Your privacy, protected by design.

1. Information we collect

To prepare your federal or state tax return we collect your first and last name, date of birth, Social Security number (SSN) or Individual Taxpayer Identification Number (ITIN), mailing address, email address, mobile phone number, and the tax documents you upload. These may include W-2s, 1099s, 1098s, Schedule K-1s, business financial records, identification documents and other records needed to complete your return. For business returns we also collect the entity name, Employer Identification Number (EIN) and owner/officer details.

Your data is stored in secure cloud infrastructure hosted in the United States. We use a multi-layered storage model:

• General profile data — name, email, phone and account metadata — is kept in an application database protected by row-level security policies.
• SSNs, TINs and EINs — are stored in a separate encrypted vault, not in the main application tables. They are encrypted before being written to disk and can only be decrypted by authorized server functions.
• Uploaded documents — W-2s, 1099s, photos, PDFs and other files are stored in private object storage buckets. Each file is linked to your account only and is not publicly accessible. Preparers access files through short-lived, cryptographically signed URLs.
• Row-level security (RLS) — at the database layer, every table has policies that prevent one client from reading another client's records, even if an attacker obtained a valid database connection.

Encryption is applied at every stage of the process:

We retain tax returns and supporting documents for the period required by federal and state tax rules, generally a minimum of three years from the filing date or the due date, whichever is later. After the required retention period ends, records are securely deleted unless a longer period is required by law or requested by you.

Deletion means:

• Active records — removed from the application database and private storage buckets.
• Encrypted vault data — SSN/TIN ciphertext and associated keys are destroyed.
• Backups — retained for operational continuity, then purged on their normal expiration cycle. Access to backup data is restricted and logged.
• Account deletion — you may request deletion of your account and documents not subject to a legal retention requirement by contacting us at the email or phone below.

6. Use and disclosure — IRC §7216

Federal law (Internal Revenue Code §7216) prohibits us from using or disclosing your tax return information for any purpose other than preparing and filing your return without your prior written consent. We do not sell your information. We do not share it with marketers or advertisers. We disclose it only to:

• The Internal Revenue Service and applicable state tax agencies when filing your return.
• Service providers who host, transmit or process data on our behalf under strict confidentiality agreements.
• Regulatory or law-enforcement authorities when required by law.

7. Marketing, analytics and cookies

If you use the Refund Estimator or join our mailing list, we collect your email address and marketing-consent choice separately from your tax data. Marketing email is never a condition of tax preparation, every message includes a working unsubscribe link, and opting out suppresses your address immediately. We use privacy-respecting, first-party analytics to understand site traffic; we do not run third-party advertising trackers. Details are in our Cookie Policy. Tax return information is never used for marketing — IRC §7216 makes that a crime.

8. Offshore preparation (opt-in only)

Returns are prepared by US-based staff by default. Only when our offshore preparation program is enabled and you have signed a specific, per-return IRC §7216 consent may an approved preparer located in India access your return, inside a controlled environment with no local storage. Every such access is logged and visible in your audit history. Without your signed consent, no offshore access occurs.

9. Your rights

You may request a copy of the information we hold about you, ask us to correct it, or request deletion of documents not subject to a legal retention requirement — directly in your portal under Account & privacy → Privacy requests, with supporting documents if needed. Residents of California, Colorado, Connecticut, Virginia and other states with comprehensive privacy laws have additional rights, including the right to know what information is collected, the right to delete, the right to correct, the right to appeal, and the right to opt out of any sale or sharing of personal information. We do not sell or share personal information, and we never discriminate against you for exercising these rights. Full retention periods and the step-by-step deletion process are published in our Records Retention & Deletion Policy.

10. Children

The Ascen Tax USA portal is intended for adults. Dependent information is provided by a parent or legal guardian in connection with a tax return.

Questions about this Privacy Policy, a data access request, or a deletion request: