--- title: "TaxWeave privacy" description: "Readable privacy policy from the public website." canonical: https://taxweave.ai/privacy last-updated: 2026-10-14 --- # Privacy Policy Effective July 28, 2026 · Updated October 14, 2026 ## Who we are TaxWeave is the context layer tax firms run on. It holds everything your firm knows about a client and puts skills to work on top of it. TaxWeave is built and operated by TaxWeave, PBC, based in Richmond, Virginia. ## What data we access When you connect an account to TaxWeave, we access data from the tools your firm already uses — including but not limited to email (Gmail, Outlook), document drives (Google Drive, OneDrive), and client lists supplied through CSV upload or Google Sheets. ShareFile and Dropbox are not listed as currently supported connections. Other integrations are in development. You will be notified when new integrations become available, and each connection requires your explicit authorization before any data is accessed. ## How we use your data We use your data solely to provide the TaxWeave service — surfacing engagement intelligence and practice insights within the product. We do not sell your data, share it with third parties for marketing purposes, or use it for any purpose beyond delivering the service to you. ## Google user data When you connect a Google account, TaxWeave requests the narrowest Google OAuth scopes that support the features you turn on: - Gmail (read-only) — reads message headers and, where needed to match a conversation to a client, message text, so that client timelines and email summaries work. TaxWeave never sends, modifies, labels, or deletes email, and never reads attachments. - Google Drive (read-only) — reads the files in the document folder you choose to connect, so you can search and reference client documents inside TaxWeave. Nothing is modified or deleted. - Google Drive (per-file) — the engagement spreadsheet you select through Google's file picker; the grant covers only that file, not the rest of your Drive. TaxWeave's use and transfer to any other app of information received from Google APIs will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Google user data is used only to provide the user-facing features described above. It is never sold, never used for advertising, and never used — in raw, aggregated, anonymized, or derived form — to create, train, or improve any machine learning or artificial intelligence model, whether ours or a third party's. Client documents are processed by a model TaxWeave operates in its private cloud. Outside AI providers receive requests through their commercial APIs, with identifiers removed as described below; their terms prohibit training on submitted data. You can revoke TaxWeave's access at any time from TaxWeave's settings or from your [Google Account permissions page](https://myaccount.google.com/permissions). ## Identifiers and AI processing TaxWeave uses two processing paths. Client documents are read by a model TaxWeave operates in its private cloud. For research and drafting that use an outside model, identifying details are detected and replaced with placeholders in code — Social Security numbers, EINs, ITINs, bank and routing numbers, and W-2 control numbers among them. Every outside-model request is checked again on the way out, and a request still containing an identifier is not sent. Real values are restored only inside TaxWeave. The private-cloud document-processing path and the outside-model path are distinct; the identifier-removal statement describes requests to outside models. See the [security and AI processing page](/security) for the data flow. This design exists because IRC §7216 and Rev. Proc. 2013-14 govern a preparer's disclosure of taxpayer return information to third parties. TaxWeave is built so that outside-model requests contain placeholders in place of detected identifying details. This is a description of how the software works, not legal advice about your own obligations — consult your own counsel regarding consent requirements that apply to your firm. ## How we store your data TaxWeave runs on third-party infrastructure and service providers, including but not limited to: - Private-cloud document processing — TaxWeave operates the model that reads client documents. The infrastructure hosting this processing is distinct from the outside AI model APIs listed below. Contact sam@taxweave.ai for the current infrastructure-provider details before onboarding. - Supabase — database, authentication, and file storage - Vercel — application hosting, and privacy-friendly visitor analytics on taxweave.ai (aggregate page views and referrers; no cookies, no cross-site tracking, no personal identifiers) - Railway — background processing - Resend — transactional email - Google — authentication and the APIs behind connected Google services - Anthropic and OpenAI — AI model processing via their commercial APIs, which receive only data with identifiers removed as described above and do not train on submitted data These providers maintain industry-standard security practices, and this list may change as the product evolves. You acknowledge that your data is processed on distributed infrastructure maintained by these third parties. ## How long we keep your data We retain your data for as long as your account is active. Following termination or a deletion request, data is removed from live systems within 14 days and purged from backups within 90 days. Note that your firm has its own record-retention obligations as a preparer; TaxWeave is not a system of record for those purposes, and you remain responsible for retaining what you are required to retain. ## Security and breach notification We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the data we handle, including access controls, encryption in transit and at rest, and the identifier-removal architecture described above. If we become aware of a security incident affecting your data, we will notify you without undue delay and no later than 72 hours after becoming aware of it. Notification will describe what we know, what we are doing about it, and what you may need to do. ## Your controls You may revoke access to any connected data source at any time. Revoking an integration stops the flow of new data from that source immediately. Full deletion of your account and associated data requires written notice to [sam@taxweave.ai](mailto:sam@taxweave.ai). Please allow a minimum of 14 days from receipt for us to execute it. ## Early access notice TaxWeave is currently in early access. The service is provided as-is and may change. This privacy policy will be updated as the product evolves. ## Contact TaxWeave, PBC [sam@taxweave.ai](mailto:sam@taxweave.ai) [← Back to TaxWeave](/)