Privacy Policy

Effective date: August 17, 2026

CPAReady exists to organize highly sensitive financial records. This policy explains exactly what we collect, how we use it, who can see it, how we protect it, and how you can delete it. We do not sell your information and we do not use your documents to train artificial intelligence models.

1. Scope of this policy

This Privacy Policy describes how CPAReady ("CPAReady", "we", "us", or "our") collects, uses, shares, protects, and deletes information when you use the CPAReady website and application (the "Service").

It applies to people who create accounts, members and guests invited into a household, and visitors to our marketing pages.

2. Information we collect

  • Account data: name, email address, password credentials in hashed form, two-factor authentication enrollment, and role within a household.
  • Household and structure data: household name, people you list and their roles, filing status answers, entities and entity types, ownership percentages, accounts including institution name, account type, last four digits, and foreign account flags.
  • Uploaded documents: bank and credit card statements, W2s, 1098s, 1099s, K-1s, receipts, and other financial or tax documents you choose to upload.
  • Extracted and derived data: figures, dates, balances, transactions, categories, reconciliation results, inter-entity attributions, annual facts such as mileage or square footage, checklist items, and generated packages.
  • Interview and questionnaire answers you provide about your tax year activity.
  • Usage and device data: log records, IP address, browser and device type, pages viewed, actions taken, timestamps, and error diagnostics.
  • Communications: messages you send to hello@cpa-ready.com and email delivery events such as sends, bounces, and failures.

3. Sensitivity of your documents

Financial and tax documents are among the most sensitive records a person holds. We treat every document you upload, and every figure extracted from it, as confidential. Access is limited to the people you invite, within the scope you grant them, and to the small number of our personnel and processors who need access to operate, secure, or support the Service.

4. How we use information

We do not sell personal information and we do not share it for cross-context behavioral advertising. We do not use your documents or the data extracted from them to train artificial intelligence models, and our AI processing providers are contractually prohibited from using your content to train their models.

  • To create and operate your account, authenticate you, and enforce roles and permissions.
  • To store, organize, and display your documents, entities, accounts, and years.
  • To perform automated extraction, categorization, transfer detection, reconciliation, and summary generation, including through third-party artificial intelligence processors that act on our behalf under confidentiality and security obligations.
  • To build checklists, readiness views, and the CPA package you choose to generate.
  • To send transactional email such as sign in assistance, password resets, and account notices.
  • To secure the Service, detect abuse, debug errors, and maintain backups.
  • To comply with legal obligations and to enforce our terms.

5. Legal bases and consent

Where a legal basis is required, we process your information to perform our contract with you, to pursue our legitimate interests in operating and securing the Service, to comply with legal obligations, and with your consent where consent is required. You can withdraw consent by contacting us, though some processing is necessary to provide the Service.

6. How we share information

We do not disclose your documents to advertisers, data brokers, or any party for marketing purposes.

  • Service providers: cloud hosting, database and storage providers, artificial intelligence processing providers, and email delivery providers. They process data only on our instructions and under confidentiality and security terms.
  • People you invite: household members, family viewers, and CPA guests see only what your role assignments and per-entity, per-year access grants allow. A CPA guest sees nothing until you explicitly invite them and choose the scope.
  • Legal compliance and safety: we may disclose information if required by law, subpoena, or court order, or where necessary to investigate fraud, protect our rights, or protect the safety of any person. Where lawful, we will try to notify you first.
  • Business transfer: if we are involved in a merger, acquisition, financing, or sale of assets, information may transfer as part of that transaction, subject to this policy.

7. Security

No system is perfectly secure. Use a strong unique password, enable two-factor authentication, and tell us promptly at hello@cpa-ready.com if you suspect a problem. If a breach affects your personal information we will notify you as required by law.

  • Encryption in transit using TLS and encryption at rest for stored documents and database records.
  • Private storage buckets. Documents are never publicly addressable and are served only through short lived signed URLs issued to authorized users.
  • Row level security in the database so that every query is scoped to your household and your permissions.
  • Role-based access control with per-entity and per-year grants, plus optional time-based one-time password two-factor authentication on your account.
  • Least privilege access for our personnel, logging of administrative actions, and regular review of dependencies.

8. Retention and deletion

We keep your information while your account is active and for as long as needed to provide the Service. Tax records are typically useful for several years, so we do not automatically purge past years unless you ask us to.

You can delete an individual document, an account record, an entity, or your entire household from within the Service. Deleting a document removes it from your vault and queues the underlying file for removal from storage. Figures previously extracted from a deleted document are removed with it, and any package you already downloaded remains on your own device.

You can request deletion of your account by writing to hello@cpa-ready.com. We remove account data and documents from live systems within 30 days of a verified request. Encrypted backups may retain copies for up to 90 days before they expire on their normal schedule, and we may retain limited records where required for legal, accounting, or fraud prevention purposes.

9. Your privacy rights

Subject to applicable law, you may request access to the personal information we hold about you, correction of inaccurate information, deletion of your information, a portable copy of information you provided, and information about how we share it. Most of these actions can be performed directly in the Service, and we will respond to emailed requests within the time required by law.

We will not discriminate against you for exercising a privacy right. We may need to verify your identity before acting on a request.

10. California and other state privacy rights

If you are a California resident, the California Consumer Privacy Act as amended gives you the right to know the categories and specific pieces of personal information we collect, the sources, the purposes, and the categories of recipients, the right to delete, the right to correct, the right to limit the use of sensitive personal information, and the right to opt out of sale or sharing. We do not sell or share personal information as those terms are defined, and we use sensitive personal information, including your financial documents, only to provide the Service you requested.

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have similar rights, including access, correction, deletion, portability, and the right to appeal a denied request. To appeal, reply to our decision at hello@cpa-ready.com with the word appeal and we will respond in writing.

You may use an authorized agent to submit a request where the law allows, with proof of authorization.

11. Children

The Service is not directed to anyone under 18 and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided information to us, contact hello@cpa-ready.com and we will delete it. Information about dependents that you enter as part of your household is treated as your household data, and you should provide only what your tax preparation requires.

12. International users

The Service is operated in the United States and information is stored and processed there. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

13. Changes to this policy

We may update this policy. If a change is material, we will notify you by email or by a notice in the Service before it takes effect and we will update the effective date above. Continued use after the change means you accept the updated policy.

14. Contact

Questions, requests, and privacy complaints can be sent to hello@cpa-ready.com and we will respond as quickly as we can.