Privacy Policy

1. Who we are

Brevitax is operated by Brevitax, Inc., a California corporation based in Burbank, California. We build software that helps households and tax professionals understand IRS account records, plan next steps, and track execution.

Privacy questions: support@brevitax.com Security vulnerabilities: security@brevitax.com (see also https://brevitax.com/security)

2. Information we collect

We collect the following categories of information:

Account information: Name, email address, firm name (for professional accounts), phone number, and password (hashed — never stored in plaintext).

IRS transcript and document data: Tax transcript files you upload, IRS notices, and related account records used to build your account view and professional deliverables.

Financial profile data: Income, expense, and asset information you enter for ability-to-pay analysis. Sensitive identifiers (Social Security Numbers, Employer Identification Numbers, bank account numbers) are collected as last-4 digits only wherever technically feasible.

Bank account data (optional, via Plaid): When you or your client connects a bank account through Plaid, we receive account names, account types, masked account numbers (last four digits), current balances, and transaction history for linked depository accounts. Connection is optional; you may enter bank information manually instead.

Payment information: Billing details processed through Stripe. We do not store full credit card numbers on our servers.

Usage data: Pages visited, features used, and actions taken within the Service, collected to operate and improve the product.

3. IRS transcript data — special handling

Transcript data is among the most sensitive information we process. We treat it accordingly.

Transcript data is used solely to deliver the Service — organize your IRS account view, generate deliverables you request, and support guided services you enroll in. It is not used to train AI models, sold to third parties, used for advertising, or shared with any party other than as described in Section 5.

We retain transcript data for as long as your account or case is active and for the periods described in Section 7. You may request deletion of transcript data associated with a case at any time by contacting support@brevitax.com.

4. How we use your information

We use the information we collect to:

• Operate the Service and authenticate your sessions • Generate Discovery, Strategy, and execution-tracking workflows you request • Process payments and send transactional communications • Improve product accuracy and reliability • Comply with legal obligations

We do not use your tax data for behavioral advertising, data brokering, or any purpose unrelated to delivering the Service.

5. How we share information (subprocessors)

We share information only as follows:

Anthropic (AI processing): We send transcript excerpts and financial context to Anthropic's API for AI-assisted analysis. Anthropic processes this data under their API usage policy and does not use API-submitted data to train their models. Data is transmitted over encrypted connections.

Supabase (database and storage): We use Supabase to store case data, transcripts, and documents. Supabase is a SOC 2 Type II certified provider operating on AWS infrastructure.

Stripe (payments): Subscriptions and billing are processed by Stripe, Inc. We share account and transaction information necessary to charge your payment method and maintain billing records. We do not store full credit card numbers on our servers.

BoldSign (electronic signatures): When you send documents for e-signature through the Service, we transmit signer names, email addresses, document content, and signing status to BoldSign (Syncfusion).

Resend (email): Transactional email delivery for account, billing, and portal verification messages.

Sentry (error monitoring): Application errors and diagnostics; we configure scrubbing and masking to limit sensitive data in third-party monitoring.

Google Calendar (optional, per-user): If you connect Google Calendar in Settings, we store encrypted OAuth tokens and your connected Google account email. We send create-only calendar events for case tasks you schedule. We do not read, list, modify, or delete your existing calendar events. You may disconnect at any time.

Google API Services: Brevitax's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Telephony — RingCentral or Dialpad (optional, per-user): If your firm enables telephony and you connect your account, we store encrypted OAuth tokens and use the connection for outbound calls, SMS, and call metadata logging. You may disconnect at any time.

Plaid (optional bank connection): When you connect a bank account, we use Plaid Inc. to collect account and transaction data from your financial institution. Before a client connects a bank account in the client portal, we send a one-time verification code to the email address on file (email-based MFA). By connecting, you acknowledge Plaid's end user privacy policy (https://plaid.com/legal). We receive account names, types, masked account numbers, balances, and transaction history solely for financial profile intake and ability-to-pay review. Plaid access tokens are encrypted at the application layer. You may disconnect at any time.

Google Analytics (website usage): We use Google Analytics 4 on our public site and signed-in application to measure aggregate traffic and engagement. We configure Analytics for measurement only — not for advertising or remarketing — and we do not sell Analytics data.

Legal compliance: We may disclose information if required by law, subpoena, or other legal process, or to protect the rights, property, or safety of Brevitax, Inc., our users, or others.

We do not sell your data. We do not share transcript data with other tax professionals, IRS representatives, or any government agency unless legally compelled. Optional integrations are initiated by you or your firm administrator; disconnecting stops new data flows through that provider.

6. Data security

We implement industry-standard security measures including:

• Encryption in transit (TLS 1.2+) for all data transmission • Encryption at rest for stored transcript, document, and report data • Application-layer encryption for high-risk fields (including integration secrets and Plaid tokens) • Firm-scoped tenant isolation and role-based access controls • Append-only activity logging for case and authentication events • Regular security reviews of our infrastructure and integrations

No security system is impenetrable. If you believe your account has been compromised, contact us immediately at support@brevitax.com. To report a security vulnerability, email security@brevitax.com.

See https://brevitax.com/security for a public overview of our security program.

7. Data retention and deletion

We retain your data for as long as your account is active. If you close your account, we retain data for up to 90 days to allow for dispute resolution, then delete or anonymize it unless a legal hold applies.

Transcript data associated with individual cases can be deleted on request at any time. Generated PDF reports are retained for 12 months from generation date and then deleted unless you request earlier deletion.

Plaid bank connection data (access tokens, account snapshots, and synced transaction summaries) is retained while the connection remains active for a case. When disconnected, we delete stored Plaid access credentials and stop new syncs; historical snapshots merged into a case financial profile may remain until the case or account is deleted.

We retain billing records as required by applicable law (typically 7 years).

To request deletion or export of your data, contact support@brevitax.com. We respond to verified requests within 30 days where permitted by law.

8. Your rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you • Correction: Request correction of inaccurate data • Deletion: Request deletion of your data (subject to legal retention obligations) • Portability: Request your data in a machine-readable format • Restriction: Request that we stop processing your data in certain ways

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to delete personal information, and the right to opt out of the sale of personal information (we do not sell personal information).

To exercise any of these rights, contact support@brevitax.com. We will respond within 30 days.

9. Cookies and tracking

We use session cookies to maintain your authenticated session.

We use Google Analytics 4 (cookies and similar technologies) to measure how visitors and signed-in users navigate brevitax.com — pages viewed, referral source, device type, and general engagement. This helps us improve the site and product. We do not use Google Analytics for advertising, and we do not allow Google to use our Analytics data for its own ad products.

We also use first-party and infrastructure analytics (for example Vercel Analytics and internal usage telemetry) to understand aggregate Service performance and feature use. None of these tools are used to sell your data or build advertising profiles.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify registered users by email of material changes and post the updated policy on this page with a revised effective date. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our data practices, contact support@brevitax.com.

Questions about this Privacy Policy? Contact us at support@brevitax.com. See also our Terms of Service.