Effective Date: May 18, 2026 · Version 2026.05.18
TaxMint.ai ("we," "us," or "our") provides informational tax modeling and educational tools. This Privacy Policy explains how we collect, use, store, and protect your personal information. The Service is for informational and educational purposes only and does not constitute professional tax, legal, or financial advice.
Payments are processed by Stripe. We store your Stripe customer ID and the last 4 digits of your card number for reconciliation; full card numbers and CVCs never reach our systems.
When you delete your account, we retain a cryptographically hashed (SHA-256 with salt) form of your email address. This hash cannot be reversed to identify or contact you; it serves only as a mathematical fingerprint to determine whether a returning user has previously used a free trial.
When you upload tax documentation files to the platform, the file is written to a short-lived temporary file on the local parsing instance. Structured numeric tax data is extracted to a single, unified database table (tax_forms), and the temporary file is immediately and permanently deleted from disk via the operating system's unlink syscall within the same request lifecycle. Source documents are never written to long-term storage or local database tables.
To ensure maximum data privacy, all tax document types processed by our ingestion pipeline — including Form W-2, the 1099 family (INT, DIV, NEC, MISC, R, B, K), Form 1098, Form 1040, Form 8606, Form 8889, Form 8938, Schedule C, Schedule E, Form 4562, Form 8582, Form 8949, and SSA-1099 — are subject to strict write-time data minimization. Personal names, spouse names, dependent names, physical street addresses, cities, and ZIP codes are programmatically stripped at the write boundary and are never persisted within our long-term JSONB data blobs. Only isolated, two-letter state codes are preserved to accurately drive localized state-tax calculation routing and depreciation engines.
Business names (Schedule C), foreign financial institution names (Form 8938), and rental property matching keys (Schedule E) are entirely excluded from plaintext database storage and are isolated via field-level column encryption using the Google Tink cryptographic library. An automated, code-level regression test enforces this data-stripping contract on every system compilation to structurally guarantee that personal identification strings cannot leak into long-term database storage.
If we detect a programmatic defect in our tax-modeling software logic or a mathematical inconsistency between our internal calculations and the cross-verification output from our automated AI engine, we may programmatically recompute the affected tax estimates within our database. If a revision alters your optimization metrics, we will proactively notify you (and any delegated tax professional or CPA firm you have actively linked to your account via our workspace invitation feature) via an automated transactional email alert and an in-app dashboard notification banner. These corrective updates are executed programmatically under the same strict data-minimization and encryption rules governing regular operations; no new categories of personal data are collected or exposed to perform a calculation revision.
The Service uses AI for the OBBBA tax auditor and related verification flows.
tests/unit/test_audit_prompt_pii.py) runs on every code change to verify no identifying patterns reach the AI provider.When you submit a bug report and grant data access via the "Allow support team to access my data" checkbox, our engineering team may use Anthropic's Claude (commercial Developer API) to assist with debugging. This authorization is bounded to the 7-day consent window you grant and is revocable at any time from your profile.
Every Claude API call is routed through a single audited code path that writes a record to our internal audit log BEFORE contacting Anthropic. Anthropic's commercial terms prohibit using your data for model training and purge logs within 30 days. We do NOT use Anthropic for any production runtime processing.
Our primary database (Google Cloud SQL) is configured with a private IP address and is fully isolated from the public internet. The application service connects to the database only over a private network within our cloud provider; no inbound traffic from the public internet reaches the database. Direct engineer access to the database is not permitted; all access goes through the audited application-layer chokepoint described in §11.
We retain your data while your account is active. When you delete your account, we remove your data from live systems immediately and crypto-shred the family encryption key (rendering encrypted backups unreadable even if recovered).
When you delete your account, we delete billing records linked to your account in our systems immediately. Stripe retains its own independent payment records subject to its retention policy (typically 7 years per its commercial terms); contact Stripe directly to request deletion of those records.
Encrypted backups are subject to a standard rolling overwrite cycle (up to 30 days). Because backups are encrypted under the family key that was crypto-shredded at deletion time, the practical data lifetime is bounded by that backup cycle and is unrecoverable thereafter.
Audit-log entries — records of support engineer access to your data under a break-glass consent you granted, e-sign consent transitions, and similar compliance events — are retained after account deletion as the legal record of access. These entries are by design PII-free: only a system user ID, a UTC timestamp, an event-type slug, and an HMAC-hashed IP address. Plaintext IP addresses are never stored.
You may request access, correction, or deletion of your personal information. The in-app "Export My Data" function on your profile page provides a one-click JSON export of every field associated with your account. To exercise your other rights or to submit a Data Subject Access Request, email privacy@taxmint.ai. Data authored by a tax professional you have linked to your account (their private strategy notes and professional-to-client messages) is treated as their work product and is not included in the automated export. You may request it via privacy@taxmint.ai.
| Provider | Purpose | Data shared | |---|---|---| | Supabase | Authentication only (OAuth / MFA sessions) | Auth identity (email, user ID) — NOT your tax or financial data | | Google Cloud Platform | Hosting (Cloud Run), Cloud SQL primary database, storage, KMS, Cloud Scheduler (nightly cleanup jobs) | All tax and financial data at rest, encryption keys managed | | Google OAuth | Sign-in | Email, name | | Apple Sign-In | Sign-in | Email (or Apple "Hide My Email" relay), name | | Google Vertex AI / Gemini | Tax auditor and verification (runtime) | De-identified financial summaries only — see §4 | | Anthropic Claude (conditional) | Engineering debug assistance only when you have granted break-glass consent | Only data on tickets where you have granted consent; gated by §11 | | Stripe | Payments | Customer ID, last-4 digits, billing address | | Resend | Transactional email | Email address | | Yahoo Finance | Public stock and security price data, fetched on demand when you view your investment holdings or run market-price-dependent simulations | Ticker symbols only (e.g., "AAPL"). We never transmit your account ID, holding quantities, or purchase prices. However, the timing of these requests does correlate with your active session. | | Sentry | Application error tracking (frontend + Flutter) | Error stack traces and metadata only. We run every error payload through a PII scrubber before transmission and apply a second scrub at the Sentry-SDK boundary (defense-in-depth). | | PostHog | Product analytics (usage funnels) | Pseudonymous user ID and event names only. No names, emails, amounts, or tax data. Consent-gated (opt-out by default) and never used for advertising. |
The Service sets cookies essential for authentication and session management:
has_subscription — a short-lived cookie (24-hour TTL) used to rapidly verify your subscription status on each page load without introducing database latencyaccount_type — routes consumer vs. CPA users to the correct workspaceuser_state — routing optimization for the multi-state-aware UINo advertising or tracking cookies are set.
The Service is not intended for, and may not be used by, individuals under 18. The Service is offered to U.S. tax filers only; tax logic is U.S. Federal + select state tax codes.
When you submit a bug report, you may grant our support team explicit data access via the "Allow support team to access my data for 7 days" checkbox. This consent:
Unrevoked support access grants automatically expire after exactly 7 days, programmatically terminating all engineer capabilities to read or query your data layers. Upon expiration or active user revocation, the support authorization entry enters a secure, inactive state and is permanently hard-deleted from our databases via an automated Cloud Scheduler nightly maintenance cron within 30 days, matching the systemic log-purging windows of our diagnostic sub-processors. The audit log row survives — that is the durable record of who accessed what, and when.
Material changes will be notified via the "Last Updated" date and an in-app notification. Changes to the list of third-party processors in Section 8 trigger a consent re-acceptance flow requiring your acknowledgment before you can continue using the Service.
If you have questions about this Privacy Policy, wish to exercise your data rights, or need to report a security concern, please contact:
TaxMint.ai Email: privacy@taxmint.ai