The Short Version
FinishTax is built with privacy as a priority. This policy explains what we collect, why, who we share it with, and the rights you have. We never sell your data or your clients' data, and we never use it for advertising.
Who We Are
FinishTax is a tax-practice-management platform operated by Oso Corp ("FinishTax," "we," "us"). For privacy questions or to exercise your rights, contact privacy@finish.tax. We will provide our registered business mailing address on request.
What We Collect
Website visitors (finish.tax): We use Google Analytics to understand site traffic. This sets analytics cookies and shares usage data (pages viewed, approximate location derived from your IP address, device and browser) with Google.
Free plan (in-browser): On the free plan, your working data (clients, tasks, checklists, settings) is stored in your browser's localStorage and is not transmitted to our servers. If you create an account, we store your email.
Paid plans & client portal: To deliver the service we collect and store:
- Account details — your name, email, password (stored hashed), and firm settings
- Client records you create — names, contact details, and, where you enter them, taxpayer identifiers including Social Security Numbers (SSNs), which are encrypted at rest
- Documents you or your clients upload — including tax documents such as W-2s and 1099s
- Identity-verification data — for e-signature identity proofing, a government photo ID and a selfie are processed by our verification provider (see "Identity Verification" below)
- Payment information — processed by Stripe; we never store full card numbers
- Communications — messages, emails, and SMS you send through the platform
- Usage and device data — log data needed to operate and secure the service
How We Use Your Data
- To provide and operate the FinishTax platform and client portal
- To process your payments and your clients' payments
- To verify signer identity for IRS Form 8879 and other e-signatures
- To send transactional email and SMS that you initiate or request
- To secure the service, prevent fraud, and meet legal obligations
We do not sell your data, use it for third-party advertising, or share your client data except with the subprocessors below who help us run the service.
Subprocessors
We share data with the following service providers strictly to operate FinishTax. Each is bound by contract to protect it:
- Supabase — managed PostgreSQL database and file storage (US)
- Cloudflare R2 — encrypted document and file storage
- Stripe — payment processing and firm-to-client billing
- Persona — identity verification (government ID + selfie) for e-signatures
- Twilio — SMS notifications you send to clients
- Anthropic (Claude) — AI document classification and assistant features
- Email delivery (Google Workspace / Resend) — transactional and account email
- Google Analytics — website traffic analytics
- Vercel — application hosting
Optional integrations you choose to connect (for example Gmail, Microsoft Outlook, Google Calendar, or QuickBooks Online) access only the data needed for that integration, and only after you authorize it.
Identity Verification & Biometric Data
When you or your client complete identity verification for an e-signature, our provider Persona collects a government-issued photo ID and a selfie to confirm identity at NIST IAL2. This may include biometric information. It is used only to verify identity for signing and is handled under Persona's privacy and retention policies. We do not use it for any other purpose.
Cookies & Analytics
Our website uses Google Analytics, which sets cookies (such as _ga) and collects usage data to help us understand traffic. Paid plans also use a single httpOnly, Secure authentication cookie to keep you logged in; it cannot be read by JavaScript. We do not use advertising or cross-site tracking cookies. You can control analytics cookies through your browser settings.
Data Storage, Security & Retention
Cloud data is stored in US-based infrastructure built on SOC 2-compliant providers. All data is encrypted at rest (AES-256) and in transit (TLS 1.2+), and is accessible only through your authenticated account. We retain account data for the life of your account and for up to 90 days after cancellation, after which it is permanently deleted — unless a longer period is required by law (for example, tax or payment records). You can request earlier deletion at any time.
Your Privacy Rights
You can access, correct, export, or delete your data at any time in-app or by emailing privacy@finish.tax.
U.S. residents (including California / CPRA): You have the right to know what personal information we collect, to access and delete it, to correct it, and to opt out of any "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under the CPRA. SSNs are treated as sensitive personal information and used only to provide the service. We do not discriminate against you for exercising these rights, and you may use an authorized agent to make a request.
EEA / UK residents (GDPR): Where GDPR applies, our lawful bases are performance of a contract, your consent (for example, analytics), and our legitimate interests in operating and securing the service. You have rights of access, rectification, erasure, restriction, portability, and objection, and may lodge a complaint with your supervisory authority.
Children
FinishTax is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.
Changes to This Policy
If we make material changes, we will update the date above and notify account holders by email before the changes take effect.
Contact
Questions about this policy or your data? Email privacy@finish.tax.