Privacy Notice

Intaxion collects the following information to support your preparer's tax intake workflow:

• Personal information: full name, date of birth, email address, phone number, home address, and occupation

• Tax identification status: the structured intake asks whether you have an SSN or ITIN; it does not ask you to enter the full number

• Uploaded documents: tax or identity documents you choose to upload may contain a full SSN, ITIN, or other sensitive identifier

• Optional client-list import: if your preparer's workspace has CSV import enabled, the preparer may import a full SSN; imported SSNs are stored with field-level encryption, and routine client exports show only the last four digits

• Financial information: income sources, expense details, life events, filing status, and household composition

• Tax documents: PDFs, images, and other supporting documents you upload

• Communication records: emails and notes exchanged with your tax preparer

We use the information you provide for the following purposes:

• To help your preparer organize the intake information and documents used in their tax-preparation workflow

• To support communication with your preparer about that workflow

• To maintain a secure record of your submissions and correspondence

• To generate AI-assisted document summaries to help your preparer review materials more efficiently

• To support recordkeeping and security obligations that apply to the service and your preparer's workflow

When AI processing is enabled and the taxpayer accepts the disclosure consent, documents are processed using AWS Textract, a secure optical character recognition (OCR) service. Documents are scanned to extract text for use by your preparer.

The extracted text is then masked to remove high-risk identifiers including Social Security Numbers, Employer Identification Numbers, card numbers, and account numbers. After masking, the text is sent to OpenAI for AI-powered summarization to help your preparer understand document contents more efficiently.

Workspace owners can disable AI processing in their workspace settings. If AI processing is disabled, documents are not sent to AWS Textract or OpenAI. When it is enabled with taxpayer consent, AWS Textract receives the document for OCR and OpenAI receives masked OCR text for summarization; that text may still contain names, addresses, dates, employer names, dollar amounts, and other taxpayer context.

AI processing requires both workspace opt-in and the taxpayer's disclosure consent.

Your information may be processed by the following parties as needed to provide the service:

• Your assigned tax preparer and their staff (within your workspace)

• AWS Textract (for secure document OCR processing)

• OpenAI (for masked summary generation only; high-risk identifiers are masked before transmission)

• Supabase (for encrypted database storage and secure authentication)

• Vercel (for hosting and delivering the Intaxion application)

• Resend (for transactional notifications that do not include client tax data)

• Cloudflare R2 (for an off-provider backup replica of uploaded documents)

Intaxion does not sell client data or disclose it for third-party marketing.

Retention depends on the record category and your preparer's workspace policy. Active engagement data is kept for the engagement and the office-selected retention period. Records that federal rules require the preparer to keep, including certain consent and due-diligence records, remain for the required period. A workspace owner may request client-data deletion, subject to those retention duties and documented deletion procedures.

You have the right to:

• Request access to your personal information and submitted documents

• Request correction of inaccurate information

• Request deletion of your data (subject to IRS record retention requirements and preparer authorization)

To exercise these rights, contact your tax preparer or email us at support@intaxion.com.

Intaxion protects stored records and files with Supabase encryption at rest, HTTPS/TLS in transit, workspace access controls, multi-factor authentication for preparer users, and signed time-limited file links. The structured intake does not store full SSNs or ITINs in answer fields. Uploaded documents may contain those identifiers. Full SSNs imported through the optional workspace CSV feature are stored with PostgreSQL pgcrypto field-level encryption, and routine client exports show the last four digits. Access is limited to authorized users within the preparer's workspace and authorized Intaxion administrators performing platform duties.

If you have questions about this Privacy Notice or your data, please contact us at:

Email: support@intaxion.com