidents.
We do not sell personal information, and we do not share it for advertising.
We use a client's tax return information only as their preparer is allowed to under IRC §7216: to process it for the preparer and, in any other way, only with the client's own signed consent (for example, the optional consent to use).
4. Who receives it
Our service providers, each only with what its job needs and bound to protect it:
- Hostinger International Ltd. — Hosting: the server that runs the Platform, its database and its file storage: All Platform data; stored files are encrypted by AnalytixData before they are written.
- Backblaze, Inc. — Off-site backups, in the United States: Encrypted backups only; Backblaze never holds the key.
- Resend — Delivery of the Platform's emails: Recipient's name and email address and the email's text (for example a document's name and a link).
- Transaction-classification service provider (named in the client's consent and in the Terms of Service): Dates, descriptions and amounts of transactions, only for clients who selected it in their signed IRC §7216 consent.
- Document-processing service provider (named in the client's consent and in the Terms of Service): Images of scanned bank statements, only for clients who selected it in their signed IRC §7216 consent.
- Stripe, Inc. — Subscription billing and card payments: The Customer's own billing details; no Client data.
We may also disclose information when the law requires it (for example, a court order) or to protect the security of the portal and its users. If the business is transferred, the information would pass to the new owner under this same policy.
5. How long we keep it
Documents and bank statements uploaded to the portal are kept for up to seven (7) years from the date of upload, unless the preparer deletes them sooner. Signed consents and signed engagement letters (the signed PDF copy and the signature record) are kept for seven (7) years from the date of signature; the preparer cannot delete them before then, not even by deleting the client's record. When that period ends, the file is deleted automatically. A record under a legal hold is not deleted while the hold lasts.
The data of a cancelled or unpaid account, signed copies included, is deleted six (6) months after its access ended.
Deleted data leaves the encrypted backups within 12 months, as they rotate.
Inquiries received through the website are kept as long as needed to answer and follow up on them.
6. How we protect it
Files and sensitive identifiers are encrypted with AES-256 before they are stored; connections use TLS; portal accounts require two-step verification and access is limited by role; the links clients receive are personal and expire; every file access is recorded in an audit log; and backups are encrypted before they leave the server. We follow the FTC Safeguards Rule (16 CFR Part 314). No system is completely secure; if an incident affects Client data, we notify the Customer as the Terms of Service describe.
7. Your choices and rights
Depending on the state where you live, you may have other rights over your information. We will respond as the applicable law requires.
"Do Not Track" signals: because we do not track you across websites, we do not change our practices when a browser sends that signal.
The website and the portal are meant for professionals and their adult clients; we do not knowingly collect information from children under 13 through the website.
8. Changes to this policy
If we change this policy, we will post the new version on this page with its date. If the change is material, we will email Customers.