Privacy Policy

CitaxPro, Inc. (“CitaxPro,” “we,” or “us”) operates the citaxpro.com platform. This Privacy Policy describes how we collect, use, and protect information when you use our Service.

1. Information We Collect

We collect the following categories of information:

• Account information — name, email address, firm name, and role when you register.
• Client data — tax documents, financial figures, and related information you upload on behalf of your clients.
• Usage data — pages visited, features used, and actions taken within the platform, collected via server logs and analytics.
• Payment information — billing details processed by our payment processor (Stripe). We do not store full card numbers.

2. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Service
• Process subscription billing and send invoices
• Send product updates, security notices, and support responses
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

We do not use your client data to train machine learning models without your explicit written consent. We do not sell your data to third parties.

3. Data Storage and Security

Your data is stored on infrastructure hosted in the United States (AWS us-west-1). All data is encrypted in transit using TLS 1.2+ and encrypted at rest. Access to production data is restricted to authorized CitaxPro personnel and is logged.

4. Data Sharing

We share data only with:

• Infrastructure providers — Supabase (database and auth), AWS (storage), and Railway (hosting), bound by data processing agreements.
• Payment processor — Stripe, for billing only.
• AI providers — Anthropic and OpenAI process document content solely to extract tax fields when you use PDF import. Data is not retained by these providers for training.
• Law enforcement — only when required by valid legal process, and we will notify you when legally permitted to do so.

5. Data Retention

We retain your account and client data for as long as your subscription is active. After termination, data is retained for 30 days to allow export, then permanently deleted. Audit logs are retained for 7 years to support professional liability requirements.

6. Your Rights

You may request access to, correction of, or deletion of your personal data at any time by emailing privacy@citaxpro.com. We will respond within 30 days. Firm administrators can delete client records directly from the platform.

7. Cookies

We use session cookies strictly necessary to keep you logged in. We do not use advertising cookies or third-party tracking pixels.

8. CCPA / California Residents

California residents have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact privacy@citaxpro.com.

9. Changes to This Policy

We will notify you of material changes to this policy by email at least 14 days before they take effect. The date at the top of this page reflects the most recent update.

Contact

Privacy questions or requests may be directed to privacy@citaxpro.com.