1. Roles
For taxpayer data your firm uploads or gives us access to, your firm decides why and how the data is used and TaxSQR processes it only on your firm’s documented instructions — to prepare returns, run the platform, and meet the legal duties that apply to tax return preparers. For your firm’s own account data, our Privacy Policy applies.
2. What we process
Taxpayer identity and contact details, Social Security numbers and tax identification numbers, income and deduction records, bank and investment account details needed for reporting, and the documents your firm places on the platform. We process this data only as long as needed under our Data Retention Policy.
3. Confidentiality and staff
Everyone who works with your firm’s data — in our United States and India offices — is bound by written confidentiality obligations and trained on handling taxpayer information. Access is limited to the people working on your firm’s files.
4. Security
We protect data with encryption in transit and at rest, role-based access controls, multi-factor authentication, and audit logging, and we do not allow client data on personal devices. Our current measures are described on the Security page, and our incident process on the Incident Response page, including our commitment to notify your firm within 72 hours of confirming unauthorized access to its data.
5. Where data is processed
Return files are prepared at our offices in India and stored on US infrastructure. We maintain the data protection safeguards required of tax return preparers under US regulations at all our offices, and your firm is responsible for obtaining the taxpayer consents described on the Taxpayer Consent page before files are shared with us.
6. Sub-processors
We use the providers listed on our Sub-processors page. We remain responsible to your firm for their work, and we will update that page before adding a provider that touches taxpayer data.
7. Deletion, return, and audits
On your firm’s written instruction, and in any case when our agreement ends, we return or delete your firm’s taxpayer data within 30 days, except copies the law requires us to keep. Once a year, on reasonable notice, your firm may request a written summary of our security program to verify these commitments.
8. Firms with EU or UK clients
If your firm is subject to the GDPR or UK GDPR for some of its clients, this addendum operates as the processing contract those laws require, and we will sign the applicable standard contractual clauses on request at contact@taxsqr.com.