The Short Version
FinishTax is built with privacy as a priority. This policy explains what we collect, why, who we share it with, and the rights you have. We never sell your data or your clients' data, and we never use it for advertising.
Who We Are
FinishTax is a tax-practice-management platform operated by Oso Corp ("FinishTax," "we," "us"). For privacy questions or to exercise your rights, contact privacy@finish.tax. We will provide our registered business mailing address on request.
What We Collect
Website visitors (finish.tax): We use Google Analytics to understand site traffic. This sets analytics cookies and shares usage data (pages viewed, approximate location derived from your IP address, device and browser) with Google.
All plans, including free: Your working data (clients, tasks, checklists, settings, and any documents you upload) is stored in our encrypted cloud database and infrastructure — there is no local-only or offline mode. Creating an account requires an email address. To deliver the service, we collect and store:
- Account details — your name, email, password (stored hashed), and firm settings
- Client records you create — names, contact details, and, where you enter them, taxpayer identifiers including Social Security Numbers (SSNs), which are encrypted at rest
- Documents you or your clients upload — including tax documents such as W-2s and 1099s
- Identity-verification data — for e-signature identity proofing, a government photo ID and a selfie are processed by our verification provider (see "Identity Verification" below)
- Payment information — processed by Stripe; we never store full card numbers
- Communications — messages, emails, and SMS you send through the platform
- Usage and device data — log data needed to operate and secure the service
How We Use Your Data
- To provide and operate the FinishTax platform and client portal
- To process your payments and your clients' payments
- To verify signer identity for IRS Form 8879 and other e-signatures
- To send transactional email and SMS that you initiate or request
- To secure the service, prevent fraud, and meet legal obligations
We do not sell your data, use it for third-party advertising, or share your client data except with the subprocessors below who help us run the service.
Subprocessors
We share data with the following service providers strictly to operate FinishTax. Each is bound by contract to protect it:
- Supabase — managed PostgreSQL database and file storage (US)
- Cloudflare R2 — encrypted document and file storage
- Stripe — payment processing and firm-to-client billing
- Persona — identity verification (government ID + selfie) for e-signatures
- Twilio — SMS notifications you send to clients
- Anthropic (Claude) — AI document classification and assistant features
- Email delivery (Google Workspace / Resend) — transactional and account email
- Google Analytics — website traffic analytics
- Vercel — application hosting
- Geoapify — address suggestions: receives only the address text you type into an address field, never your name or account
Optional integrations you choose to connect (for example Gmail, Microsoft Outlook, Google Calendar, or QuickBooks Online) access only the data needed for that integration, and only after you authorize it.
Identity Verification & Biometric Data
When you or your client complete identity verification for an e-signature, our provider Persona collects a government-issued photo ID and a selfie to confirm identity at NIST IAL2. This may include biometric information. It is used only to verify identity for signing and is handled under Persona's privacy and retention policies. We do not use it for any other purpose.
Cookies & Analytics
Our website uses Google Analytics, which sets cookies (such as _ga) and collects usage data to help us understand traffic. Signed-in accounts also use a single httpOnly, Secure authentication cookie to keep you logged in; it cannot be read by JavaScript. We do not use advertising or cross-site tracking cookies. You can control analytics cookies through your browser settings.
Data Storage, Security & Retention
Cloud data is stored in US-based infrastructure built on SOC 2-compliant providers and is accessible only through your authenticated account. All data is encrypted in transit (TLS 1.2+). Social Security Numbers, IRS preparer credentials (EFIN/PTIN), and connected-account (OAuth) tokens are additionally encrypted by FinishTax with AES-256-GCM before they reach the database; other data, including uploaded documents, is encrypted at rest by our storage providers. Canceling a subscription does not delete your data — it downgrades your account, and your data is retained until you delete it yourself from Settings → Delete Account, or by emailing us to request deletion.
Backups. We take an encrypted backup of the database every night and immediately before any change to its structure. Each backup is encrypted immediately after it is read from the database and before it is written to storage, using a key that is never kept alongside the backups. Backups are stored separately from production and kept for 30 days. When you delete your account, your records are removed from the live database immediately and age out of backups within 30 days.
If something goes wrong. If we confirm a security incident that exposes your clients' personal information, we will tell you without undue delay and no later than 72 hours after confirming it, with what happened, what data was involved, and what we are doing about it, so you can meet your own notification duties under IRS Publication 4557 and the FTC Safeguards Rule.
Access records. Downloads of client files from the Documents area of the firm app and from the client portal, by you, your team, or the client, are written to the activity log on that client's record.
Your Privacy Rights
You can access, correct, export, or delete your data at any time in-app or by emailing privacy@finish.tax.
U.S. residents (including California / CPRA): You have the right to know what personal information we collect, to access and delete it, to correct it, and to opt out of any "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under the CPRA. SSNs are treated as sensitive personal information and used only to provide the service. We do not discriminate against you for exercising these rights, and you may use an authorized agent to make a request.
EEA / UK residents (GDPR): Where GDPR applies, our lawful bases are performance of a contract and our legitimate interests in operating and securing the service, which includes analytics. Browser "Do Not Track" signals are not honored by Google Analytics; to opt out, use the Google Analytics opt-out browser add-on or block requests to googletagmanager.com. You have rights of access, rectification, erasure, restriction, portability, and objection, and may lodge a complaint with your supervisory authority.
Children
FinishTax is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.
Changes to This Policy
If we make material changes, we will update the date above and notify account holders by email before the changes take effect.
Contact
Questions about this policy or your data? Email privacy@finish.tax.