TERMINAL TAX PRIVACY NOTICE
Last updated: October 2026
Terminal Tax LLC is a New Jersey limited liability company. Privacy questions, rights requests, and appeals: legal@terminal.tax
ABOUT THIS NOTICE
This notice describes how the service handles personal information when you use it. It governs the filing session in which it is shown to you, at the exact version and hash recorded there.
THE SHORT VERSION
Terminal Tax is the transmission wire at the end of a tax conversation you had with a separate chatbot or other agent. There is no Terminal Tax account, login, password, dashboard, return history, tax interview, advertising profile, or document upload.
Your agent creates an empty, non-tax reservation and hands you one short-lived link. No tax information exists at that point. You open the link, read this notice, and acknowledge it. You then give a separate permission for Terminal Tax to receive the completed return at all. Only after both of those steps may your agent send the return, and once it does, that return is bound permanently and cannot be replaced.
Your agent cannot send us your name, Social Security number, address, date of birth, occupation, driver's license or state ID number, Identity Protection PIN, bank details, phone number, or email address. You type those yourself, on our page, later. Your agent may send us the employer and payer identification numbers from your source forms, and the lender, trustee, partnership, and corporation numbers listed in section 2, each in the form of an employer identification number. Those numbers appear in your review on our page before you sign. Your agent never receives your return back from us, and never receives your possession code, your signing PIN, your prior-year authentication answer, or your card details.
We use return information only to mechanically check, calculate from the values supplied to us, secure, transmit, reconcile, acknowledge, and retain your filing as this notice describes; to share your filing's status with your AI assistant, only if you sign the optional consent described in section 9; and, using only the fixed codes listed in section 5, to find and fix defects in the software that does those things; outside our hosting provider we use only those codes together with counts in steps of ten filings, with no breakdown of the counts and no dates. We do not sell personal data. We do not use it for advertising. We do not use it to train or evaluate any language model, and there is no language model in this service.
1. WHAT THIS NOTICE COVERS
It covers the Terminal Tax draft service, the hosted filing session, transmission to a taxing authority, the acknowledgement and status service, the privacy-rights channel, security operations, and legally required records.
It does not cover the chatbot, agent, browser, device, taxing authority, telecommunications carrier, or Stripe's own hosted card page. Their own notices govern what they do.
2. WHAT WE COLLECT
FROM YOUR AGENT, after you acknowledge this notice and give the separate permission described in section 4: the structured return and its schedules. That means the amounts, elections, and statements each form on your return needs - for example wages and withholding; self-employment, rental, partnership, and S corporation income; retirement, Social Security, interest, dividend, brokerage, unemployment, cancelled-debt, and other income; deductions and credits; the filing status and the tax year; a spouse's amounts and statements; each dependent's relationship, age, residency, and credit facts, never a dependent's name or number; the names and addresses of the employers, payers, and partnerships on your source forms; the employer and payer identification numbers from your source forms; and the statements of whether you are blind and whether you are 65 or older. The identification numbers your agent may send are: the employer identification number from each W-2; the payer's identification number from each 1099, RRB-1099, and W-2G; the lender's identification number from each 1098 and 1098-E; the trustee's identification number from each 5498-SA; the partnership's or corporation's identification number from each Schedule K-1; and your own employer identification number as a household employer, for Schedule H. Your agent sends each of these in the form of an employer identification number. The filter refuses a payer's or lender's number sent in the form of a Social Security number, and a W-2G payer's number described as a Social Security number, even when the payer or lender is an individual. For a W-2G, your agent may also send the statement that the payer's number is an employer identification number.
Those last two are required and are never inferred. Your agent must state each one explicitly as true or false on every return. A return that leaves either blank is refused. They set the size of your standard deduction, and we will not read a blank as "no" or derive the age answer from your date of birth.
STATEMENTS THE LAW TREATS AS SENSITIVE. Your agent may also send statements that privacy laws treat as sensitive, where the forms ask for them: whether you, and a spouse on your return, are blind, for the tax year and, when a state or local income tax refund needs an earlier year's worksheet, for that earlier year; whether a dependent listed on your return is permanently and totally disabled; the distribution codes on Forms 1099-R and 1099-SA, which can show that a payment was made because of a disability; on Form 2441, whether a spouse is treated as having income because the spouse was a student or disabled; amounts paid for medical and dental care, for health and long-term care insurance, and to or from a health savings account; what kind of taxpayer identification number you, a spouse, and each dependent has, and whether your or your spouse's Social Security number is valid for employment; on a married return with a nonresident-alien spouse, whether the spouse is a nonresident alien and the related statements the form asks for; on Form 8862, whether each child or dependent it lists is a United States citizen or national; and, on Schedule EIC, whether you file Schedule SE as a member of the clergy. Your agent states each of these; Terminal Tax neither infers nor verifies them.
WHAT YOUR AGENT CANNOT SEND US. A versioned filter stands in front of the return and refuses the whole packet, before anything is stored or calculated, if it contains your name, your own Social Security number, individual taxpayer identification number, or adoption taxpayer identification number, your address, your date of birth, your occupation, your driver's license or state ID number, your Identity Protection PIN, your bank routing or account number, your email address, your phone number, a signature value, or card data. It also refuses any field labelled as genetic, biometric, health, medical, citizenship, immigration-status, or precise-location data. It does not refuse the statements listed under STATEMENTS THE LAW TREATS AS SENSITIVE above, because the forms themselves ask for them; and it refuses the disability answers on Schedule EIC and on Form 2441's list of qualifying persons, because the service does not file those answers. You supply your identity to us directly, in the filing session, and not through your agent.
Information that describes a business or a property rather than a person is refused from your agent the same way your own identity is — a sole proprietorship's name and address, or the description of a mortgaged property, are taxpayer identity wearing a form label. Where the return needs one of those values, you supply it yourself on our page, in the step built for it. The one exception is the employer and payer identification numbers listed above: your agent sends those with the return, and your review on our page shows them.
FROM YOU, typed into the Terminal Tax page: your legal name, Social Security number or taxpayer identification number, date of birth, occupation, and mailing address; your refund routing number, account number, and account type; either your six-digit IRS Identity Protection PIN or your statement that none was issued; your confirmation that you hold the final form; your mobile number and email address; your acknowledgements and permissions; your Self-Select PIN; your prior-year adjusted gross income or prior-year Self-Select PIN; and, where the return needs them, a sole proprietorship's name and address or a mortgaged property's description, and the names, taxpayer identification numbers, and other details it requires for a spouse, a dependent, or another person it lists, as section 16 describes.
ONLY IF YOUR RETURN INCLUDES AN OHIO INDIVIDUAL INCOME TAX RETURN, and only if you choose to: your driver's license or state ID number and issuing state, and its issue and expiration dates if you enter them, or your statement that you do not have a driver's license or state ID. Ohio asks tax software to request this to combat stolen-identity tax fraud; it does not reject a return without it. This step is optional: if you choose nothing, nothing about it is collected or sent. We use it only to file it with your Ohio return, we show it to you in the return you review and sign, and we never send it to your agent.
ONLY IF YOUR RETURN INCLUDES A WEST VIRGINIA INDIVIDUAL INCOME TAX RETURN: your driver's license or state ID number, issuing state, issue date, and expiration date. West Virginia rejects a return without the primary taxpayer's, so this step is required: if you hold neither a driver's license nor a state ID, we cannot file your West Virginia return. On a joint return your spouse is asked for the same in your spouse's own session. We use them only to file them with your West Virginia return, we show them to you in the return you review and sign, and we never send them to your agent.
ONLY IF YOUR RETURN INCLUDES AN OREGON PERSONAL INCOME TAX RETURN: your Yes or No answer to whether you want to provide race or ethnicity data on Oregon's Form OR-VSI, and, only if you answer Yes, the race or ethnicity codes you choose. Oregon requires tax software to offer this form to every Oregon filer; completing it is voluntary and does not change your tax. If you answer No, nothing about it is sent to Oregon. We use your answer only to file Form OR-VSI with your Oregon return, we do not keep or use it beyond what filing that form requires, as Oregon law (ORS 305.686) directs, and we never send it to your agent.
PRODUCED BY THE SERVICE: filing-session identifiers, the immutable hash of your return, the version and SHA-256 of every notice, permission, terms text and declaration shown to you, timestamps, the result of the phone-possession check, a keyed correlation of the network address a request came from, your reported time zone and UTC offset at the moment you signed, and audit records.
WE COLLECT LIMITED DEVICE SIGNALS FOR SECURITY: the filing page reads your browser's user-agent string and basic device characteristics and computes a security fingerprint from them. We keep only the fingerprint digest as sealed security evidence; the underlying characteristics never leave your browser. The IRS requires the network addresses involved in preparing and filing your return, including the one your filing came from, to be carried inside the return. We hold those addresses encrypted in your filing session records, transmit them inside the return, and keep them with the return. Those encrypted records are kept or deleted as section 10 describes, including when no return is sent. Other than in those encrypted filing records, our database keeps network addresses only as keyed correlations, which section 6 explains. Separately, the request logs of our application host record the network address each request came from; where those logs are held in our own cloud account, they are kept for up to 30 days, for security and incident response.
FROM STRIPE: whether a usable card exists for this filing session, and the authorization, capture, and release status of the charge. Never a card number and never a card security code. No Terminal Tax endpoint accepts one.
FROM THE PHONE PROVIDER: whether the number you gave exists in the public numbering plan, and whether the code you typed was correct.
FROM THE TAXING AUTHORITY: the acknowledgement, its submission identifier, and any rejection rule codes.
3. YOUR SOURCE DOCUMENTS STAY WITH YOU
There is no upload box, document vault, scanning intake, or document-custody service. No W-2, 1099, receipt, statement, scan, or photograph reaches us. We receive the numbers your agent extracted, not the documents.
The one exception contemplated for the future is an attachment a taxing authority legally requires and we cannot generate. It is not built. Until its exact handling is separately adopted, an affected return is refused rather than falling back to an upload.
4. THE PERMISSIONS THAT COME BEFORE YOUR RETURN DOES
FIRST, THIS NOTICE. Your agent creates an empty reservation and hands you a link. The page shows you this notice at its exact version and hash and records that you acknowledged it. Acknowledging this notice confirms that you received and read it. It is not permission to do anything, and it is not a consent.
SECOND, PERMISSION TO RECEIVE THE RETURN AT ALL. On the same page, before your agent may send anything, you give a separate permission - its own text, its own version, its own hash - for Terminal Tax to receive and mechanically process the tax facts your agent assembled. Nothing is prefilled. This permission is yours and no one else's. It does not claim authority for a spouse, a child, a dependent, or anyone else, though it does cover receiving the facts about them that your own return carries, including the sensitive statements section 2 lists; it is not the permission of the person a statement describes. A spouse who signs a joint return gives their own permission later in the session, as section 16 describes. You can withdraw this permission with the Withdraw permission and stop filing button, from the moment you give it until finalization of your signed return begins; withdrawing it after your return arrives ends the session and erases that return.
THIRD, PERMISSION TO COLLECT THE VALUES YOU TYPE YOURSELF. Later in the session, after your phone is verified and before we accept your Social Security number, date of birth, bank details, Identity Protection PIN, or, for an Ohio or West Virginia return, driver's license or state ID details, or, for an Oregon return, race or ethnicity data, you give a third separate permission on its own screen.
You can withdraw the third permission at any time until finalization of your signed return begins. Withdrawal is not a pause. It ends the filing session, consumes the draft so it cannot be used to file, and erases the sensitive identity, authentication, driver's license or state ID, race or ethnicity, source-form, bank, review, and signature values held for it, keeping only the record that you gave the permission and the time you withdrew it. It erases the return your agent sent too.
5. WHY WE USE INFORMATION
To create and protect a short-lived reservation and filing session.
To verify possession of your phone, and to record identity, review, permission, declaration, PIN entry, and prior-year authentication.
To mechanically check what your agent sent and to calculate deterministically from the values it supplied - never to supply a value it left blank.
To generate, transmit, and reconcile the return.
To tell you what the taxing authority said, and to support a correction after a rejection.
To authorize, capture, or release the filing charge.
To prevent fraud, duplicate filing, abuse, and security incidents.
To comply with tax, recordkeeping, consumer, privacy, security, and lawful-process obligations.
To answer and evidence privacy-rights requests and appeals.
To share your filing's status with your AI assistant, only if you sign the optional consent described in section 9.
To find and fix defects in the filing software. For this we use only fixed codes our software assigns: the taxing authority's rejection rule codes and the return form family they belong to, our own server error codes, the class of any database error, positions in our own page code resolved to our own registered function names, the step of the filing session where the problem happened, which of four fixed timing bands the step fell in, and which agent surface and browser family the session used. Those codes carry no figure from your return, no name, no identifier, and nothing you typed. What leaves our hosting provider is only those codes together with counts in steps of ten filings, with no breakdown of the counts and no dates.
We do not use return information for targeted advertising, sale, lead generation, unrelated analytics, data-broker activity, credit decisions, or model training.
6. FRAUD AND BULK-FILING CHECKS ACROSS RETURNS
IRS e-file rules require an online filing service to protect itself against bulk filing of fraudulent returns and to limit how many returns it accepts from one email address and one phone number. We meet the first with the single-use code we send you before your return can be filed, and the second with the contact limits described below, which count across returns. No other comparison of your return with another filer's runs.
To make these comparisons without keeping a searchable copy of anyone's Social Security number or bank account, we compute a keyed fingerprint - a digest made with a secret key of ours, separate from the encryption keys that protect your return - of the taxpayer identifier, the refund account, the email address and verified phone number you gave, and the network address at the moment of transmission. These fingerprints are not anonymous. Someone able to compute fingerprints with our secret key could test guessed values against them, including possible Social Security numbers. We keep the fingerprints with the records described in section 10.
THE CONTACT LIMITS. For one tax year we accept at most five returns that give the same email address, and at most ten that give the same mobile number. A filing past either limit is refused before any payment is authorized; the refusal says that a limit was reached, not which one.
These limits use only a count of other filers' matching email and phone fingerprints. No other filer's fingerprint, identifier, or fact is read out or shown to anyone, and only our own operators see the counts. Within your own return, the same fingerprints are also compared among the people who sign it.
IRS e-file rules also require a provider that transmits more than 2,000 individual income tax returns in a year to analyse them for identity-theft patterns and report the results to the IRS weekly, following requirements the IRS says it will distribute. Our production system does not produce that report. If we come to owe it, a new version of this notice will describe it before we send one.
7. WHO RECEIVES YOUR INFORMATION, AND EXACTLY WHAT
THE TAXING AUTHORITY receives the filed return and its transmission envelope. That is the point of the service.
OUR APPLICATION HOST holds your return, and the contact details you enter, in memory while a request is being processed, and passes encrypted records through. Its request logs record the network address each request came from.
OUR DATABASE HOST holds the encrypted return, contact, signature, and filing records, and the operational log rows.
AMAZON WEB SERVICES receives your information through several of its services, each described below.
Its Key Management Service receives encryption-key operations: requests to create and to unwrap data keys, each with an encryption context naming our application, the envelope purpose and identifier, and, for test records, the record type; and requests to sign our own sign-in messages to the taxing authority, which carry our identifiers and no return content. It also receives requests for the public half of our signing key, which carry only the key's identifier. It never receives the encrypted data those keys open, so no return content reaches it.
Its CloudTrail service keeps a record of every management request made in our account, in every region: each request that sets up, changes, or reads the settings of one of our services, and each Key Management Service request described above. A record carries the time, the role or operator of ours that made the request, the request's terms, and where it came from, which is one of our systems, one of our operators, or Amazon itself, never your device. For a Key Management Service request, the terms include the encryption context, so a record can carry the envelope identifier of an encrypted record of your filing. When one of our operators searches our logs, the record carries the search terms, which can include an identifier of your filing, such as its Submission ID. Records of our systems' own requests carry no return content, figures, or contact details. CloudTrail does not record the email we send, the alerts we publish, or the receipts our queue holds. Amazon Web Services keeps these records for us for seven years, in its storage service and its log service, in a United States region, and shows the last 90 days of them in its own event history for our account. Rules we set forward a few kinds of these records, whole, to our alert topic, described below: refused key requests, and changes to our keys, roles, database, network rules, logs, alarms, and alert rules.
Its container service runs our transmission worker, in a United States region. To transmit your return, the worker decrypts the complete signed return in memory and sends it to the taxing authority. To send you a filing-status message, it decrypts the stored email address and phone number you gave, and uses only the email address. The worker's logs, which Amazon Web Services keeps for us for 90 days, carry counts, fixed states, and fields drawn from the same fixed list as the operational alerts described next, including the Submission ID. If the worker process itself stops on an error, they also carry the error's type, a machine code when the error message is already one, and short digests of the error messages. They never carry return content, figures, or contact details.
Its Simple Notification Service receives our operational alerts, in a United States region. An alert can carry the event name, its level, a timestamp, request, transmission, finalization and filing-session identifiers, an HTTP method, a normalized path, a status code, fixed action and error tokens, a resource token, the taxing authority's Submission ID for your filing, the payment authorization identifier from our payment processor, the name of a provider, a retry flag, the tool name, a fixed code and reason, a database error-class code, browser stack positions, digests of the cause and message, a reviewer-lane-only detail field, and an audit-gap count. It carries no return figure, no name, no Social Security number, no bank detail, no email address, and no phone number: the fields are enumerated by name in code, so a new field cannot ride along silently. The Submission ID is the taxing authority's identifier for your specific filing, and we treat it as tax return information.
Its Simple Email Service also returns a delivery receipt for each message we send you, through a second notification topic into its Simple Queue Service, in a United States region. A receipt carries your email address and the message's headers, including the subject line, which for a filing-status message states the outcome; it carries no message body. A receipt for a message that could not be delivered, or that was reported as unwanted, also carries the receiving mail system's own report. Receipts wait in the queue for up to 4 days, or up to 14 days if they cannot be processed. When we read a receipt we keep only the message's identifiers, the kind of receipt, and its time, never the address, headers, subject, or report. For each message we send we also keep a send record holding a keyed fingerprint of your email address, of the kind section 6 describes, and no address; if a receipt reports a permanent bounce, which means the receiving mail system permanently rejected the message or Amazon declined to send it to that address (for example because the address is on one of its suppression lists), or reports the message as unwanted, we mark that fingerprint so that we do not send to it again. No other receipt marks it, including one for a temporary delivery failure or for a failure Amazon could not classify. Amazon Web Services also keeps, with the reason, on a suppression list for our account, the address of a message that the receiving mail system permanently rejected or that was reported as unwanted, so that its Simple Email Service does not send to it again; an address stays on that list until it is removed, which Amazon does on its own only after our account's ability to send has been paused for 90 days, and our service does not remove it. Amazon also places a permanently rejected address on a suppression list of its own that covers all its customers. Section 10 says how long we keep our own records.
THE PHONE PROVIDER receives your mobile number, a check of whether that number exists, a generic verification message, and the result of that message. It never receives your return, your figures, or your Self-Select PIN. The existence check is answered from the phone provider's own numbering data and engages no other company. If the number does not exist, Terminal Tax stops before sending anything to it.
THE EMAIL PROVIDER is Amazon Web Services' Simple Email Service, in a United States region. It receives your email address and the message we send you. For a filing-status message that is: whether the taxing authority accepted, rejected, or reported a duplicate; the date; the Submission ID; the rejection rule codes with our own fixed explanations; and, after a rejection, paper-filing instructions and a date; and, whatever the outcome, whether your card was charged for this filing, and the amount if it was; and, after an acceptance, the Form 8453 instruction paragraph and where to mail it. Where an electronic funds withdrawal was requested, the message also carries the withdrawal outcome paragraph: whether the acknowledgement says the payment request was received, and if so the warning that the bank account, date, and amount cannot be changed through us, the IRS e-file Payment Services number, and the cancellation deadline. For a privacy-rights message it is a single-use link and the kind of request it relates to, and nothing else. No return body, no figure, no Social Security number, no bank detail. An acknowledgement of acceptance or a notice of rejection is tax return information, so this is a disclosure of tax return information and not merely a delivery detail. Under Amazon Web Services' own terms, it or its own third-party providers may store and scan the message to block spam, phishing, viruses and other harmful mail; those terms name no retention period for this and do not name the third-party providers or where they are. That is its contract, and we do not control it.
STRIPE receives an opaque customer reference, a filing-session reference, a purpose label, the amount, and the description "Terminal Tax service". Our servers send Stripe no name, no email address, no tax figure, and no return content. Stripe's own hosted page collects your card details and asks you for an email address directly, and Stripe then sets that address on the customer record. Anything you type on Stripe's page is governed by Stripe's notice.
LAW ENFORCEMENT, REGULATORS AND COURTS receive only what law requires or what is necessary to protect rights and security.
YOUR OWN AGENT receives only a link, the field names of mechanical blockers, and a fixed status vocabulary: whether the filing is waiting for you, in progress, not sent, or could not be shown for review, and, once your signed return is committed for sending, fixed words saying we email you its result. It receives the result itself - each return's status, filing reference, jurisdiction and Submission ID, the fact that correcting a rejection is free, and our fixed explanations of any rejection codes - only if you sign the optional consent described in section 9, and only when it asks through the same connection that started your filing. No return content, no figure, no identity value, no signature value, no payment state, and no raw text from the taxing authority crosses that boundary.
YOUR AI ASSISTANT'S COMPANY receives that result only under that consent. Today the consent is offered only when your filing started from a ChatGPT connection, so the company is OpenAI, L.L.C., and only on a return with one signer.
OUR MAILBOX PROVIDER receives what you write to legal@terminal.tax, and what we write back, and keeps it in our mailbox. Section 17 asks you not to put a Social Security number, a PIN, a code, a bank account number, a return, or an identity document in an email to us.
Some of the recipients above are described by role rather than by name, so that changing a supplier does not require reissuing this notice. If you want the current names, write to legal@terminal.tax and we will tell you.
8. WHERE YOUR INFORMATION IS PROCESSED
Our providers may process, support, back up, replicate, or subprocess information outside the United States. None of them has given us a commitment that your information stays in the United States.
9. INTERNAL REVENUE CODE SECTION 7216
We treat return information as protected by sections 7216 and 6713 of the Internal Revenue Code. Ordinary processing, electronic filing, acknowledgement, security, payment, and required retention rest on specific exceptions in the regulations rather than on your consent. An exception is not permission for a broader use, and we do not use one that way.
THIS NOTICE IS NOT A SECTION 7216 CONSENT AND CANNOT BECOME ONE. A valid consent must be a separate written document, specific about recipient and purpose, signed and dated by you, and never a condition of filing.
The service offers one section 7216 consent, and it is optional: permission to disclose your filing's status to your AI assistant's company, described in section 7. It is offered on its own screen, it is never ticked for you, you sign it by typing your own name and the date, your filing is exactly the same without it, and it lasts one year. No other section 7216 consent is asked of you. If one is ever required, it will be asked for separately, on its own screen, in the form the regulation requires.
10. RETENTION
Terminal Tax is not a return-history or document-storage product.
EXPIRED MEANS UNUSABLE FROM THAT MOMENT: an expired filing draft, reservation, capability, or credential stops working the instant it expires — every read re-checks the expiry, so nothing expired can be used again. DELETED ON SCHEDULE: a retention job purges expired filing drafts and the capabilities that pointed at them, expired browser and filing sessions, expired integration authorization records, rate-limit counters two days after they stop mattering, delivered operational events after 90 days, and undeliverable operational events after one year. The job runs every day.
KEPT, AND FOR HOW LONG: returns, signatures, transmissions, filing identities, audit records, and the permission, legal-text and payment evidence attached to them; and, for the email we send you, the send records, delivery receipt records and do-not-send marks that section 7 describes, none of which holds an email address. Our adopted retention schedule sets the periods listed below. For those email records: the send record and delivery receipts of a possession code are deleted 90 days after the later of the send record's last update and its last receipt, and never before the filing session has expired; those of a filing-status message are deleted with the proof of what was done for the filing it reported, described below; those of a privacy-rights message are deleted with the privacy-rights records of its request; and a do-not-send mark is deleted two years after the latest of when it was written, when a later permanent bounce or complaint marked the same address again, and when it last stopped a message. The CloudTrail records described in section 7 are kept for the seven years stated there. In this section, the "filing year" is the later of the year your return was sent and the year its final acknowledgement from the taxing authority arrived. "Disposition" is the first of these: the return is accepted; it is rejected and no correction can still be claimed against that rejection; you withdraw; or the filing session ends without the return being sent. A filing that is never sent has no filing year, and its records are kept as follows instead. A filing is never sent when no transmission record was made for it, and its never-sent date is when its filing session, or a reservation no filing session reached, ended or expired. Its return contents, the network-address record from when its filing link was first opened, and the keyed fingerprints left on its records are erased 90 days after that date, and the proof of what was done for it is deleted 18 months after the later of that date and the release of its last payment authorization. Nothing of such a filing is erased while one of its payment authorizations is neither released nor captured, or while a fraud-review hold on it is open. A filing whose every send failed before the taxing authority received it, with no further send permitted, has as its filing year the calendar year in which its last send failed, and that failure is its disposition.
YOUR RETURN'S CONTENTS are erased at the later of December 31 of the filing year and 90 days after disposition. That covers the figures; the names and identification numbers and, where the return carries them, the dates of birth, occupations, and addresses of you, your spouse, your dependents, and the other people and businesses on the return; any driver's license or state ID details; your Identity Protection PIN answer; your source-form confirmations; your state answers; your bank instructions; the complete review you approved; the email address and phone number you gave for the filing; and the network addresses and the device fingerprint digest recorded for your filing. Terminal Tax never signs a return as its paid preparer, so it keeps no list of returns under section 6107 of the Internal Revenue Code, which requires one only of a signing preparer.
PROOF OF WHAT WAS DONE FOR YOUR FILING is deleted at the later of December 31 of the filing year and 18 months after the latest of: your payment being captured, your payment authorization being released, and disposition. That covers your sealed signature record (the declaration you signed, your name, the figures it attests, when and by whom it was entered, the kind of prior-year answer you gave, and the possession check it seals); your acknowledgement of this notice and your acceptance of the permissions, terms, and declaration, each with its version and hash; any statement you made about your authority to provide the information of a dependent, a child claimed for the earned income credit, or another person your return lists; the record that your spouse was shown this notice; the possession-check results; the hash of the review you approved; and the transmission record, including the taxing authority's rule messages, the Submission ID, and the acknowledgement. A card dispute opened before that date keeps this evidence until the dispute is finally resolved.
THE FRAUD-CHECK FINGERPRINTS described in section 6 are deleted on December 31 of the year after the filing year.
OUR PAYMENT RECORDS (the amount, fee, refund and dispute outcome, dates, and opaque Stripe and filing references; never your card details, your return's contents, or your contact details) are Terminal Tax's own business tax records. We keep them until no tax can still be assessed, and no credit or refund can still be claimed, for that year on Terminal Tax's own federal and state income tax returns. Ordinarily that is three years after the later of the day our return for that year was filed and its due date, or two years after the tax was paid if that is later. The law keeps a year open longer in some cases, and we keep these records for as long as it does: until our return for that year is filed, if it has not been, after which the periods above run from that filing; to the end of an agreed extension of the assessment period, and six months more where the law adds them; for six or seven years where those periods apply; and with no end if a return for that year is false or fraudulent, or the IRS asserts that it is, because the law then sets no time limit.
AUDIT RECORDS (filing-scoped references, the action taken, a keyed digest of the network address, and a fixed set of details; never return figures) are deleted two years after the event, unless the record of a security incident cites them.
PRIVACY-RIGHTS RECORDS (your request, our decision, any appeal, and how we fulfilled it) are deleted 24 months after the request, or its appeal, closes.
BACKUPS: our automatic database backups expire on their own within 7 days, so a deleted record can remain in a backup until that backup expires. A manual snapshot or export is deleted, or purged again, by the earliest deadline of anything it holds.
HOLDS: a litigation hold, a security incident, a government request, or an open card dispute pauses deletion of only the records it names, from a dated written start to a dated release. A hold can delay a deletion; it never shortens a period.
COPIES OTHERS HOLD: the copies held by Stripe, the phone provider, and the email provider described in section 7 are outside our own stores and follow those providers' terms.
Whatever we keep, for however long, we use only as the section 7216 regulations described in section 9 permit.
The daily job applies the deletions listed under DELETED ON SCHEDULE and erases return contents on the periods stated in this section, except the contents of a filing whose every send failed, which it does not yet erase. The other periods in this section are not yet applied automatically; until they are, a record can be kept after its period ends.
When a lawful deletion request conflicts with a retention duty, we restrict the information to that duty and explain the result.
11. SECURITY
Your return content, your computed figures, your contact details, your identity and bank entries, your Identity Protection PIN answer, your review copy, and your signature material are encrypted before they are stored. Each stored field gets its own fresh 256-bit key, used for a single encryption operation and then discarded. The database holds that ciphertext and its wrapped key, non-secret routing information, and the keyed fingerprints described in section 6. The encryption is bound to the record it belongs to, so a valid ciphertext copied to another return or another filing session fails to decrypt.
Our production application refuses to store tax data any other way. It refuses plaintext, and it refuses the older format that used an application-held key.
Your Self-Select PIN and your prior-year authentication answer are the signature and the identity check inside the return we send. We hold them encrypted only until your return package is built, when the filing-session copies are deleted, and the transport copy is deleted when the MeF submission receipt arrives, or when we confirm the send never reached the IRS; if a send times out, we keep the transport copy until we have confirmed with the IRS whether it arrived. If you withdraw from your filing session, they are deleted at once; if it expires without sending, they are deleted with the session as described in section 10. Encrypted database backups made before a deletion can still contain them until those backups expire. For a return signed under this notice, we keep no fingerprint that could be turned back into either: only the fact that you entered them yourself, when you did, and which kind of prior-year answer you gave.
The filing page loads nothing from anywhere else. Its content-security policy permits scripts and connections from Terminal Tax's own origin only, forbids framing, sends no referrer, and disables camera, microphone, geolocation, and payment interfaces. Operational logs accept only an allowlist of fields, so a request body, an email address, a phone number, or a tax figure cannot reach them. The audit log records what happened, never what your return said.
We maintain physical, electronic and procedural safeguards that comply with applicable law and federal standards.
12. FILING SESSION SECURITY
Your filing link begins as a scoped capability for an empty reservation. Before the page shows any protected return, a fresh code must be texted to a mobile number entered on the page and then entered there. After the first mechanically admissible return attaches, the session is bound to that exact return and refuses replacement. The link is single-use, short-lived, dies on use or expiry, and is not an account credential.
13. ADVERTISING, TRACKING, AND LANGUAGE MODELS
THERE IS NO TRACKING TECHNOLOGY IN THIS SERVICE. No advertising cookies, no pixels, no web beacons, no session-replay tools, no advertising tags, no analytics kit. We do not permit any other party to collect personally identifiable information about your activity over time and across different websites or online services on any Terminal Tax surface where your information is present.
Because we do not track you across sites and never have, a browser Do Not Track signal or opt-out preference signal changes nothing about our behaviour. We treat it as a standing instruction never to do those things, which we already do not do.
WE DO NOT COLLECT, USE, OR SELL PERSONAL DATA FOR THE PURPOSE OF TRAINING LARGE LANGUAGE MODELS. Terminal Tax contains no language model, and your tax information is never used by us to train or evaluate one. Section 7 tells you what our email provider's own terms permit it to do with message content, which is a different question and not one we can answer for it.
Stripe's separately hosted card page is governed by Stripe's own notice.
14. SOCIAL SECURITY NUMBERS
We collect Social Security numbers in the course of business and maintain this policy for them specifically.
We protect their confidentiality. They are held only inside encrypted records, and never in audit records, operational logs, or any message to a service provider.
We prohibit their unlawful disclosure. Disclosure is limited to the taxing authority for the purpose of filing your return, and to what valid legal process requires.
We limit access to the systems that check, package, and transmit a return, and to the minimum personnel necessary to operate and secure the service.
15. WHAT THIS SERVICE CAN FILE, AND WHAT IT CANNOT CATCH
The service transmits one original individual federal income tax return on Form 1040 or Form 1040-SR, for one taxpayer or for a married couple filing jointly, together with a linked state individual income tax return only for a state the service supports. When this version of the notice took effect it supported no state return; Ohio, Oregon, and West Virginia are among the state returns being built, and section 2 names the extra values those three states ask for. It refuses more than one federal filing, any jurisdiction it does not support, and any return root or filing kind other than those.
Most unsupported situations are refused by name, before payment and before anything is transmitted, and the refusal tells your agent exactly which field caused it.
SOME REST ENTIRELY ON YOUR AGENT'S WORD, AND YOU SHOULD KNOW WHICH. Your agent states your federal residency or alien status and whether the return is original or amended. Terminal Tax mechanically refuses values outside the supported envelope, but it cannot verify that the stated values are correct: if your agent states them wrongly, a Form 1040-NR filer's facts would be built into a Form 1040 and an amended return's facts would transmit as an original, and Terminal Tax cannot detect either error.
Because of that, the review screen states in its first block that what will be transmitted is an ORIGINAL return, and that Form 1040 is the return for a United States citizen or resident alien, and names Form 1040-X, Form 1040-NR, and Form 1040-SS as returns Terminal Tax does not transmit. Your own review of that screen is the only check on this. It is a real control, because reviewing and signing the complete return is what you are here to do - but it is a second line, not a refusal, and we are not going to describe it as one.
16. PEOPLE OTHER THAN YOU
The permission you give before your return arrives is yours and no one else's, and it gives you no authority over anyone else's information. Some returns also carry another person's information: some of it your agent sends with the return and some a signer types directly, as this section describes.
A joint return needs both spouses. Each required adult signer receives the sensitive-data permission text and independently types agreement before Terminal Tax accepts the sensitive information that signer types; one signer cannot agree for the other. Your agent also sends a spouse's tax facts with the return, never the spouse's identity: the spouse's amounts and elections, the statements of whether the spouse is blind and is 65 or older, and the other statements about a spouse that section 2 lists. Those arrive under your permission described in section 4, not your spouse's. Terminal Tax neither infers nor verifies them and handles them as part of your return. After the first signer completes through source-identity confirmation, the session hands off so the second signer completes their own privacy, contact, and possession steps.
On a married-filing-separately return the header requires the non-signing spouse's name and taxpayer identification number (name only where the spouse is a nonresident alien with no number), which the signer types in the session; that entry is return data, not the spouse's permission. Before a signer types the identifying information of a dependent, a child claimed for the earned income credit, or another non-signing person the return lists, such as a spouse filing separately, a head-of-household qualifying person, or a person on Form 2441, 8615, 8863 or 8962, the signer chooses on its own screen, for each person, the basis on which they may provide it. Terminal Tax records that statement and does not verify it, and without it the filing stops. Other supported returns collect similar details the same direct way — a qualifying person, a parent, a donee, a care provider, a student, or a former spouse, depending on the form. The filter in front of your return refuses another person's identity when it arrives from your agent — a spouse's name, Social Security number, date of birth, occupation, or Identity Protection PIN from the agent packet is rejected before it is stored; the values above arrive typed by a signer, not from the agent packet. The one exception is the employer and payer identification numbers section 2 lists, which your agent may send only in the form of an employer identification number; a number sent in the form of a Social Security number is refused.
STATEMENTS ABOUT OTHER PEOPLE ON YOUR RETURN. Form 1040 asks whether a dependent listed on your return is permanently and totally disabled, Form 8862 asks whether a child or dependent it lists is a United States citizen or national, a married return with a nonresident-alien spouse asks whether the spouse is a nonresident alien, and your return states what kind of taxpayer identification number each person on it has. Your agent may send each such statement with the rest of your return. It is your statement on your own return. Terminal Tax neither infers nor verifies it and does not ask the person it describes for permission. It keeps the statement with your return as section 10 describes, carries it on your federal return to the IRS, and uses it for nothing else.
Terminal Tax does not let a minor create an account, because it has no accounts. A return for a minor or a person who has died is not offered unless the form, the signer's capacity, the authority evidence, and the signature method are all specifically supported.
17. YOUR CHOICES AND PRIVACY RIGHTS
You may decline to continue at any point before transmission. Withdrawing the permission described in section 4 ends the session and erases the sensitive information held for it.
WHAT YOU CAN ASK FOR. Access to the personal data we hold about you; a portable copy of it; a correction; deletion; or withdrawal of the sensitive-data permission. You may appeal if we deny a request.
HOW TO ASK. Write to legal@terminal.tax. Do not put a Social Security number, a PIN, a one-time code, a bank account number, a tax return, or an identity document in an email to us.
HOW WE CHECK IT IS YOU. There is no account to log in to, so we send a single-use confirmation link to the email address on the request. That link expires in 30 minutes. Before we send you a copy of your information, or correct or delete it, we also check that the request is yours against what your filing holds: the email address, the mobile number on your filing, your legal name and date of birth (for a correction, not the item you say is wrong), and a short declaration you sign under penalty of perjury. We email you how to complete those checks, which can include a code we text to that mobile number. We use what you give us for these checks only to verify the request and to prevent fraud.
WHAT AN ACCESS OR PORTABILITY RESPONSE WILL NOT CONTAIN. If we hold your Social Security number, a government-issued identification number, a financial account number, a health-insurance or medical identification number, a password, a security question and answer, or biometric data, we will tell you that we hold it, and which of those it is, but we will not send the value back to you. Connecticut law prohibits returning those values in an access response, and we apply the same rule to a portability response as our own commitment.
HOW LONG WE TAKE. We answer an access, correction, deletion, or portability request within 45 days of receiving it, counted from when the request arrives rather than from when verification finishes. A withdrawal of the sensitive-data permission is different and faster: we stop the processing it authorized no later than 15 days after we receive the request.
APPEALS. If we deny a request, you have 60 days to appeal. Once you appeal, we must answer you in writing within 60 days of receiving the appeal and tell you the reasons for the decision. Those are two different 60-day periods running in opposite directions: the first is yours to use, the second is our deadline to answer you.
HOW THE WORK IS ACTUALLY DONE. A correction, a deletion, or a withdrawal made through this channel is performed by a person at Terminal Tax and then recorded, with evidence, against your request. There is no automated correction or deletion facility, and a request is not marked fulfilled unless the person who did the work has recorded that they did it.
Your appeal is decided by the same person who made the original decision.
LIMITS. Correcting our records does not amend a return already filed with a taxing authority; that remedy is with the authority. Deletion is subject to filing, signature, tax, security, payment, dispute, and other legal retention duties. We will explain a material denial and the appeal or regulator-contact rights that apply.
18. SHARING WITH OTHER COMPANIES
What we collect is in section 2. What we disclose, and to whom, is in section 7.
We have no affiliates. We do not engage in joint marketing. We do not disclose your information to anyone for marketing purposes, and we do not disclose it to any third party for that party's own direct marketing.
The only recipients of your information are the service providers listed in section 7, the taxing authority, and, only if you sign the optional consent described in section 9, your AI assistant's company; each service provider and the taxing authority receives only what it needs to perform the filing you asked for. We do not offer an opt-out choice for those disclosures, because without them the filing you asked for cannot happen. If you believe a law gives you a choice we have not described, write to legal@terminal.tax and we will answer you.
We treat information about people who have stopped using the service exactly as we treat information about current users.
How we protect it is described in section 11.
19. STATE-SPECIFIC INFORMATION
CONNECTICUT. If you are a Connecticut resident, the Connecticut Data Privacy Act applies to our processing of your personal data. Your rights, the response periods, and the appeal process are in section 17. Your return carries a Social Security number or other taxpayer identification number; the statements section 2 lists under STATEMENTS THE LAW TREATS AS SENSITIVE, which can reveal a disability, health treatment, citizenship or immigration status, or religious belief, about you or about another person on your return; if you choose direct deposit, a financial account number; on an Ohio or West Virginia return, a driver's license or state ID number; and, on an Oregon return where you answer Yes on Form OR-VSI, data revealing racial or ethnic origin. We treat all of these as sensitive data and ask for your affirmative permission before processing them, as described in section 4, separately and never bundled into any other agreement. The permission that covers a statement about a spouse, a dependent, or another person on your return is yours, given as the filer of the return that carries it; we do not ask that person for one, except that a spouse who signs a joint return gives their own permission before typing their own sensitive information. We process those statements only to provide the filing you asked for, and only as far as that filing requires. Our treatment of the account number is stricter than the statute requires, deliberately. If we deny your appeal, we will give you the method to contact the Connecticut Attorney General.
CALIFORNIA. We do not sell or share personal information, and we do not disclose personal information to third parties for their own direct marketing purposes.
DELAWARE. This notice is provided under the Delaware Online Privacy and Protection Act.
NEW JERSEY. Terminal Tax LLC is a New Jersey limited liability company.
EVERYWHERE ELSE. We offer the rights in section 17 to everyone, regardless of where you live, subject to the limits stated there.
20. CHANGES
The version displayed and acknowledged in your filing session governs that filing. We do not silently replace the hash-bound version recorded in a completed evidence record.
If we change this notice, we publish the new version at terminal.tax/privacy with a new effective date and a new last-updated month and year, and the new version applies to filings made after that date. A change that materially affects how we handle information already collected requires fresh notice and, where the law requires it, fresh permission before that change is applied to you.
21. CONTACT
Privacy questions, rights requests, and appeals: legal@terminal.tax