Privacy Policy

Effective Date: September 17, 2026 · Version 2026.09.17

1. Introduction

TaxMint, Inc., a Delaware corporation ("TaxMint," "we," "us," or "our"), operates the website located at yearwise.ai, together with any related mobile or desktop applications (collectively, the "Service"), which provides informational tax modeling and educational tools. This Privacy Policy explains how we collect, use, store, and protect your personal information. The Service is for informational and educational purposes only and does not constitute professional tax, legal, or financial advice.

2. Information We Collect

2.1 Information You Provide

• Account information: Name, email address, and authentication credentials, via Google sign-in or, where available, Sign in with Apple. Sign in with Apple supports "Hide My Email"; if you use it, we receive only Apple's private relay address and have no way to recover the underlying email.
• Tax and financial data: Income figures, deduction amounts, investment details, business information, real estate data, and other financial information you enter into the Service for tax modeling purposes.
• Sensitive identifiers — encrypted at write time: Social Security Numbers (SSNs), dates of birth, telephone numbers, bank account numbers, driver's license numbers, employer corporate business names, payer corporate business names, beneficiary names, beneficiary dates of birth, securities broker names, charitable organization names, medical provider names, and free-text notes. Each of these fields is encrypted at the field level immediately upon receipt using AES-256-GCM. Tax and financial data is encrypted under a data encryption key generated uniquely for your family workspace; identity fields such as names are encrypted under a key generated uniquely for each person. Every data encryption key is itself wrapped by a master Key Encryption Key (KEK) held in Google Cloud KMS. Plaintext copies of these specific identifiers are never written to disk or exposed to application diagnostics.

2.2 Payment Information

Payments are processed by Stripe. We store your Stripe customer ID and the last 4 digits of your card number for reconciliation; full card numbers and CVCs never reach our systems.

2.3 Trial Abuse Prevention

When you delete your account, we retain a keyed cryptographic hash (HMAC-SHA256, using a secret key held outside the database) of your email address. This hash cannot be reversed to identify or contact you; it serves only as a mathematical fingerprint to determine whether a returning user has previously used a free trial.

2.4 Document Ingestion, Parsing, and Absolute Data Minimization

When you upload tax documentation files to the platform, the file is written to a short-lived temporary file on the local parsing instance. Structured numeric tax data is extracted to a single, unified database table (tax_forms), and the temporary file is immediately and permanently deleted from disk via the operating system's unlink syscall within the same request lifecycle. Source documents are never written to long-term storage or local database tables.

To ensure maximum data privacy, all tax document types processed by our ingestion pipeline — including Form W-2, the 1099 family (INT, DIV, NEC, MISC, R, B, K), Form 1098, Form 1040, Form 8606, Form 8889, Form 8938, Schedule C, Schedule E, Form 4562, Form 8582, Form 8949, and SSA-1099 — are subject to strict write-time data minimization. Personal names, spouse names, dependent names, physical street addresses, cities, and ZIP codes are programmatically stripped at the write boundary and are never persisted within our long-term JSONB data blobs. Only isolated, two-letter state codes are preserved to accurately drive localized state-tax calculation routing and depreciation engines.

Business names (Schedule C), foreign financial institution names (Form 8938), and rental property matching keys (Schedule E) are entirely excluded from plaintext database storage and are isolated via the same field-level encryption described in §2.1. An automated, code-level regression test enforces this data-stripping contract on every system compilation to structurally guarantee that personal identification strings cannot leak into long-term database storage.

2.5 Waitlist and Invitation Information

If you join a waitlist or request access before creating an account, we collect your email address, your first name if you choose to give it, and, optionally, a second email address you provide for a spouse or household member so that both can be invited together. We also collect your filing status, your sign-in preference, and a tag identifying how you reached us. Email addresses are stored in plaintext because they exist to be emailed, together with a keyed hash used for matching; a first name, if given, is stored in plaintext and used only to address your invitation. We retain this information while your request is pending and while any invitation or account it led to remains active; it is deleted when you ask to be removed or when you delete your account. To be removed, email privacy@yearwise.ai.

If you provide a second email address, you represent that you have that person's permission to do so. We will send that person an invitation and this Privacy Policy; they may ask to be removed at any time by emailing privacy@yearwise.ai.

3. How We Use Your Information

• To provide and maintain the Service (perform calculations, run simulations, generate audit reports).
• To process payments and manage subscriptions.
• To communicate with you about your account, including transactional emails (e.g., free-trial reminders three days before conversion).
• To improve the Service.
• To send invitation and waitlist emails, including to a second email address you provide.

3.1 Calculation Revisions and Proactive Updates

If we detect a programmatic defect in our tax-modeling software logic or a mathematical inconsistency between our internal calculations and the cross-verification output from our automated AI engine, we may programmatically recompute the affected tax estimates within our database. If a revision alters your optimization metrics, we will proactively notify you (and any delegated tax professional or CPA firm you have actively linked to your account via our workspace invitation feature) via an automated transactional email alert and an in-app dashboard notification banner. These corrective updates are executed programmatically under the same strict data-minimization and encryption rules governing regular operations; no new categories of personal data are collected or exposed to perform a calculation revision.

4. AI and Automated Processing

The Service uses AI for the OBBBA tax auditor and related verification flows.

• Runtime AI provider: Google Gemini (via Google Vertex AI, in our dedicated Google Cloud project).
• No model training: Our Vertex AI configuration prohibits use of your data to train public models.
• De-identification before transmission: Personal identifiers — names, SSNs, EINs, email addresses, phone numbers, family ID, and physical addresses — are removed before any prompt is sent. Dates of birth are converted to integer ages and capped at 90 (a HIPAA safe-harbor pattern) to prevent age-based re-identification. An automated regression test (tests/unit/test_audit_prompt_pii.py) runs on every code change to verify no identifying patterns reach the AI provider.

4.1 Conditional Debug Access — Anthropic Claude

When you submit a bug report and grant data access via the "Allow support team to access my data" checkbox, our engineering team may use Anthropic's Claude (via Anthropic's commercial API, not a consumer product) to assist with debugging. This authorization is bounded to the 7-day consent window you grant and is revocable at any time from your profile.

Every engineer access to your data under a support consent is routed through a single audited code path that writes a record to our internal access log before the data is read. Any use of Anthropic's API on your data happens only within that consented, logged access. Under Anthropic's Commercial Terms, your data is not used to train models, and API inputs and outputs are deleted within 30 days. We do NOT use Anthropic for any production runtime processing.

5. Data Security

• Field-level encryption: As described in §2.1, sensitive identifiers are encrypted at write time using AES-256-GCM, with per-family keys for tax data and per-person keys for identity fields, all wrapped by a master key held in Google Cloud KMS.
• Document-data scrubbing: Beyond field-level column encryption, we apply a write-time scrub to our parsed document storage that removes names, street addresses, cities, and ZIP codes from the JSON blob for high-volume form types (W-2, the 1099 family, 1098, Form 1040, Schedule C, Schedule E, Form 4562, Form 8582, Form 8606, Form 8889, Form 8938, Form 8949, SSA-1099). State codes are intentionally retained because they are required for state-tax calculations.
• Address blinded lookups: Where we need to match addresses for de-duplication, we store an HMAC-SHA256 hash with a family-scoped salt alongside the encrypted address. Database compromise does not yield plaintext addresses; the hash space is too sparse to brute-force.
• In transit: All connections use TLS 1.2+.
• Access controls: Support access to your data is available only through the break-glass consent flow described in §11, is routed through a single audited code path, and is logged before any data is read. A limited number of personnel hold administrative database credentials used for operational purposes such as schema migrations and backup verification; these credentials are not used to provide support. Reads of household data made outside the application are independently logged by the database, as described in §5.1.

5.1 Database Network Isolation

Our primary database (Google Cloud SQL) is configured with a private IP address and no public route, enforced at the organization-policy level rather than by instance configuration alone. The application service connects to the database only over a private network within our cloud provider; no inbound traffic from the public internet reaches the database.

Routine access to your data for support purposes goes only through the audited application-layer chokepoint described in §11. Administrative database credentials are held by a limited number of personnel and are used for operational work (migrations, backup verification, and similar maintenance) rather than for support. Every read of household data made outside the application is independently logged by the database itself to Google Cloud Logging; query values are masked, so no field values appear in the log, and entries are retained for 400 days in a store whose retention cannot be shortened or deleted during that period.

5.2 Incident Notification

If we determine that unencrypted personal information has been acquired by an unauthorized person, we will notify affected users without unreasonable delay. Notice will describe the categories of information involved, the date or estimated date of the incident, and steps you can take to protect yourself. No system is completely secure, and we cannot guarantee absolute security.

6. Data Retention and Deletion

6.1 Live Account Data

We retain your data while your account is active. When you delete your account, we remove your data from live systems immediately and crypto-shred all encryption keys associated with your account. Backups taken before deletion are handled as described in §6.3.

We periodically test our ability to restore from backups. Restore testing may temporarily re-create data, including data from deleted accounts, in an isolated environment that is destroyed at the end of the test. Restored copies are never used to serve the Service and are not accessible to users.

6.2 Billing Records

When you delete your account, we delete billing records linked to your account in our systems immediately. Stripe retains its own independent payment records subject to its retention policy (typically 7 years per its commercial terms); contact Stripe directly to request deletion of those records.

6.3 Backups

We retain up to 30 daily database backups, plus seven days of point-in-time recovery logs, on a rolling basis: each new backup replaces the oldest, so a backup is ordinarily overwritten within about 30 days of being taken (longer only if scheduled backups fail). A backup taken before you deleted your account contains your data and its encryption keys as they were at that moment, and could be read if that backup were restored. Backups are used only for disaster recovery and for periodic restore testing; no backup is used to serve the product. Once the backups taken before your deletion have been overwritten, your data is no longer recoverable from any system we control.

6.4 Audit Logs

Audit-log entries — records of support engineer access to your data under a break-glass consent you granted, e-sign consent transitions, and similar compliance events — are retained after account deletion as the legal record of access. These entries are by design PII-free: only a system user ID, a UTC timestamp, an event-type slug, and an HMAC-hashed IP address. Plaintext IP addresses are never stored.

Separately, the database-level audit trail described in §5.1 records reads and writes of household data, including any made outside the application, with query values masked.

7. Your Data Rights

You may request access, correction, or deletion of your personal information. The in-app "Export My Data" function on your profile page provides a one-click JSON export of every field associated with your account. To exercise your other rights or to submit a Data Subject Access Request, email privacy@yearwise.ai. Data authored by a tax professional you have linked to your account (their private strategy notes and professional-to-client messages) is treated as their work product and is not included in the automated export. You may request it via privacy@yearwise.ai.

7.1 California Privacy Rights; Do Not Sell or Share My Personal Information

If you are a California resident, you have the right to: know the categories and specific pieces of personal information we collect, use, and disclose; delete personal information we hold about you; correct inaccurate personal information; opt out of the sale or sharing of personal information; and limit the use and disclosure of sensitive personal information. You may exercise these rights by emailing privacy@yearwise.ai. We will verify your identity before responding and will respond within 45 days, subject to permitted extensions.

We do not sell or share your personal information, and we have not done so in the preceding twelve months. We do not use or disclose sensitive personal information for purposes other than providing the Service. We honor the Global Privacy Control (GPC) browser signal as a valid request to opt out of any sale or sharing of personal information; when your browser sends it, the Service treats you as opted out without further action on your part.

The categories of personal information we collect are described in Section 2, the purposes in Section 3, and the parties to whom we disclose it in Section 8. We retain personal information as described in Section 6.

We will not discriminate against you for exercising any of these rights. You may designate an authorized agent to submit a request on your behalf.

8. Third-Party Processors

9. Cookies

The Service sets cookies essential for authentication and session management:

• Supabase authentication cookies (session)
• has_subscription — a short-lived cookie (24-hour TTL) used to rapidly verify your subscription status on each page load without introducing database latency
• has_consented — a short-lived cookie (1-hour TTL) recording that you have accepted the current versions of these legal documents
• account_type — routes consumer vs. CPA users to the correct workspace
• user_state — routing optimization for the multi-state-aware UI

The has_subscription and has_consented cookies carry a value derived from your own user ID rather than a bare flag, so they cannot be copied between accounts.

If you opt in to product analytics (§8, PostHog), a first-party analytics cookie is set to keep your pseudonymous analytics ID consistent between visits; it is not set otherwise. No advertising cookies are set.

10. Children's Privacy & International Users

The Service is not intended for, and may not be used by, individuals under 18. The Service is offered to U.S. tax filers only; tax logic is U.S. Federal + select state tax codes.

The Service is not directed to individuals located outside the United States. Data is stored and processed in the United States. If you access the Service from outside the U.S., you do so on your own initiative and are responsible for compliance with local law; we do not offer the Service to residents of the European Economic Area or the United Kingdom.

11. Break-Glass Support Access

When you submit a bug report, you may grant our support team explicit data access via the "Allow support team to access my data for 7 days" checkbox. This consent:

• Is opt-in. Default is unchecked.
• Is time-bounded. Access expires automatically 7 days after the bug report is submitted.
• Is revocable. A banner appears on your dashboard while the consent is active, with a "Revoke Now" button.
• Is audit-logged. Every access by an engineer under this consent writes a row to our append-only support-access log before the operation executes. The log row contains a system user ID, a timestamp, and an event-type slug — no PII.
• Authorizes Anthropic for debugging only. Per §4.1, this is the only consent under which Anthropic's Claude may be used on your data.

Unrevoked support access grants automatically expire after exactly 7 days, programmatically terminating all engineer capabilities to read or query your data layers. Upon expiration or active user revocation, the support authorization entry enters a secure, inactive state and is permanently hard-deleted from our databases via an automated Cloud Scheduler nightly maintenance cron within 30 days, matching the systemic log-purging windows of our diagnostic sub-processors. The audit log row survives — that is the durable record of who accessed what, and when.

12. Changes to This Policy

Material changes will be notified via the "Last Updated" date and an in-app notification. Changes to the list of third-party processors in Section 8 trigger a consent re-acceptance flow requiring your acknowledgment before you can continue using the Service.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact:

TaxMint, Inc. Email: privacy@yearwise.ai

To report a security vulnerability or concern, email security@yearwise.ai. Our security disclosure policy is published at https://yearwise.ai/.well-known/security.txt.