Privacy Policy

Information We Collect

From practices

• Account information: your name, practice name, the CPA name shown to clients, and your email address
• Practice settings: calls to action, scheduling or contact links, email delivery preferences, page color, logo, footer text and links, and retention settings
• Billing information: your plan and billing status. Payments are processed by Stripe; we do not store your full card details
• Communications: messages you send us

From clients, on a practice's behalf

• Sign-in information: the client's email address on the practice's permitted list, and a one-time passcode that expires
• The acknowledgment: that the client accepted the disclaimers, and when
• Chat content: the questions a client types, the AI's answers, the session summary, any note the client leaves, the calls to action they choose, and their rating
• Client notes the practice adds for context
• Files shared in private client folders, their filenames, sizes, types, upload dates and security-check metadata
• An optional client phone number the practice stores for reference; it is not used for AI text messaging

The chat blocks Social Security numbers, ITINs, and account numbers before a message is sent, and asks clients not to share personal tax information. Clients may still type financial details despite that request.

Collected automatically

• Technical data: IP address, browser type, and device information, used for security and rate limiting. We store email addresses and IP addresses used for rate limiting only as keyed hashes
• Cookies: we use cookies that keep you signed in. A practice can let its clients' devices stay signed in for 30 days. We do not use advertising cookies

The scripted demo on askabout.tax runs in your browser. It makes no AI model calls and does not send your demo activity to us.

How We Use Information

• Provide the Service: sign people in, answer clients within the practice's rules and sources, create session summaries, and show them to the practice
• Send service emails: sign-in codes, client invitations requested by the practice, optional chat summary notices or weekly digests (with no chat content), plan and billing notices, and deletion notices
• Keep an audit trail of every answer, the model that gave it, the rules in effect, and the sources used
• Manage subscriptions and token limits, and measure usage
• Detect and prevent fraud, abuse, and security incidents, including rate limiting
• Comply with legal obligations

We do not sell personal information, and we do not use practices' data or clients' conversations to train AI models.

Private Files

Files are stored in an authenticated private practice/client destination for the client and authorized practice members. Uploaded files stay in quarantine until format checks and a trusted malware verdict allow them to become ready. Files, filenames and metadata are not automatically sent to AI models, processed with OCR or added to assistant knowledge.

Clients and authorized practice members can download or delete their files. Shared practice storage is separate from AI capacity; when storage is full new uploads pause, while existing access and deletion remain available.

Subprocessors

We share information with these service providers only as needed to run the Service:

• Amazon Web Services (AWS): hosting, databases, private file storage and malware scanning, in the United States
• Amazon Bedrock (AWS), running AI models from Anthropic and OpenAI: generates the chat's answers and the session summaries. Requests are processed in AWS regions in the United States. Under the terms we use Bedrock on, prompts and answers are not used to train the models and are not shared with the model providers
• Stripe: subscription payments for practices
• Resend: delivery of sign-in codes and notification emails

We may also disclose information when the law requires it, to protect the rights and safety of our users or others, in connection with a merger, acquisition, or sale of assets, or with your consent.

Data Retention

• Shared files, transcripts, summaries, and client notes are deleted automatically 3 years after the client's most recent chat or successful file sharing by default. The practice can shorten that period, or extend it with a reason, such as a state board retention rule
• The practice gets a notice 30 days before automatic client deletion, and can delete one session, one client, or all of its data at any time
• A deletion log records what was deleted and when, with no client content
• Practice account information is kept while the account is open. An inactive account may be deleted as described in the Terms of Service, after a 30-day notice

We keep records we are required to keep by law, such as billing records, for as long as the law requires.

Security

• Encryption of data in transit and at rest
• One-time passcode sign-in for practices and clients, with no passwords to steal
• Rate limiting on sign-in and chat
• Notification emails that contain no client content
• Blocking of Social Security numbers, ITINs, and account numbers before they reach any AI model
• Separation of each practice's data from every other practice's

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your Rights and Choices

• Access: ask for a copy of your personal information
• Correction: update inaccurate or incomplete information
• Deletion: ask us to delete your account and data
• Export: get a copy of your practice's transcripts and summaries

If you are a client of a practice, contact that practice about your information; it decides what happens to it. If you contact us instead, we will pass your request to the practice and help it respond.

To exercise these rights, email privacy@kiwibooks.ai.

California Residents (CCPA/CPRA)

• Right to know what personal information is collected, used, and disclosed
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of personal information. We do not sell or share personal information
• Right to non-discrimination for exercising these rights

For client information, we act as the practice's service provider, and requests are handled with the practice.

EEA and UK Residents (GDPR)

AskAboutTax is offered to practices in the United States. Where the GDPR applies, we process information on these bases:

• Contract: to provide the Service you signed up for
• Legitimate interests: to secure, operate, and improve the Service
• Legal obligation: to meet legal and regulatory requirements
• Consent: where we ask for it

You may also have the rights to restrict or object to processing, to withdraw consent, and to complain to a supervisory authority. Information is processed in the United States; for transfers from the EEA or UK we use appropriate safeguards, such as Standard Contractual Clauses.

Email and CAN-SPAM

Most emails we send are service messages that you need to use the Service: sign-in codes, summary notices, and plan, billing, and deletion notices. If we send marketing emails, we do so in compliance with the CAN-SPAM Act of 2003 (15 U.S.C. § 7701 et seq.): they identify us as the sender, have accurate subject lines, include our postal address, and include an unsubscribe link.

You can opt out of marketing emails at any time with the unsubscribe link, or by emailing contact@kiwibooks.ai with "Unsubscribe" in the subject line. We process opt-outs within 10 business days. We do not sell, rent, or transfer your email address to third parties for their own marketing.

Children's Privacy

The Service is not intended for anyone under 18. We do not knowingly collect personal information from children. If we learn that we have, we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy. We will tell practices about material changes by email or in the Service before they take effect, and show the date of the latest change at the top of this page.

Contact

For questions about this Privacy Policy or your information: