Privacy policy
Effective .
Who we are and what this notice covers
TaxAhead ("we", "us") operates this household investment planning service. This notice covers the invitation-only Web beta at app.taxahead.app, the invitation process (including an email address you gave us on taxahead.app or to the person who invited you) and related support. Privacy contact: hi@taxahead.app. Business mailing address: to be published.
Information we process
- Identity and access information: your email address, sign-in provider identifier, email verification status, invitation and household membership, and session information.
- Information you provide: household and account labels, holdings, tax lots, account history in supported CSV files, tax profile details and planning inputs. We also process the resulting calculations, alerts and exported planning packets.
- Participation, request and support records: the beta consent version you accepted and when, the associated member and household identifiers, the messages or feedback you send us, and the requests you make under this notice and our answers.
- Technical information: information needed to deliver and secure the service, which may include connection, device, request and error information processed by our hosting and identity providers. Our own operational logs record status codes, route names and opaque identifiers, not your data or your identity.
How we use information
We use information to manage invitations and access, organize imported data, generate planning material you request, record beta participation, respond to support and privacy requests, maintain security, troubleshoot failures and meet applicable legal obligations. We use submitted feedback to improve the beta. We use your information for no other purpose without first telling you and, where required, asking for your consent.
Scope of collection
Do not send passwords, brokerage credentials, full Social Security numbers, payment-card details or unrelated personal documents in CSV files or support messages. Use limited account labels, such as the last four digits, where supported. Upload information only if you have authority to provide it. This initial beta is available only to invited adults aged 18 or older located in the United States; we do not knowingly collect information from anyone under 18.
Financial connections
The initial beta uses CSV imports. Plaid Sandbox demonstrations use test data and are not a live financial connection. Before a live connection is offered, we will provide the applicable connection disclosures and request the authorization required for that feature.
Who receives information
We use service providers to operate the beta: Auth0 for identity and sign-in email, Cloudflare for the API, database, private object storage and email routing, Railway for the Web server, and Google for the mailbox that receives support and request correspondence. They process information only as needed for their service. Authorized personnel may access information for support, security and operation.
We may disclose information when required by law or as reasonably necessary to address fraud, security incidents or legal claims. Information you make available within your household can be seen by anyone else who has authorized access to that household. Copies you download or share are outside our control.
We do not sell personal data.
Retention and deletion
We keep information while it is reasonably needed for the purposes described here. Identity and household data stay while your invitation is active. Operational and security logs that carry no household data and no identity are kept by our providers for a limited time, up to 30 days.
After we receive your deletion request, we verify it as appropriate and delete eligible primary data within 30 days of the request. Controlled backup copies of eligible data are deleted or expire within 90 days of that same request. The 90-day period is not added to the 30-day period. These periods describe deletion after a request, not automatic deletion 30 days after an upload.
What we keep after deletion. Some records are not eligible for deletion on request, and we keep them with restricted access for the stated time:
- A sealed, access-restricted record of the household's imported ledger history and the planning outputs built from it, kept for four years from the deletion request to preserve the integrity of planning records and to resolve disputes or legal claims.
- Records of your beta consent, your requests under this notice and our answers, kept for four years from the deletion request to document your choices and our compliance.
- Where law requires or permits retention for a specific obligation or claim, only the information necessary for that purpose, with its use restricted.
We explain any applicable exception when we answer your request.
Your requests and choices
The owner of a household can request its deletion in the app at Delete your household data. For any other request, or if you can no longer sign in, write to hi@taxahead.app from the email address you sign in with to request access to, correction, deletion or a portable copy of your information, or to withdraw an optional consent. No new account is required to submit a request. We may ask for proportionate identity verification, normally confirmation from your sign-in email address.
We acknowledge a request within 10 days and answer within 45 days of receiving it; if we need longer we tell you why and answer within a further 45 days. If we deny a request, we explain why. To appeal, reply to our answer with "Appeal" in the subject line; we answer the appeal within 60 days.
If a household member uploaded information about you and you are not a participant, you may make the same requests through the same contact.
Security and changes
We use safeguards appropriate to the information and the service, but cannot guarantee absolute security. We post material changes here with a new effective date and give additional notice or obtain new consent where required. This notice is published at https://app.taxahead.app/privacy.