Privacy Policy

1. Information we collect

Account information. Your name, email address and a hashed password, or the identity your sign-in provider (Google, GitHub or Microsoft) shares with us. We also record whether your email address has been verified.

Organization information. The name of each set of books you create, the people you invite to it and their roles (owner, member or viewer).

Financial data you provide. Bank and credit card statements you upload (CSV, OFX, QFX, MT940 or BAI2), the transactions in them, the categories, notes and rules you apply, receipts and bills you upload, invoices you create, and the customer and vendor records attached to them.

Bank connections. If you link an account through Teller, you sign in to your bank inside Teller Connect. Your bank username and password never reach Taxee. Teller gives us a read-only access token, which we store encrypted and use only to fetch account details, balances and transactions. The connection cannot move money.

Billing information.Payments are processed by Stripe. We store your Stripe customer identifier, the plan you are on and its status. Card numbers are entered on Stripe’s pages and never touch our servers.

Messages to the assistant.Questions you type to the Taxee assistant, any images you attach, and the assistant’s replies are stored with your organization so the conversation can continue.

Technical data. Our servers log the IP address, browser type, time and path of each request, and errors, for security and troubleshooting. We do not use advertising or analytics trackers on the Service.

2. How we use it

• To provide the Service: import and categorize transactions, detect transfers and anomalies, build reports, generate invoices and bills, run the period-close workflow and produce your accountant package.
• To run AI features: categorization suggestions, receipt and bill extraction, narratives and the assistant. See section 4 for how AI processing works.
• To operate your account: verify your email, reset passwords, send invitations and invoice emails, bill your subscription and measure usage against the limits of your plan (for example the number of assistant questions in a month).
• To keep the Service secure: rate limiting, abuse detection, and an audit history of who changed what in your books.
• To support you when you contact us and to notify you about changes that affect your account.

We do not sell personal information and we do not use your financial data for advertising.

Where data protection law requires a legal basis, we rely on the performance of our contract with you (providing the Service), our legitimate interests in keeping the Service secure and improving it, compliance with legal obligations such as tax and accounting records, and your consent where you connect a bank or sign in with a provider.

3. Who can see your data inside the Service

Data belongs to an organization (a set of books). Owners and members of that organization can see and edit it; viewers, such as the CPA you invite, can read it and download exports but cannot change it. Your name and email address are visible to the other members of any organization you belong to. Each organization is isolated from every other organization on the Service.

4. AI processing

To categorize transactions, read receipts and bills, write narratives and answer assistant questions, we send the relevant text and images to Anthropic, our AI provider, through its API. That includes transaction descriptions, merchant names, amounts, dates and category names, receipt and bill images, your assistant messages, and, when the assistant looks something up for you, the records it reads from your books, such as invoices, bills, customers and vendors. Summary statistics of your bank feed activity are used to write the daily digest.

Anthropic processes this data under its commercial terms, which do not allow it to train models on the data; it may retain the data for a limited period to enforce its usage policies. AI output is a suggestion: every categorization it proposes is marked as such until a person in your organization approves it, any change the assistant proposes runs only after you confirm it, and you remain responsible for reviewing your books.

5. Service providers we share data with

We share data only with providers that help us run the Service, and only what each one needs:

• Stripe for subscription billing (your email, plan and the payment details you enter on Stripe).
• Teller for bank connections (your bank login happens on Teller; we receive account and transaction data).
• Anthropic for AI features (section 4).
• Our email provider for transactional email: verification, password reset, invitations and invoices you choose to send.
• Google, GitHub and Microsoft when you choose to sign in with them (we receive your name, email and a provider identifier).
• Public government data sources (the U.S. General Services Administration per-diem API and the Federal Register) when the assistant looks up rates or notices; no personal data is sent to them.

We may also disclose information when the law requires it, to protect the rights and safety of our users or the public, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to your data.

6. Cookies and browser storage

The application uses one strictly necessary cookie that keeps you signed in; it is HttpOnly and is only sent to our API. During sign-in with Google, GitHub or Microsoft a second short-lived cookie protects the sign-in from forgery and is removed when it completes. Your browser’s local storage remembers preferences such as dark mode, the organization you last viewed and which tips you have dismissed. There are no advertising, analytics or third-party tracking cookies.

7. Where data is stored and how we protect it

The Service runs on servers we operate in the United States, and our service providers also process data in the United States. If you use the Service from elsewhere, your data is transferred to and processed in the United States, where privacy laws may differ from those of your country. Every connection to the Service, including bank feeds and email, is encrypted in transit with TLS. Passwords are stored as salted hashes, bank access tokens are encrypted at rest, and access to production systems is limited to the people who operate the Service. Roles are enforced by the API, not just the interface. No system is perfectly secure; if we learn of a breach that affects your data we will notify you as the law requires.

8. Retention and deletion

We keep your data for as long as your account and organizations exist so that your books stay complete. You can export everything at any time through the accountant package and transaction exports. We do not yet offer self-service deletion: to delete an organization or your account, email hello@taxee.ai from the address on the account. We delete the data within 30 days, except billing records we are required to keep and information needed to resolve a dispute or enforce our terms. Server logs are kept for a limited period for security purposes and then discarded.

9. Your rights and choices

You can access and correct your account information in Settings, export your financial data at any time, and ask us to delete it. If you are in the European Economic Area, the United Kingdom or another region with data protection laws, you also have rights to restrict or object to processing and to data portability, and you may lodge a complaint with your local supervisory authority. If you are a California resident, you have the right to know what personal information we collect and to request its deletion; we do not sell or share personal information for cross-context behavioural advertising, and we will not treat you differently for exercising your rights. To exercise any right, email hello@taxee.ai. We will verify the request using the account email address and respond within the time the applicable law allows.

10. Data you upload about other people

Your books may contain information about your customers, vendors, employees or, if you are an accountant, your clients. You are responsible for having the right to upload that information and for telling those people how it is used where the law requires. We process it only to provide the Service to you and on your instructions, and we will assist with requests from those people that the law requires you to honour.

11. Children

The Service is for businesses and the professionals who serve them. It is not directed at anyone under 18, and we do not knowingly collect information from children.

12. Changes to this policy

When we change this policy we will update the effective date above. If a change materially affects how we use your data, we will email the address on your account before it takes effect.

13. Contact

Novaluna LLC, Plainsboro, New Jersey, United States. Email hello@taxee.ai for privacy questions or requests.