Privacy Policy

The Short Version

FinishTax is built with privacy as a priority. This policy explains what we collect, why, who we share it with, and the rights you have. We never sell your data or your clients' data, and we never use your clients' data for advertising. The only advertising measurement we do is on our own marketing website (finish.tax), described under "Cookies, Analytics & Advertising" below; it never runs inside the app or the client portal.

Who We Are

FinishTax is a tax-practice-management platform operated by OSO Corp, doing business as FinishTax ("FinishTax," "we," "us"). For privacy questions or to exercise your rights, contact privacy@finish.tax. We will provide our registered business mailing address on request.

What We Collect

Website visitors (finish.tax): We use Google Analytics to understand site traffic. This sets analytics cookies and shares usage data (pages viewed, approximate location derived from your IP address, device and browser) with Google. When we run ads, our marketing pages also use the Meta Pixel, and we keep a first-party cookie recording which campaign brought you here (the utm_ tags and click identifiers in the link you arrived on, the page you landed on, and the site that referred you). See "Cookies, Analytics & Advertising" below for exactly what that involves and how to opt out.

All plans, including free: Your working data (clients, tasks, checklists, settings, and any documents you upload) is stored in our encrypted cloud database and infrastructure — there is no local-only or offline mode. Creating an account requires an email address. To deliver the service, we collect and store:

• Account details — your name, email, password (stored hashed), and firm settings
• Client records you create — names, contact details, and, where you enter them, taxpayer identifiers including Social Security Numbers (SSNs), which are encrypted at rest
• Documents you or your clients upload — including tax documents such as W-2s and 1099s
• Identity-verification data — for e-signature identity proofing, a government photo ID and a selfie are processed by our verification provider (see "Identity Verification" below)
• Payment information — processed by Stripe; we never store full card numbers
• Communications — messages, emails, and SMS you send through the platform
• Usage and device data — log data needed to operate and secure the service

In our iPhone and iPad apps: FinishTax (for preparers) and FinishTax Portal (for clients) work with the same account and the same data described above. They also handle the following:

• Camera and photos — used only when you choose to scan or attach a document. The image you pick is attached to the document, message or email you chose it for
• Face ID and Touch ID — when the app asks you to unlock it or to confirm an action, the check runs on your device through Apple's frameworks. We never receive your face or fingerprint data
• Push notifications — if you allow them, we store your device's push token so we can tell you about new messages and activity on your account. A notification's text can name a client or a firm
• Crash and error reports — when the app crashes or hits an error it sends a report to Sentry, and it also sends performance timings for a random 10% sample of app activity. The app removes request bodies, cookies and headers from error reports
• In-app subscriptions — preparers can subscribe through the App Store. Apple handles the payment and RevenueCat keeps track of the subscription for us; we never see your card details
• Invoice payments — in FinishTax Portal, card details are entered in Stripe's payment sheet and go directly to Stripe; we never see your full card number
• Sign-in — the apps keep your sign-in tokens in the device's secure storage (the iOS Keychain)

How We Use Your Data

• To provide and operate the FinishTax platform and client portal
• To process your payments and your clients' payments
• To verify signer identity for IRS Form 8879 and other e-signatures
• To send transactional email and SMS that you initiate or request
• To secure the service, prevent fraud, and meet legal obligations

We do not sell your data or use your clients' data for advertising, and we share your client data only with the subprocessors below who help us run the service. The one advertising use we make of your own data is measuring our ads, described under "Cookies, Analytics & Advertising".

Subprocessors

We share data with the following service providers strictly to operate FinishTax. Each is bound by contract to protect it:

• Supabase — managed PostgreSQL database and file storage (US)
• Cloudflare R2 — encrypted document and file storage
• Stripe — payments, and identity verification (government ID + selfie) for e-signatures
• Twilio — SMS notifications you send to clients
• Anthropic (Claude) — AI document classification and assistant features
• Email delivery (Google Workspace / Resend) — transactional and account email
• Google Analytics — website traffic analytics
• Vercel — application hosting
• Geoapify — address suggestions: receives only the address text you type into an address field, never your name or account
• Sentry — error and crash reports from our servers and our iPhone and iPad apps. A server report carries the request method and URL and your account ID; an app report carries the error, device and app details, and a random 10% sample of performance timings, with request bodies, cookies and headers removed
• Expo — relays push notifications to our iPhone and iPad apps and delivers app updates. For a notification it receives your device's push token and the notification's title and text, which can name a client or a firm
• RevenueCat — manages App Store subscriptions bought in the FinishTax preparer app. It receives your FinishTax account ID and Apple's record of the purchase, never your name or email
• Apple — distributes the apps through the App Store, takes payment for in-app subscriptions (Apple bills you; we never see your card details), and delivers push notifications through the Apple Push Notification service

Optional integrations you choose to connect (for example Gmail, Microsoft Outlook, Google Calendar, or QuickBooks Online) access only the data needed for that integration, and only after you authorize it. What we do with data from Gmail and Google Calendar is set out under "Google User Data" below.

Advertising partner. Meta (Facebook) is not a subprocessor: it does not help us run the service and never receives client or return data. It receives advertising-measurement data from our marketing pages and the signup events described under "Cookies, Analytics & Advertising", which is why it is listed there and in the CPRA "sharing" paragraph below rather than here.

Google User Data

FinishTax connects to your Google account only if you choose to connect a Gmail mailbox (Inbox Sync) or a Google Calendar. This section sets out exactly which Google data we access, why, and what happens to it. FinishTax's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Gmail. With your permission to read your email (gmail.readonly) and to send email for you (gmail.send), FinishTax:

• reads your Gmail address, to name the connected mailbox
• copies your recent Inbox and Sent messages into your FinishTax inbox: sender, recipients, CC, subject, date, the message text, Gmail's short preview, whether it has been read, and the name, type and size of each attachment. It matches each message to one of your clients by email address, so you can see which mail is from clients and which still needs a reply
• downloads an attachment only when you open it or choose "File to client", and keeps a copy only when you file it, as a document in that client's files
• sends the emails, replies and forwards you write in FinishTax, from your Gmail address, only when you send them

FinishTax never changes your Gmail mailbox. It does not delete, archive, label or mark anything there; marking a message read, starring it or archiving it in FinishTax changes only FinishTax's copy. Your synced mail is visible only to you in FinishTax, not to the rest of your team. An attachment you file to a client becomes one of that client's documents, visible to the people who can see that client.

Google Calendar. With your permission to view and edit events on your calendars (calendar.events) and to see your Google Account email address (openid, userinfo.email), FinishTax:

• records the Google Account email address the calendar belongs to, so that disconnecting never cuts off another FinishTax connection on the same account
• adds each appointment booked in FinishTax to your primary Google Calendar (its title, time, notes and the client's name, with the client's email address as an invited guest, so Google sends the client an invitation), and updates or removes the event when the appointment changes or is cancelled
• reads the events on your primary calendar for the dates you are viewing (title, description, time, location and status) to show them beside your FinishTax calendar. These are fetched each time you look and are not stored; FinishTax keeps only the IDs of the events it created

How we use it. We use Google user data only to provide and improve these features, which you can see and use in FinishTax. We never sell it, never use it or transfer it for advertising, including retargeting, personalized or interest-based ads, never use it to determine creditworthiness or for lending, and never use it to develop, improve or train generalized AI or machine-learning models.

Who receives it. We transfer Google user data only as needed to provide these features, to comply with the law, for security purposes, or as part of a merger, acquisition or sale of our business, and then only with your explicit consent first. It is stored by the subprocessors that host FinishTax (Supabase, Cloudflare R2 for filed attachments, and Vercel). When new client mail arrives, FinishTax notifies you in the app and, if you allow push notifications, on your iPhone or iPad through Expo and Apple; that notification names only the mailbox, never the sender or subject. Google user data reaches an AI service in one case only. We do not send your Gmail messages or your Google Calendar events to any AI service. An email attachment you file to a client becomes that client's document and is handled like any document you upload: if you click Classify on it or include it in a batch classification, its contents are sent to Anthropic, our AI subprocessor, to classify it for you. When you use the AI assistant features (search, task suggestions, intake review, insights and the anomaly scan), what they send Anthropic about your documents can include the attachment's file name and file type and what an earlier classification found in it: its document type, summary, key details (such as the amounts and names it read) and tax year. The daily triage agent never sees a filed email attachment. Anthropic processes this under its commercial terms.

Who can read it. No one at FinishTax reads your Google user data unless you ask us to for a specific support request and agree to it, it is needed for security purposes such as investigating abuse, or the law requires it. Our own operational metrics use counts, never message content, and FinishTax staff cannot query synced mail from our internal tools or open it while signed in to your account for support. Direct access to the production database is limited to engineers doing maintenance.

Security and deletion. Google access and refresh tokens are encrypted by FinishTax with AES-256-GCM before they reach the database, and all data travels over TLS. Disconnecting a mailbox in FinishTax deletes its access tokens and every message synced from it; disconnecting Google Calendar deletes its tokens (events FinishTax added stay in your calendar until you remove them). Either way FinishTax also asks Google to revoke its access, unless another FinishTax connection still uses the same Google access (for example, your firm's Google Calendar and a teammate's Gmail on one Google account); then that access stays until the last of those connections is disconnected. Attachments you filed stay in the client's files until you delete them. You can also remove FinishTax's access at any time from your Google Account's third-party connections page. Deleting your FinishTax account deletes all of it.

Identity Verification & Biometric Data

When a signer completes identity verification for an e-signature, our provider Stripe (Stripe Identity) collects a photo of a government-issued ID and a live selfie and compares them. This involves biometric information, which Stripe processes under its own privacy policy and retention terms. FinishTax keeps only the result, a session reference and the first and last name on the ID, in the envelope's history. We never receive or store the ID images or selfie, and we use none of it for any other purpose.

Cookies, Analytics & Advertising

Our website uses Google Analytics, which sets cookies (such as _ga) and collects usage data to help us understand traffic. Signed-in accounts also use a single httpOnly, Secure authentication cookie to keep you logged in; it cannot be read by JavaScript. You can control analytics cookies through your browser settings.

Meta Pixel — marketing pages only. To measure our own advertising, the public marketing pages on finish.tax (the home page, pricing, blog, and similar pages) load the Meta Pixel. It sends Meta the page you viewed, your IP address and browser details, and sets Meta's _fbp and _fbc cookies so Meta can tell which ad led to a visit or a signup. The Pixel never loads inside the FinishTax app, the client portal, firm websites, or any page that handles your clients' information, and it is only active while we are running ads.

Campaign attribution cookie. Our marketing pages set a first-party cookie, ftx_attr (90 days), holding the campaign tags and click identifiers from the link you arrived on, the page you landed on, and the site that referred you. If you later create a firm account we store that record with the account so we know which campaign it came from. It never contains your IP address.

What Meta receives. When you submit one of the interest forms on our marketing pages (the founding-firm or free-trial forms), our server tells Meta a lead happened, using a one-way hash (SHA-256) of the email you entered together with your IP address, your browser's user-agent string, and the identifiers from the cookies above. When a firm owner then verifies their email, our server reports that signup the same way (hashed email, IP address, user agent, cookie identifiers); when they start a trial or make a first payment, it reports that with the hashed email and cookie identifiers only. This is always a business user's email, never a taxpayer's. We do not send names, client records, documents, or any tax information.

Opting out. We honor the Global Privacy Control (GPC) signal: if your browser sends it, the Meta Pixel does not load at all. You can also block requests to connect.facebook.net or clear the cookies above at any time. Neither affects your use of the app.

Opt out of sharing. To opt out of this advertising data being shared with Meta, turn on Global Privacy Control in your browser (we honor it automatically) or email privacy@finish.tax and we will handle it for you.

Data Storage, Security & Retention

Cloud data is stored in US-based infrastructure built on SOC 2-compliant providers and is accessible only through your authenticated account. All data is encrypted in transit (TLS 1.2+). Social Security Numbers, IRS preparer credentials (EFIN/PTIN), and connected-account (OAuth) tokens are additionally encrypted by FinishTax with AES-256-GCM before they reach the database; other data, including uploaded documents, is encrypted at rest by our storage providers. Canceling a subscription does not delete your data — it downgrades your account, and your data is retained until you delete it yourself (Settings → Your data → Reset or close your account → Delete account on the web, or More → Settings → Your data → Reset or close your account → Delete account in the FinishTax app; team members: More → Settings → Delete account), or by emailing us to request deletion. Deleting your account doesn't cancel a subscription bought in the app on iPhone or iPad — cancel it first in Settings → your name → Subscriptions.

Backups. We take an encrypted backup of the database every night and immediately before any change to its structure. Each backup is encrypted immediately after it is read from the database and before it is written to storage, using a key that is never kept alongside the backups. Backups are stored separately from production and kept for 30 days. When you delete your account, your records are removed from the live database immediately and age out of backups within 30 days.

If something goes wrong. If we confirm a security incident that exposes your clients' personal information, we will tell you without undue delay and no later than 72 hours after confirming it, with what happened, what data was involved, and what we are doing about it, so you can meet your own notification duties under IRS Publication 4557 and the FTC Safeguards Rule.

Access records. Downloads of client files from the Documents area of the firm app and from the client portal, by you, your team, or the client, are written to the activity log on that client's record.

Your Privacy Rights

You can access, correct, export, or delete your data at any time in-app or by emailing privacy@finish.tax.

U.S. residents (including California / CPRA): You have the right to know what personal information we collect, to access and delete it, to correct it, and to opt out of any "sale" or "sharing" of personal information. We do not sell personal information. Sending marketing-page activity, the hashed email from our interest forms, and signup events to Meta for advertising measurement (see "Cookies, Analytics & Advertising") may count as "sharing" under the CPRA; we honor the Global Privacy Control signal as your opt-out, and you may also email privacy@finish.tax. Your clients' data is never sold or shared for advertising. SSNs are treated as sensitive personal information and used only to provide the service. We do not discriminate against you for exercising these rights, and you may use an authorized agent to make a request.

EEA / UK residents (GDPR): Where GDPR applies, our lawful bases are performance of a contract and our legitimate interests in operating, securing and marketing the service, which includes analytics and advertising measurement on our marketing pages. Browser "Do Not Track" signals are not honored by Google Analytics; to opt out of it, use the Google Analytics opt-out browser add-on or block requests to googletagmanager.com. The Global Privacy Control signal is honored for the Meta Pixel. You have rights of access, rectification, erasure, restriction, portability, and objection, and may lodge a complaint with your supervisory authority.

Children

FinishTax is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.

Changes to This Policy

If we make material changes, we will update the date above and notify account holders by email before the changes take effect.

Contact

Questions about this policy or your data? Email privacy@finish.tax.