TaxPin

Privacy Policy

Last updated: November 1, 2026

1. Who We Are

TaxPin ("TaxPin," "we," "us") provides a secure document-exchange portal that connects tax preparation firms ("Firms") with their clients ("Clients"). TaxPin is operated by ApexPin Tax Service LLC. Contact: info@apexpintax.com.

2. Information We Collect

• Account information — name, email address, phone number, and password (stored as a cryptographic hash).
• Tax documents — files you or your Firm upload, which may contain sensitive information such as Social Security numbers, income records, and financial statements.
• Usage records — security logs of actions such as uploads, downloads, sign-ins, and document confirmations, kept for audit and compliance purposes.

3. How We Use Information

We use your information solely to operate the service: transmitting documents between you and your Firm, sending notification emails, maintaining security (including fraud prevention and audit logging), and complying with legal obligations. We do not sell your personal information, and we do not use your tax documents for advertising, analytics, or model training.

Some features involve automated processing, and all of them are limited to operating the service:

• Document text recognition — when a document is uploaded, we may run automated text recognition on it so your Firm can check the extracted values against the original side by side. Extracted values are never applied automatically; a person at your Firm must review and approve them.
• Message translation — when you and your Firm write to each other in different languages, the text of those portal messages is translated automatically so both sides can read it. This applies to message text only, not to your documents.
• Office document preview — when you or your Firm open a Word, Excel or CSV file in the portal, it is converted to PDF automatically so it can be shown on screen. The original file is not changed, and downloading always gives you the original.
• Bookkeeping category suggestions — if your Firm uses the bookkeeping tools, the description lines of bank and card transactions (for example “COSTCO WHSE #1123”) may be sent to Anthropic’s API so a suggested account category can be returned. Only the description, date and amount are sent — never your name, account number, or documents. Suggestions are never applied automatically; a person at your Firm must review and approve them.
• Return summaries and letter drafts for your preparer — when a person at your Firm asks for it, the text of a finished tax return may be sent to Anthropic’s API to draft a short summary or a plain-language letter explaining the return. Long numbers such as Social Security and account numbers are masked before sending. The draft is only a draft: a person at your Firm reads and edits it before anything reaches you.

4. Security

• Documents are encrypted in transit (TLS) and at rest (AES-256).
• Files are accessible only through expiring, signed links — never public URLs.
• Each Firm's data is isolated at the database level; one Firm can never access another Firm's data.
• Two-factor authentication (2FA) is available for all accounts and required for Firm staff.
• Sessions automatically expire after 30 minutes of inactivity.

5. Who Can See Your Documents

Documents you upload are visible only to you and the Firm that invited you. TaxPin personnel do not access document contents except where strictly necessary for security investigation or as required by law.

6. Service Providers

We rely on vetted infrastructure providers to operate the service:

• Supabase — database and encrypted file storage, hosted in the United States.
• Vercel — application hosting.
• Amazon Web Services — transactional email delivery (Amazon SES), automated text recognition on uploaded documents (Amazon Textract), and malware scanning of every uploaded file (Amazon GuardDuty Malware Protection). For scanning, a copy of the file is placed in a private scanning bucket (Amazon S3) and is removed automatically within one day; a file that is found to be infected is blocked and replaced with a notice. All in the United States.
• Backblaze — nightly backup copies of stored documents and database records (Backblaze B2, in the United States), so that records can be restored after a failure. Backups are encrypted in transit and at rest and are kept for about 60 days (see Retention).
• BoldSign — electronic signature delivery and, for IRS e-file signature forms, identity verification (knowledge-based authentication) of the signer when your Firm requests it. BoldSign receives the document to be signed and the signer’s name and email; identity-verification questions are generated and scored by BoldSign’s verification provider and the answers are not stored by TaxPin.
• Intuit (QuickBooks Online) — only when a Firm connects its own QuickBooks company for bookkeeping. TaxPin then sends transaction records to, and reads account lists from, that QuickBooks company on the Firm’s behalf. The connection key is stored encrypted and the Firm can disconnect at any time.
• Stripe — payment processing when your Firm bills you through the portal. Card details are entered directly with Stripe and are never stored by TaxPin.
• Google Cloud — translation of portal message text when you and your Firm use different languages (Cloud Translation), and conversion of Word, Excel and CSV documents to PDF so they can be previewed in the portal (Cloud Run, in the United States). The conversion service does not keep a document after converting it.
• Twilio — SMS text-message delivery, for clients who opt in.
• Anthropic — suggested bookkeeping categories from transaction description lines, and, when a person at your Firm asks for it, summaries and letter drafts from the text of a finished tax return (long numbers masked). Your messages and other documents are not sent to Anthropic, and nothing sent is used to train models.

These providers process data on our behalf under their own security commitments and do not use it for other purposes.

7. Google Drive Backup (Optional)

A Firm’s owner may choose to connect the Firm’s own Google account so that TaxPin copies the Firm’s documents and records (client folders, messages, document notes, and invoice and signature lists) into that account’s Google Drive — when the owner presses “Send to Drive” and, if turned on, once a month. This feature is off unless the owner connects it.

• Limited access. TaxPin asks Google only for the “drive.file” permission, plus the email address of the connected account so the Firm can see which account is linked. With this permission TaxPin can see and change only the backup folder and files it creates; it cannot see or change anything else in that Drive.
• Where copies go. Copies are placed only in the connecting owner’s Google Drive, never in another Firm’s or in TaxPin’s own account. Once there, they are held by Google under that account and the Firm’s agreement with Google, and they are under the Firm’s control. Deleting a document in TaxPin does not delete a copy already backed up to Drive.
• Connection key. The key Google issues for the connection is stored encrypted, is used only to perform these backups, and is never shown to Firm staff or Clients.
• Turning it off. The owner can disconnect at any time in Settings, which revokes TaxPin’s access. Access can also be removed from the Google Account’s security settings.
• Google API Services User Data Policy. TaxPin’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to train AI models.

8. Retention

Documents are retained while your account is active so that you and your Firm can access prior-year records. Tax records are generally retained in accordance with IRS record-keeping guidance. When a Firm deletes a document, it goes to the Firm’s trash and can be restored for 30 days; after that it is permanently removed from storage. When a Firm permanently deletes a client, that client’s files are removed from storage at that time.

Backup copies (see Service Providers) are kept for about 60 days and then expire, so a permanently deleted file may remain in an encrypted backup for up to about 60 days after deletion. Backups are used only to restore the service after a failure and are not used to serve documents back to your Firm after deletion.

9. Your Choices

• You may view and update your name, contact email, and phone number in the portal settings.
• You may request account deletion or a copy of your data by contacting your Firm or info@apexpintax.com.
• Notification emails are transactional (not marketing) and are part of the service.

10. SMS / Text Message Notifications

If you provide a mobile phone number and opt in, your Firm may send you transactional SMS text messages through TaxPin — for example, when a document has been shared with you, when documents are requested, or when your uploads are received. You opt in by checking the SMS consent box on the invite-request form or in your account settings, and consent is not a condition of using the service.

• Message frequency varies based on your document activity.
• Message and data rates may apply.
• Reply STOP to any message to unsubscribe at any time. Reply HELP for help, or contact info@apexpintax.com or (617) 874-6753.
• We do not share your mobile phone number or your SMS opt-in consent with any third parties or affiliates for their own marketing or promotional purposes. Your mobile information is used only to deliver the notifications you requested and is shared only with our messaging provider (Twilio) strictly to transmit those messages.
• Carriers are not liable for delayed or undelivered messages.

11. GLBA Notice

Tax preparation firms are financial institutions under the Gramm-Leach-Bliley Act. TaxPin acts as a service provider that helps Firms meet their safeguarding obligations under the FTC Safeguards Rule and IRS Publication 4557. Your Firm remains responsible for its own privacy practices.

12. Children

TaxPin is not directed to children under 13, and we do not knowingly collect information from them.

13. Changes & Contact

We will post any changes to this policy on this page with an updated date. Questions: info@apexpintax.com · ApexPin Tax Service LLC.

This document is provided for general information and does not constitute legal advice.