Privacy Policy

This Privacy Policy explains how Tax Wallet Inc., a Florida corporation (Florida Document No. P23000077808), doing business as TaxWallet (“TaxWallet”, “Company”, “we”, “our”, or “us”), collects, uses, shares and protects information through taxwallet.ai, app.taxwallet.ai, the TaxWallet and Talks mobile apps, our APIs and sandbox, and our AI assistant Justin.

TaxWallet is a secure tax technology platform built on proprietary infrastructure developed by Jadee. We provide workflow systems, SaaS dashboards, mobile scanning applications, AI-assisted automation, and document management tools for tax professionals and taxpayers.

This Privacy Policy describes how we collect, use, store, process, and protect personal information when users (“you”) access our website, SaaS dashboard, mobile apps, APIs, or any related services (collectively, the “Platform”).

Where the law requires your consent, for example for analytics cookies and live session tracing on our website (Section 19), we ask for it separately and you can refuse or withdraw it at any time.

This Privacy Policy applies to:

• Tax professionals and firms.

• Firm staff and administrative users.

• Taxpayers whose data is uploaded, processed, or stored.

• Mobile app users (iOS and Android), including users of the TaxWallet and Talks apps.

• Users accessing APIs, the sandbox, integrations, banking partners, or third-party services.

• Anyone who calls, texts, chats with, or messages TaxWallet or Justin.

This Policy covers all Platform environments:

• Marketing website (www.taxwallet.ai), including the blog and careers pages.

• SaaS dashboard (app.taxwallet.ai).

• Mobile apps used to scan documents, upload data, sign returns, message, or call.

• Back-end systems, automation tools, AI services, and integrated third-party solutions.

If you are a tax professional, you are responsible for obtaining all required taxpayer authorizations before transmitting personal information through the Platform.

TaxWallet collects only the information necessary to deliver secure, compliant tax workflow services. This includes:

1. Identity & Account Information

• Name, email address, phone number, office information.

• Login credentials, MFA tokens, biometric authentication events (when used on mobile).

2. Taxpayer & Return Information

• SSNs, ITINs, dependents, spouse data, household information.

• Tax documents: W-2, 1099, 1098, receipts, IDs, prior-year returns.

• Financial and employment information necessary for IRS/state filings.

3. Mobile App Data

• Device identifiers, device metadata, OS version, crash logs.

• Camera input for document scanning (TaxWallet never accesses personal photo libraries).

• Installation-based device ID used for fraud prevention and verification.

• Push notification tokens (for alerts, document requests, and signature reminders).

4. Electronic Signatures & Compliance Data

• IP address, timestamp, device information, geolocation (where legally permitted).

• ESIGN/consent logs, audit trails, identity confirmation data.

5. Communications

• Content and metadata of calls, voicemails, text messages, chats and direct messages with TaxWallet and our assistant Justin, including call recordings and transcripts where you have been notified (see Section 16).

• Messages between tax professionals and taxpayers, and support tickets.

6. AI, OCR & Automation Inputs

• Document scans and extracted values processed through optical character recognition or AI analysis.

• AI inference logs, structured tax data extracted via automation.

All AI/OCR results must be manually verified by the user. TaxWallet is not responsible for inaccuracies or omissions.

7. Technical, Usage & Security Logs

• IP address, browser type, operating system, access times.

• API access logs, security events, anomaly detection flags.

• Device identifiers used to keep your account and authenticator codes bound to your own device.

8. Billing & Payment Data

• Cardholder information collected and processed by PCI-compliant third-party payment processors.

• TaxWallet does not store, retain, or directly process full payment card numbers.

9. Website and Content Analytics — only after you click Accept

• If you click Accept on our cookie banner, when you view or interact with our website, blog or posts we record the page or post, date and time, your IP address and the approximate location derived from it (city, region, country), the referring site or campaign (for example a social platform, search engine, email or text link, and UTM parameters), your device and browser type, an anonymous first-party device ID, and a live connection of your session to our secure hub. We filter automated traffic and count repeat views from the same address within 30 minutes once.

• If you don’t accept, click Decline, or your browser sends a Global Privacy Control (GPC) signal, we don’t run analytics, set the device ID, or trace your session, and your page view adds only to an anonymous total.

• Separately, for every visit our servers keep a security log (IP address, approximate location — city, region, country — page requested, time and browser type) used only to protect the site and our users: detecting attacks, fraud and abuse, and investigating incidents. Security logs are kept for 90 days, are never used for marketing or analytics, and are never sold or shared except with law enforcement or as the law requires.

10. Likes and Reactions

• Likes and reactions on our content. After you accept, they are recorded with the same details as Section 3.9; otherwise only a strictly necessary key that lets the Like button work is used.

11. Identification of Known Visitors

• If you have an account with us, or reached our site through a link we sent you (for example by email, text message or direct message), and you have accepted analytics, a first-party cookie or link token set by TaxWallet may connect your visit or reaction to your account or contact record. We do not use third-party advertising cookies for this.

We use information for the following lawful business and compliance purposes:

• Account creation, user authentication, and identity verification.

• Preparing, managing, reviewing, and transmitting tax returns.

• Document uploads, storage, retrieval, and audit logging.

• Enabling e-signature workflows with legal compliance.

• Providing mobile notifications, secure messaging, and user support.

• Securing accounts: device binding, fraud and abuse detection, rate limiting, and blocking of abusive networks.

• Meeting IRS, federal, state, financial, ESIGN, and data protection obligations.

• Improving Platform performance, reliability, and features.

• With your consent (Section 19), measuring how our content performs and where our audience is located, and improving our services and marketing.

• Routing your request (for example “TRY”, “API” or “CHECKLIST” replies) to the right team and following up with you.

We do not use taxpayer data for advertising or profiling unrelated to tax services.

Where GDPR applies, we process personal data under the following bases:

• Contractual necessity – to provide users access to the Platform.

• Legal obligations – IRS, FTC, GLBA, KYC/identity verification requirements.

• Legitimate interests – platform security, fraud detection, performance improvement.

• Consent – website analytics, live session tracing, and other optional features.

We do not sell personal information and do not share it for cross-context behavioral advertising.

We may share information only with the following, strictly for operational or compliance purposes:

• The IRS and state tax agencies, to transmit returns and receive acknowledgments.

• Banks and refund-transfer providers you or your preparer select, to process bank products.

• Payment processors and gateways (we do not store full card numbers).

• Identity verification providers.

• Telecommunications, messaging, email and hosting providers, and AI model providers acting as our service providers under confidentiality obligations.

• Social platforms (for example Meta/Instagram) when you interact with us there.

Each vendor is contractually required to adhere to confidentiality, security, and compliance standards equivalent to or exceeding our own.

TaxWallet is not responsible for failures, outages, breaches, or delays caused by independent third-party systems outside our control.

Our security program follows the FTC Safeguards Rule (16 C.F.R. Part 314) and IRS Publication 4557, and is documented in our Written Information Security Plan. Controls include:

• Encryption of sensitive data in transit (TLS 1.2+) and at rest (AES-256).

• Multi-factor and device-bound authentication, signed sessions, and role-based, least-privilege access.

• Network allowlisting and abuse blocking.

• Audit logging, including immutable logs for signatures, file access, and workflow actions, and redaction of personal data from logs.

• Continuous vulnerability scanning, vendor oversight, and incident response.

Despite best efforts, no system is 100% secure. Users are responsible for maintaining device security, credential hygiene, and safeguarding access to TaxWallet.

See the AI Terms. Justin, our AI assistant, may answer questions, summarize documents, draft messages, place or answer calls, reply to messages and comments, and schedule content on our behalf. Information you provide to Justin is processed to deliver that service.

We do not use taxpayer tax return information to train AI models. Our AI providers are contractually prohibited from using it to train their models.

AI outputs may contain errors or omissions and must be reviewed by a qualified person before they are relied on or used in a filing.

Users affirm that:

• All information submitted is accurate, lawful, and authorized.

• Necessary taxpayer permissions have been obtained before uploading data.

• Documents uploaded do not infringe on any third-party rights.

• Users will not misuse the Platform for fraud, identity theft, or unauthorized access.

TaxWallet bears no responsibility for:

• Errors caused by user negligence.

• Fraudulent returns submitted under user accounts.

• Misuse of AI-generated data.

• Unverified OCR or auto-fill entries.

We retain information only as long as necessary to:

• Provide Platform services to users and tax professionals.

• Comply with IRS, federal, state, and financial record-keeping requirements.

• Maintain security, auditing, and fraud prevention systems.

Specific periods:

• Raw IP addresses in website analytics: 90 days, after which we keep only aggregated location statistics (city, region and country counts).

• Website security logs (IP address, approximate location, page requested, time and browser type, kept for every visit — Section 3.9): 90 days, after which we keep only daily country and region counts with no IP address.

• Call recordings and transcripts: kept only as long as needed for the purposes in Section 16 and our business records, and longer when needed for a dispute or legal hold.

• Tax return information: as required by IRS rules for EROs, our agreements, and law (generally at least 3 years).

Tax professionals may implement their own independent retention policies which operate separately from TaxWallet.

All data is stored in the United States.

For international transfers, we use Standard Contractual Clauses (SCCs) or legally recognized mechanisms.

The Services are not directed to children under 13 and we do not knowingly collect their personal information.

Dependents’ information entered by a parent or preparer on a tax return is tax return information handled under 26 U.S.C. §7216.

Depending on your state (for example California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and others where thresholds are met), you may have rights to:

• Know what personal information we hold and access it.

• Correct inaccurate information.

• Delete personal information (subject to IRS and other retention laws).

• Receive a portable copy of your data.

• Opt out of sale or sharing, targeted advertising and profiling (TaxWallet does not sell or share personal information, and does not use it for targeted advertising).

• Opt out of marketing communications.

• Appeal our decision on your request.

Submit requests to support@taxwallet.ai. We verify requests and do not discriminate against you for exercising your rights. Information we hold as a service provider to your tax preparer is handled under our contract with them; we will route your request to them.

We may update this Privacy Policy periodically to reflect:

• Changes in regulation or compliance requirements.

• Enhancements to security or product functionality.

• Operational or business updates.

Significant changes will be communicated through email, in-app notifications, or a prominent notice on the website. Previous versions remain available from this page.

TaxWallet Privacy & Security Office — Tax Wallet Inc.

Privacy requests and questions: support@taxwallet.ai

Legal notices: legal@taxwallet.ai. TaxWallet will provide a mailing address for formal legal notice on request.

We respond promptly to all compliance, legal, and privacy requests.

Calls with TaxWallet, including calls handled by Justin, may be recorded and transcribed for quality, training of our staff, security and records.

We announce this at the start of the call; by continuing, you consent. If you do not consent, you may hang up and contact us by email or chat instead.

Florida and several other states require the consent of all parties to record a call. See our Communications, Text Message & Call Recording Policy.

If you opt in to texts, we use your number to send the messages you requested. Message frequency varies; message and data rates may apply; reply STOP to cancel and HELP for help.

Consent to texts is not a condition of purchase. We do not share or sell mobile numbers or SMS opt-in data with third parties for their marketing.

If a breach affects your personal information, we will notify you and regulators as required by law, including Fla. Stat. §501.171, other state laws, and the FTC Safeguards Rule notification requirement.

On our website, analytics and live session tracing run only after you click Accept on our cookie banner. That includes Google Analytics and Google Tag Manager (analytics only, never advertising), the anonymous first-party device ID, recording your IP address and approximate location with the pages you read, and the live connection of your session to our secure hub.

Before you choose, if you click Decline, or if your browser sends a Global Privacy Control (GPC) signal, none of these run and no Google script is loaded. We treat a GPC signal as Decline unless you later choose Accept yourself.

Whatever you choose, our servers keep the security log described in Section 3.9 for every visit — it sets no cookie, is used only to protect the site and our users, and is kept for 90 days.

Strictly necessary cookies always run: they keep the site secure, prevent fraud and abuse, remember your choice, and make forms, chat, likes and checkout work when you use them.

You can change your choice at any time from “Your Privacy Choices” at the bottom of every page. Choosing Decline after you accepted deletes the analytics cookies and the device ID and stops live tracing immediately.

We do not sell personal information, and we do not use third-party advertising pixels (such as Meta, TikTok or LinkedIn pixels), retargeting, or cross-site advertising. See the Cookie Policy for details.