TaxOrch privacy policy

What this covers#

This describes what happens to data in the TaxOrch product and on this website. Everything below is a description of behaviour that is implemented, not of behaviour that is planned. Where something is not yet decided, it says so.

Who is responsible for it#

TaxOrch is the controller of the personal data described here, except where this policy says otherwise. The registered company details and the address for written correspondence are published at the foot of the terms of service.

For the tax data your organisation puts into the product, the roles are the other way round: you are the controller and TaxOrch is the processor, acting on your instructions. The data processing agreement is where those terms sit.

Paddle is a separate controller for payment and billing data. Paddle is the merchant of record for every purchase, and it collects your payment details, your billing address and the tax status of the transaction directly. No card number ever reaches TaxOrch. What we receive from Paddle is which plan was bought, when, the amount, the country used for tax, and whether the payment succeeded. Paddle's handling of it is governed by Paddle's privacy notice.

For anything about your own personal data, write to privacy@taxorch.com.

Why we are allowed to process it#

Where data protection law requires a lawful basis, these are the ones relied on:

• To perform our contract with you - running the product, computing answers, keeping your account, taking payment, providing support.
• Your consent - analytics on this website, and any opt-in to using tenant data for training. Consent can be withdrawn at any time, and withdrawing it stops the processing rather than the next page from starting it.
• Our legitimate interests - keeping the service secure, preventing abuse, and maintaining the audit trail. Weighed against your interests, and limited to what the security section below describes.
• A legal obligation - retaining records where a tax or accounting rule requires it, and responding to a lawful request.

We do not rely on legitimate interests for anything a reader would be surprised by, and there is no processing here for advertising, for profiling, or for automated decisions with a legal effect on you.

What is processed#

On this website#

Nothing that observes you runs before you agree to it. Until you make a choice, the only things stored in your browser are the ones the site cannot work without:

• Your consent decision, so you are not asked on every page. It records which version of this policy you were shown.
• Your theme and motion preferences, so the site does not change appearance or start animating between pages.
• A dismissal record, if you close a prompt, so it is not shown again during the same visit. It is cleared when you close the tab.

None of these leaves your browser and none identifies you. The consent record and your preferences are kept for twelve months, after which you are asked again; the dismissal record is cleared when you close the tab. The full list, with what each one stores, is in the cookie policy.

If you consent to analytics, the site reports which pages and sections were read, which actions were pressed, and how forms progressed — as event names and categories. Form field contents are never included, and there is no property in the event model capable of carrying one.

If you write to us through a form, we process what you typed in order to reply to it: your name, your address, and whatever you wrote.

In the product#

• Tax documents and the figures extracted from them, in order to compute and cite an answer.
• Entity, filing and jurisdiction data, in order to select the right calculator and the right law.
• Questions asked and answers produced, with the corpus release, model version and calculator version behind each one, so an answer can be reproduced later.
• An audit trail of who did what, including access to sensitive documents and every deletion.
• Account and subscription records - who is on the account, which plan it is on, what was charged and when. The payment itself is handled by Paddle, as set out above.

What is never done with it#

Tenant data is never used for training without an explicit opt-in, and the opt-out is on by default. The safe setting is the one you get without asking for it.

Where a dataset is built for training, deterministic redaction runs on every piece of text entering it, ordered most-specific-first, and rows that are unknown, restricted, licence-missing or PII-heavy are blocked outright.

Raw document contents, sensitive figures and conversation content are never written to logs. Taxpayer identifiers are redacted from prompts and from support surfaces before anyone or anything sees them, and bookkeeper message content is not visible in the administrative interface either.

How it is protected#

• Encryption at rest for sensitive extracts. Full national identifiers and bookkeeper conversation content are encrypted; stored display fields keep only masked values.
• Structural tenant isolation. Every tenant-owned record inherits a workspace- and site-scoped base, and queries always filter by tenant. It is a property of the data model rather than a rule the application remembers.
• Hash-chained audit entries, per tenant, with a command that validates the whole chain — so tampering with the record is detectable rather than merely discouraged.
• Role-based access, including a read-only auditor role, so somebody can verify the record without being able to change it.

How long it is kept#

Retention is configurable, with a seven-year default for tax documents, which reflects the period a tax record is typically required to be retained rather than a period chosen for convenience.

A retention-eligibility report lists what is due for removal, so deletion is something that happens on a schedule rather than when somebody remembers.

A legal hold flag blocks deletion for records under dispute or audit, overriding the retention schedule. A record under hold is not deleted by the retention process and cannot be deleted by a request.

Your data, on the way out#

• Export. A per-tenant privacy export produces all of your tax data. Privacy requests are modelled and tracked to completion rather than handled ad hoc.
• Deletion. An explicit, audit-logged deletion path — not a support ticket and not a flag that hides a record while keeping it.
• No third-party AI. The AI models run on TaxOrch's own servers, so your tax data is never sent to an outside model provider.

Sub-processors#

AI models run on TaxOrch's own servers: there is no third-party AI provider in the request path, so your questions and documents are not sent to one.

A change to this list is published here before it takes effect.

Where it goes#

There is no third-party model in the request path, so there is nothing for your data to be sent to.

The hosting region is agreed before any customer data is carried, and the regions and sub-processors are recorded in the data processing agreement rather than left to this page.

Where personal data is transferred out of the UK or the EEA, it is done on the basis of an adequacy decision where one covers the destination, and otherwise under the Standard Contractual Clauses - with the UK Addendum where the UK is involved - together with the technical measures described above. Paddle makes its own transfer arrangements for payment data as a separate controller.

Children#

The product is for business and professional use and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe we have, write to privacy@taxorch.com and it will be deleted.

Your rights#

Depending on where you are, you may have rights to access, correct, export, restrict or delete the personal data held about you, to object to certain processing, to withdraw consent, and to receive your data in a portable form. The export and deletion paths above exist to make those rights operable rather than theoretical.

To exercise any of them, write to privacy@taxorch.com. You will get a reply within 30 days, which is the statutory period rather than a target, and there is no charge. If we need to verify who you are first, we will ask for the least that establishes it.

If you are in the UK or the EEA and you believe your rights have not been honoured, you may complain to your national supervisory authority - in the UK, the Information Commissioner's Office. You do not have to come to us first, though it is usually faster.

If you are in California, you may exercise the equivalent rights of access, deletion, correction and portability, and to know what is collected and why. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is no opt-out of those to offer.

If something goes wrong#

A personal data breach affecting you is notified to you, and to the relevant supervisory authority within 72 hours of us becoming aware of it where the law requires. The notice says what happened, what data was involved and what is being done about it, rather than that an incident occurred.

Changes to this policy#

Every version carries the date it took effect and a summary of what changed. A change that materially affects how your personal data is handled is notified to account holders in advance rather than announced by a banner afterwards, and earlier versions stay readable at this address.

Contacting us about this#

privacy@taxorch.com for anything about data, including a rights request. security@taxorch.com for a vulnerability, where the disclosure terms and the response commitments are published in full on the security page.

Written correspondence goes to the registered office published at the foot of the terms of service.