Privacy Policy

This Privacy Policy describes how Tax Panic ("Tax Panic," "we," "us") collects, uses, and protects information when you use our website and mobile applications (collectively, the "Service").

1. Information we collect

Uploaded documents. When you scan an IRS notice, we receive the image or PDF you upload in order to analyze it. These documents may contain sensitive information, including your name, address, Social Security Number, Taxpayer Identification Number, and tax balances. We do not store the document on our servers. It is sent to our AI provider to generate your analysis and is not saved to your account or retained by us afterward; our staff cannot retrieve it. Handling during AI processing is covered in Section 3.

Analysis results. For anonymous scans, we do not save your results; they exist only on your device for that session. If you are a subscriber and choose to save a notice to your history, we store only a de-identified summary of the analysis (such as the notice code, urgency, tax year, an amount, and deadline dates). We do not store your Social Security or Taxpayer Identification Number, your name, or your address. Our analysis engine is instructed not to include those identifiers in its output, and we additionally filter them out before anything is saved.

Account information. If you create an account, we collect your email address and authentication credentials. We never store your password in plain text.

Usage data. We collect basic, non-document usage information (pages visited, features used, device type) to operate and improve the Service. We do not log the contents of your notices.

2. How we use information

We use your uploaded document solely, and momentarily, to generate the notice analysis you requested. We use account and usage information to operate, secure, and improve the Service. We do not sell, rent, or trade your personal information, and we do not use your documents to train artificial intelligence models.

3. AI processing

To read and explain your notice, the document is processed by Anthropic, our AI provider, acting on our behalf under a data-processing agreement. Anthropic does not use data submitted through Tax Panic to train its models, and your document is not shared with any other third party. We do not store the document on our own servers after the analysis is produced. Our provider's handling of data during processing is governed by our contract and technical configuration with that provider; we configure the service to minimize retention.

4. Data retention

The uploaded document is never retained. Anonymous scans store nothing on our servers. If you are a subscriber and save a notice, the de-identified summary described above is kept until you delete that notice or your account. You may delete your account and all associated data at any time from within the app or from your account on the web, or by emailing privacy@taxpanic.com.

5. Security

We use industry-standard security practices, including TLS 1.2 or higher in transit and AES-256 at rest, and we additionally encrypt the saved analysis summary. Because we do not store your document and do not store direct identifiers such as your Social Security Number, the information we hold is limited by design. No security system is perfect; you acknowledge this risk by using the Service.

6. California privacy rights (CCPA/CPRA)

Notice at collection. We collect the categories of personal information described in Section 1 (identifiers such as your email; internet/usage activity; and the document you upload, which is processed transiently and not retained) for the purposes described in Section 2 (providing your analysis and operating the Service). We do not sell or share your personal information, and we do not use it for cross-context behavioral advertising.

Sensitive personal information. An uploaded IRS notice can contain a Social Security Number, which is sensitive personal information. We process it only, and momentarily, to generate the analysis you requested, and we do not retain it. We do not use or disclose sensitive personal information for any purpose that would trigger the right to limit its use, and we honor requests to limit such use.

Your rights. California residents may request to know/access, delete, or correct their personal information, opt out of sale or sharing, limit the use of sensitive personal information, and not be discriminated against for exercising these rights. You may exercise these rights in the app (Account → Privacy & data), from your account on the web, or by emailing privacy@taxpanic.com. You may use an authorized agent to submit a request on your behalf, subject to verification.

7. EU and UK privacy rights (GDPR)

If you are in the EU or UK, our lawful bases for processing are: performance of the contract to provide the analysis you requested; our legitimate interests in securing and improving the Service, balanced against your rights; and consent where required. You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to lodge a complaint with your supervisory authority.

Your data is processed in the United States by our processors under appropriate safeguards, such as Standard Contractual Clauses and/or the EU-US Data Privacy Framework where available. We enter into data-processing agreements with our processors: Anthropic (AI processing), Supabase (database and authentication), Vercel (hosting), RevenueCat (subscriptions), and our email provider. Where required, we will appoint an EU/UK representative and a Data Protection Officer.

8. Automated processing and AI

Your notice is analyzed by an automated, AI-based system. This analysis is educational information, not a decision about you, and it does not produce legal or similarly significant effects on you: you decide what to do, we direct you to verify everything against your original letter, and we recommend a licensed professional for serious notices. Where applicable law gives you rights regarding automated decision-making, you may contact us to request human review or to object.

9. Other U.S. state rights and preference signals

Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others) may have rights to access, correct, delete, and obtain a copy of their personal data, to opt out of targeted advertising or sale, and to appeal a denied request. We honor these rights and provide an appeal process; to appeal, reply to our response or email us. We do not sell or share personal information or engage in targeted advertising, and we honor recognized opt-out preference signals such as Global Privacy Control.

10. Retention, requests, and breach notice

We retain personal information only as long as needed for the purposes described here: uploaded documents are not retained; anonymous scans are not retained; saved (de-identified) analysis is retained until you delete it or your account; account and billing records are retained as required for legal and financial purposes and then deleted. We verify rights requests before acting and respond within the timeframes required by law (generally 45 days under U.S. state laws, extendable, and one month under GDPR). We do not re-identify de-identified data. If a data breach affects your personal information, we will notify you and regulators as required by applicable law.

11. Children

Tax Panic is not directed to children under 13. We do not knowingly collect personal information from children under 13, and, for EU/UK users, not from children under the applicable age of digital consent.

12. Changes

We may update this policy. Material changes will be communicated via the Service or by email to account holders.

13. Contact

For privacy questions, contact privacy@taxpanic.com.