Privacy Policy

TaxMD™: TAX PLANNING SOFTWARE LLC ("TaxMD™," "we," "us," or "our") respects your firm's privacy and is committed to protecting the personal and confidential information processed in connection with your firm's subscription. This Privacy Policy (Professional Edition) governs how we collect, use, disclose, retain, and protect information when a CPA firm, tax professional practice, or similar business entity (the "Firm") accesses or uses the TaxMD™ Services.

If your Firm has a separate written agreement with TaxMD™, such as a Master Services Agreement (MSA), Data Processing Addendum (DPA), or Order Form, that agreement controls in the event of any conflict with this Privacy Policy.

TaxMD™ as Service Provider / Processor

When your Firm submits client data to the TaxMD™ platform, TaxMD™ acts as a service provider or processor of that client data on behalf of your Firm. Your Firm is the controller or business with respect to your clients' personal information. TaxMD™ processes client data only to provide, maintain, and improve the Services as permitted by your agreement and applicable law.

Firm as Controller

Your Firm is responsible for: (a) determining what client data to submit to the platform; (b) ensuring you have the legal right to submit that data; (c) obtaining any consents required by law, including IRC §7216 consent where applicable; (d) responding to your clients' privacy requests; and (e) complying with all applicable laws governing the handling of client tax and financial data.

Firm Administrator Access

Firm administrators designated by your Firm may access, manage, review, export, and administer all data associated with the Firm account, including data submitted by other firm users and data relating to client matters. Your Firm is responsible for managing firm administrator credentials and access privileges.

Firm Account and Contact Information

Firm name, business address, billing contact, authorized firm administrator names and email addresses, account credentials, and subscription details.

Payment and Billing Information

Billing name and address, business entity name, invoice and payment records, and subscription plan details. For firm accounts, billing may be by invoice with payment due within 30 days of invoice date (Net-30) or by credit card depending on your subscription tier. We use third-party payment processors and do not store full payment card numbers.

Client and Matter Data (Confidential Tax Information)

Information your Firm uploads, imports, or enters on behalf of clients, which may include client income, deductions, expenses, business structure and ownership information, tax elections, planning assumptions, financial figures, uploaded documents and tax records, generated reports and projections, and government-issued identifiers such as SSNs, ITINs, or EINs. Your Firm controls what client data is submitted to the platform.

Firm Usage and Technical Information

Firm user IP addresses (approximate location only), browser type and version, device type, pages and features accessed, session information, and performance/diagnostic data at the firm account level.

Communications and Support

Contact details, content of communications with us, support tickets, and feedback submitted by firm users.

To the extent the platform processes taxpayer information subject to Internal Revenue Code Section 7216 and related Treasury Regulations, TaxMD™ will handle such information consistent with applicable legal requirements, including limitations on unauthorized use and disclosure.

Your Firm is responsible for determining whether IRC §7216 consent is required before submitting client taxpayer information to the platform and for obtaining any required consents from clients. TaxMD™ does not act as your clients' tax return preparer unless separately engaged in writing.

TaxMD™ does not use client taxpayer information for purposes not permitted by law or by the taxpayer's consent, and does not share client taxpayer information with advertising networks, data brokers, or for any purpose unrelated to providing the Services.

• Provision and administration of the Firm account and all firm user accounts
• Processing client and matter data entered by firm users and generating informational outputs, reports, and projections
• Enabling firm administrator access controls, billing, and account management
• Platform improvement, security monitoring, and fraud prevention, using aggregated or de-identified data where possible
• Responding to firm support requests and sending service-related communications
• Complying with legal and contractual obligations

We do not sell client data. We do not use client tax return information for targeted advertising or to train publicly available AI models.

We protect Firm and client data with:

• TLS 1.2+ encryption for all data in transit
• AES-256 encryption for sensitive data at rest where applicable
• Multi-factor authentication (MFA), available for all firm user accounts and strongly recommended for all firm administrators
• Role-based access controls, logging, monitoring, and anomaly detection
• Regular vulnerability assessments and security patching
• Incident response procedures and vendor security oversight

If we determine that a breach has resulted in unauthorized access to Firm or client personal information in our control, we will notify your Firm no later than 72 hours after we make that determination, or within the timeframe required by applicable law, whichever is shorter. Notice will describe the incident, the types of information involved, and remediation steps.

Your Firm is responsible for maintaining the security of firm administrator credentials, enforcing MFA for firm users, limiting access to authorized personnel, and notifying us promptly at Privacy@taxmd.com if you suspect unauthorized access.

• Service providers working on our behalf (hosting, payment processing, analytics, security, support), contractually restricted to the services they provide
• Third-party integrations your Firm enables, subject to those third parties' own terms
• Legal authorities where required by law, court order, or to protect against fraud or harm, including as permitted by IRC §7216 and applicable regulations
• Transaction counterparties in a merger, acquisition, or sale of assets

We do not sell personal information and do not share it for cross-context behavioral advertising or with data brokers.

Your clients (as data subjects with respect to data submitted by your Firm) may direct privacy rights requests, including access, correction, deletion, and portability requests, to your Firm in the first instance, as your Firm controls the submission of that data. If a client contacts TaxMD™ directly regarding data submitted by your Firm, we will generally redirect them to your Firm unless otherwise required by law.

Firm users acting in their individual capacity as subscribers may contact Privacy@taxmd.com to exercise rights with respect to their own account data.

We retain Firm account information and client data for as long as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements, generally up to seven (7) years after account termination, or longer where required by law or as agreed in a written data retention addendum. After the applicable retention period, we delete or anonymize the information.

TaxMD™ may use automation, machine learning, and AI-assisted features to process client data inputs and generate calculations, projections, and planning outputs. We do not use individually identifiable client tax return information to train publicly available AI models. Automated outputs may contain errors and are informational only, firm professionals remain responsible for reviewing outputs before using them in client advice or filings.

We may update this Privacy Policy (Professional Edition) from time to time. We will revise the Effective Date and version number and update the Version History table. We will provide additional notice of material changes by direct communication to firm account administrators or by posting notice on the website.

Privacy Officer TaxMD™: TAX PLANNING SOFTWARE LLC 5020 Clark Rd, #202, Sarasota, FL 34233 Email: Privacy@taxmd.com Website: www.taxmd.com