TERMINAL TAX PRIVACY NOTICE
Last updated: October 2026
Terminal Tax LLC is a New Jersey limited liability company. Privacy questions, rights requests, and appeals: legal@terminal.tax
ABOUT THIS NOTICE
This notice describes how the service handles personal information when you use it. It governs the filing session in which it is shown to you, at the exact version and hash recorded there.
THE SHORT VERSION
Terminal Tax is the transmission wire at the end of a tax conversation you had with a separate chatbot or other agent. There is no Terminal Tax account, login, password, dashboard, return history, tax interview, advertising profile, or document upload.
Your agent sends the completed return before it gives you any link. We check that return mechanically. If anything we need is missing or cannot be filed, we tell your agent everything at once, keep none of that return except the fixed codes listed in section 5, such as the code of each problem found, and issue no link. Only once the return is complete do we hold it, sealed, and hand your agent one short-lived link for you. Until you acknowledge this notice and give the separate permission described in section 4, we do nothing else with that return except record the fixed codes listed in section 5, such as whether your link was opened. If you decline, we erase it at once; if the link expires first, it stops working at that moment and our daily retention job deletes the return. This order is safe for you: we ask for the return first only so that no link is ever issued for a return that cannot be filed, and a return held this way goes nowhere else and is never filed or charged for unless you yourself give that permission and then sign on the filing page. Once your return is bound to your filing session it is bound permanently and cannot be replaced.
Your agent cannot send us any Social Security number or other taxpayer identification number, your driver's license or state ID number, your Identity Protection PIN, your Wisconsin Identity Protection PIN, or a signing or prior-year PIN. You type those yourself, on our page, later. With the return, your agent may also send the identity details this filing needs: your name, address, date of birth, and occupation; on a joint return, your agent may also send the same details for your spouse, other than the address, which is the return's one address: your spouse's name, date of birth, and occupation; the names of the dependents on your return and the names of any other qualifying child for the earned income credit; the routing number, account number, and account type of the bank account for your refund or tax payment; on Form 8938, the account number of each foreign financial account and the identifying number of each other foreign asset; whether you filed a federal income tax return for last year, and whether you have ever filed one; your prior-year adjusted gross income; whether the IRS issued an Identity Protection PIN to you or to anyone else on your return, never the PIN itself; only if your return includes a Wisconsin return, whether the Wisconsin Department of Revenue issued you or your spouse a Wisconsin Identity Protection PIN, never the PIN itself; your mobile number and email address; on a joint return, whether your spouse filed a federal income tax return for last year and whether your spouse has ever filed one, and your spouse's prior-year adjusted gross income; for each W-2, the statement that the employee name, Social Security number, and address printed on it are your own (on your spouse's W-2, that the name and Social Security number printed on it are your spouse's and the address is yours), the employee name and address printed on a W-2 when they are not exactly yours or your spouse's, and the employer's state identification numbers printed in box 15 of each W-2; for each Form 1099-MISC, 1098, 1098-E, 1099-C, 1099-SA, and 5498-SA, the payer's, lender's, creditor's, or trustee's name, address, and telephone number printed on it; the property address printed in box 8 of a Form 1098; the payer's address printed on a Form 1099-R and whether its telephone number is a US number; the names, addresses, and other identifying details of the businesses, rental properties, schools, care providers, students and other people, insurance policies, and vehicles your return lists: your business's name, address, and employer identification number, and, for California Form FTB 3514, your business license number and your California state employer identification number, a rental property's address, a school's name, address, and employer identification number, a student's name, a care provider's name, address, and employer identification number and the amount you paid it, the name of each person you paid care expenses for and the amount, whether the IRS issued that person an Identity Protection PIN, a Marketplace policy number, and a vehicle identification number, never another person's Social Security number or taxpayer identification number; the name of a spouse filing a separate return, of a head of household qualifying person who is not your dependent, and of a parent on Form 8615, never their Social Security number; on a return for a person who died, the date of death, that person's prior-year adjusted gross income, whether the IRS issued them an Identity Protection PIN, and the personal representative's name; your home telephone number on Form 9465; your or your spouse's foreign address on Form 2555; the employer identification number of your household employment on Schedule H and of your farm on Schedule F or Form 4835; a donee organization's name and address on Form 8283; a clean vehicle's model year, make, model, vehicle identification number, and date placed in service on Form 8936; the partnership, corporation, and payer names and addresses printed on each Schedule K-1 and Form W-2G and the payer's state identification number on a Form W-2G, your statement that the partner, shareholder, or winner name and address printed on it are your own or your spouse's (or else the name and address as printed), and your statement that you hold the final form, never the identification numbers in boxes 11 and 12 of a Form W-2G; and, for each other source form, the payer's telephone number, the account number and the payer's state identification numbers printed on it, the payer's routing transit number printed on a Form 1099-INT, and your statements that you hold the final form and that the recipient name and address printed on it are your own or your spouse's (or else that name and address as printed). Our page shows each of them before you sign, at the latest in the complete return you review, except the IRS and Wisconsin Identity Protection PIN answers, which our page uses as given: when one is yes, our page asks you for that PIN itself. Your agent may send us the employer and payer identification numbers from your source forms, and the lender, creditor, trustee, partnership, and corporation numbers listed in section 2, each in the form of an employer identification number. Those numbers appear in your review on our page before you sign. Your agent never receives your return back from us, and never receives your possession code, your signing PIN, your prior-year authentication answer, or your card details.
We use return information only to mechanically check, calculate from the values supplied to us, secure, transmit, reconcile, acknowledge, and retain your filing as this notice describes; and, using only the fixed codes listed in section 5, to find and fix defects in the software that does those things and to measure and improve how well its filing session works; outside our hosting provider we use only those codes, the exact counts of requests that carry no return described in section 5, and totals of filings that each count ten or more returns, where no total and no difference between totals counts fewer than ten; for filings made under this version of this notice or a later one those totals may be broken down, for example by agent surface, step, or week, and dated, and our company may analyze them with an AI model provider; for filings made under this version of this notice or a later one, our company may also show that AI model provider, which helps us program and repair this software and has received the written notice sections 6713 and 7216 require of our contractors, exact totals of the steps, outcome codes, and blocker codes in section 5, including totals under ten, only to find and fix where the filing session fails; those totals never list or describe any one taxpayer, though a small total can be a count of one; for earlier filings they stay in steps of ten filings, with no breakdown and no dates. The one exception is a private page that only our company's owner can open, on his own computer: it shows him exact, dated totals of filings made under this version of this notice or a later one, such as how many were filed, accepted, rejected, or paid, and, counted only from the moment this version was first published at terminal.tax/privacy, totals of the links agents created and opened, of the requests and tool calls any agent's software made to us, by agent surface, and of their outcomes and blocker codes, including those that never led to a link, an acknowledgment, or a filing. It never lists or describes any one taxpayer, though a small total can be a count of one; these are our company's own statistics about its service. We do not sell personal data. We do not use it for advertising. We do not use it to train or evaluate any language model, and there is no language model in this service.
1. WHAT THIS NOTICE COVERS
It covers the Terminal Tax draft service, the hosted filing session, transmission to a taxing authority, the acknowledgement service and the filing-status emails we send you, the privacy-rights channel, security operations, and legally required records.
It does not cover the chatbot, agent, browser, device, taxing authority, telecommunications carrier, Stripe's own card fields, or Google's own use of the address section 7 says it receives. Their own notices govern what they do.
2. WHAT WE COLLECT
Your agent may give us your email address so that we can send your possession code when you open the filing page. The page links this notice before sending the code. We keep that address encrypted with the filing reservation, together with a keyed fingerprint and the records needed to send and check the code. The code email contains only the code and fixed instructions. We do not display your identity or return content until the code is verified.
FROM YOUR AGENT, in the order section 4 describes: the structured return and its schedules. That means the amounts, elections, and statements each form on your return needs - for example wages and withholding; self-employment, rental, partnership, and S corporation income; retirement, Social Security, interest, dividend, brokerage, unemployment, cancelled-debt, and other income; deductions and credits; the filing status and the tax year; a spouse's amounts and statements; each dependent's relationship, age, residency, and credit facts, never a dependent's name or number; the names and addresses of the employers, payers, and partnerships on your source forms; the employer and payer identification numbers from your source forms; and the statements of whether you are blind and whether you are 65 or older. Your agent also sends, in a separate identity section kept apart from the return until it is confirmed on our page, the identity details listed in the short version of this notice. The identification numbers your agent may send are: the employer identification number from each W-2; the payer's identification number from each 1099, RRB-1099, and W-2G; the lender's identification number from each 1098 and 1098-E; the creditor's identification number from each 1099-C; the trustee's identification number from each 5498-SA; the partnership's or corporation's identification number from each Schedule K-1; and your own employer identification number as a household employer, for Schedule H. Your agent sends each of these in the form of an employer identification number. For California Form FTB 3514, your agent may also send your business license number and your California state employer identification number (SEIN). The filter refuses a payer's or lender's number sent in the form of a Social Security number, and a W-2G payer's number described as a Social Security number, even when the payer or lender is an individual. For a W-2G, your agent may also send the statement that the payer's number is an employer identification number.
Those last two are required and are never inferred. Your agent must state each one explicitly as true or false on every return. A return that leaves either blank is refused. They set the size of your standard deduction, and we will not read a blank as "no" or derive the age answer from your date of birth.
STATEMENTS THE LAW TREATS AS SENSITIVE. Your agent may also send statements that privacy laws treat as sensitive, where the forms ask for them: whether you, and a spouse on your return, are blind, for the tax year and, when a state or local income tax refund needs an earlier year's worksheet, for that earlier year; whether a dependent listed on your return is permanently and totally disabled; the distribution codes on Forms 1099-R and 1099-SA, which can show that a payment was made because of a disability; on Form 2441, whether a spouse is treated as having income because the spouse was a student or disabled; on Form 8853, amounts distributed after death, disability or age 65; on a state return, where its forms ask: whether you, a spouse, a child or another household member is disabled, severely disabled, or permanently and totally disabled, whether a veteran is totally disabled or how many disabled veterans the return claims, veterans' disability compensation your household received, whether your or your spouse's Social Security benefits were disability income for the whole year, which dependents have a developmental disability certification, and how many individuals with permanent disabilities you or your spouse supported; amounts paid for medical and dental care, for health and long-term care insurance, and to or from a health savings account; what kind of taxpayer identification number you, a spouse, and each dependent has, and whether your or your spouse's Social Security number is valid for employment; on a married return with a nonresident-alien spouse, whether the spouse is a nonresident alien and the related statements the form asks for; on Form 8862, whether each child or dependent it lists is a United States citizen or national; on Schedule 3-A, which a return claiming the earned income credit, the additional child tax credit or the refundable American opportunity credit files from tax year 2026, whether you or your spouse is a United States citizen, United States national, or qualified alien; and, on Schedule EIC, whether you file Schedule SE as a member of the clergy. Your agent states each of these; Terminal Tax neither infers nor verifies them.
ONLY IF YOUR RETURN IS A FORM 1040-NR: your agent sends with the return, in a separate section apart from it, the answers Schedule OI (Other Information) asks for: the countries of which you are a citizen or national; the country where you are a resident for tax purposes; whether you ever applied for a green card, and whether you were ever a United States citizen or a green card holder; your visa type or United States immigration status on the last day of the tax year, and whether and when it changed during the year; the dates you entered and left the United States during the year, or that you commute regularly from Canada or Mexico; the number of days you were present in the United States in each of the last three years; whether and when you last filed a United States income tax return, and on which form; and its statements about a trust, compensation of $250,000 or more, a treaty exemption, and a section 871(d) election. Privacy laws treat citizenship and immigration status as sensitive. Your agent states each answer; Terminal Tax neither infers nor verifies them, uses them only to file Schedule OI with your Form 1040-NR, shows them in the return you review and sign on our page, and never sends them back to your agent.
WHAT YOUR AGENT CANNOT SEND US. A versioned filter stands in front of the return and refuses the whole packet, before anything is stored or calculated, if it contains your own Social Security number, individual taxpayer identification number, or adoption taxpayer identification number, your driver's license or state ID number, your Identity Protection PIN or Wisconsin Identity Protection PIN, a signature value, or card data. It also refuses your name, address, date of birth, occupation, bank routing or account number, email address, or phone number anywhere in the packet except the separate identity section described above, and it refuses any taxpayer identification number there too. It also refuses any field labelled as genetic, biometric, health, medical, citizenship, immigration-status, or precise-location data, except the Schedule OI answers of a Form 1040-NR described above, which it accepts only in their own section; like the rest of the return, we hold them sealed and use them only after your permission. It does not refuse the statements listed under STATEMENTS THE LAW TREATS AS SENSITIVE above, because the forms themselves ask for them; and it refuses the disability answers on Schedule EIC and on Form 2441's list of qualifying persons, because the service does not file those answers. You type your identification numbers to us directly, in the filing session, and not through your agent.
Information that describes a business or a property, such as a sole proprietorship's name and address, a rental property's address, or the property address printed in box 8 of a Form 1098, is often your own name or home address, so the filter refuses it anywhere in the return itself. Your agent may send the business and property details the short version of this notice lists only in the separate identity section described above, and our page shows each of them to you before you sign, at the latest in the complete return you review. Any such value the return needs that is not on that list, you supply yourself on our page, in the step built for it. The employer and payer identification numbers listed above are different: your agent sends those with the return, and your review on our page shows them.
FROM YOU, typed into or confirmed on the Terminal Tax page: your Social Security number or taxpayer identification number; your legal name, date of birth, occupation, and mailing address, the routing number, account number, and account type for your refund or tax payment, and your mobile number and email address, each either typed by you or sent by your agent and confirmed by you; either your six-digit IRS Identity Protection PIN or your statement, typed by you or sent by your agent, that none was issued; your confirmation that you hold the final forms, and for each source form the details the short version lists, each either typed by you or sent by your agent and shown to you before you sign; whether you filed a federal income tax return for last year and whether you have ever filed one, either answered by you or sent by your agent and confirmed by you; your acknowledgements and permissions; your Self-Select PIN; your prior-year adjusted gross income or prior-year Self-Select PIN; and, where the return needs them, the details the short version lists for the businesses, properties, and other people your return lists, each either sent by your agent and shown to you before you sign, or typed by you, and the Social Security numbers and other taxpayer identification numbers of a spouse, a dependent, or another person it lists, and any Identity Protection PIN issued to one of them, which a signer types on our page, as section 16 describes. Our page never asks you to type again the recipient's identification number printed on one of your own source forms: it uses the Social Security number you typed.
ONLY IF YOUR RETURN INCLUDES AN OHIO INDIVIDUAL INCOME TAX RETURN, and only if you choose to: your driver's license or state ID number and issuing state, and its issue and expiration dates if you enter them, or your statement that you do not have a driver's license or state ID. Ohio asks tax software to request this to combat stolen-identity tax fraud; it does not reject a return without it. This step is optional: if you choose nothing, nothing about it is collected or sent. We use it only to file it with your Ohio return, we show it to you in the return you review and sign, and we never send it to your agent.
ONLY IF YOUR RETURN INCLUDES A WEST VIRGINIA INDIVIDUAL INCOME TAX RETURN: your driver's license or state ID number, issuing state, issue date, and expiration date. West Virginia asks for the primary taxpayer's on the return, so this step is required: you enter your driver's license or state ID, or say that you have neither or that you choose not to provide one, and we file that answer with your West Virginia return. On a joint return your spouse is asked for the same only if West Virginia's return has a place for a spouse's, and then may continue without entering one. We use them only to file them with your West Virginia return, we show them to you in the return you review and sign, and we never send them to your agent.
ONLY IF YOUR RETURN INCLUDES A MICHIGAN OR MAINE INDIVIDUAL INCOME TAX RETURN: we do not ask for your driver's license or state ID. Your Michigan return says you did not provide them, which Michigan accepts, and nothing about them is sent to Maine, which does not reject a return without them.
ONLY IF YOUR MICHIGAN RETURN IS FILED WITHOUT YOUR FEDERAL RETURN: to sign it electronically, the adjusted gross income (or total household resources) and the refund or amount owed shown on your Michigan return for the previous year, which Michigan uses to confirm that the return is yours. They are typed on our page, for each of you on a joint return, and never accepted from your agent. We use them only to sign that Michigan return, we show them to you in the return you review and sign, and we never send them to your agent.
ONLY IF YOUR RETURN INCLUDES AN OREGON PERSONAL INCOME TAX RETURN: your Yes or No answer to whether you want to provide race or ethnicity data on Oregon's Form OR-VSI, and, only if you answer Yes, the race or ethnicity codes you choose. Oregon requires tax software to offer this form to every Oregon filer; completing it is voluntary and does not change your tax. If you answer No, nothing about it is sent to Oregon. We use your answer only to file Form OR-VSI with your Oregon return, we do not keep or use it beyond what filing that form requires, as Oregon law (ORS 305.686) directs, and we never send it to your agent.
ONLY IF YOUR RETURN INCLUDES A WISCONSIN INDIVIDUAL INCOME TAX RETURN: your Wisconsin Identity Protection PIN, six digits followed by the letter W, only if the Wisconsin Department of Revenue issued you one, or, when your agent did not say whether it did, your answer that it did not. Wisconsin's electronic return has a place for the primary taxpayer's and for a spouse's, so on a joint return your spouse is asked the same. You type the PIN yourself on our page; your agent sends only whether one was issued, never the PIN, and if your agent says none was issued we ask nothing. We use it only to file it with your Wisconsin return, we show it to you, masked, in the return you review and sign, and we never send it to your agent. If you choose to register as an organ and tissue donor on Schedule 3 Part II of your Wisconsin return, your agent may send that choice and your sex with the return, and on a joint return your spouse's choice and sex; Wisconsin's form also asks for the date of birth, which is the one your agent sends or you confirm as described above. We use them only to file them with your Wisconsin return and we show them to you in the return you review and sign.
ONLY IF YOUR RETURN INCLUDES AN ILLINOIS INDIVIDUAL INCOME TAX RETURN: your Illinois signature alternatives, which Illinois requires to sign its electronic return: your IL-PIN, the Illinois adjusted gross income shown on your Illinois return for the previous year, and your Illinois driver's license or state ID number, names, suffix, and weight exactly as printed on the card, or, for each, your statement that it does not apply to you. On a joint return your spouse enters their own. We use them only to sign and file your Illinois return, we show them to you, the IL-PIN and card number masked, in the return you review and sign, and we never send them to your agent.
PRODUCED BY THE SERVICE: filing-session identifiers, the immutable hash of your return, the version and SHA-256 of every notice, permission, terms text and declaration shown to you, timestamps, the result of the email possession check, a keyed correlation of the network address a request came from, your reported time zone and UTC offset at the moment you signed, audit records, and the fixed measurement codes section 5 lists. Two of those codes come from the user-agent header that software sends with each request: which agent surface created your link, from the header your agent's software sends, and your browser family, from the header your browser sends. We keep only the code, never the header.
WE COLLECT LIMITED DEVICE SIGNALS FOR SECURITY: the filing page reads your browser's user-agent string and basic device characteristics and computes a security fingerprint from them. We keep only the fingerprint digest as sealed security evidence; the underlying characteristics never leave your browser. Separately from that fingerprint, our server reads the user-agent header your browser sends with every request and keeps from it only the browser family section 5 lists. The IRS requires the network addresses involved in preparing and filing your return, including the one your filing came from, to be carried inside the return. We hold those addresses encrypted in your filing session records, transmit them inside the return, and keep them with the return. Those encrypted records are kept or deleted as section 10 describes, including when no return is sent. Other than in those encrypted filing records, our database keeps network addresses only as keyed correlations, which section 6 explains. Separately, the request logs of our application host record the network address each request came from; where those logs are held in our own cloud account, they are kept for up to 30 days, for security and incident response.
FROM STRIPE: whether a usable card exists for this filing session, and the authorization, capture, and release status of the charge. Never a card number and never a card security code. No Terminal Tax endpoint accepts one.
FROM GOOGLE, only for a return that includes a Louisiana individual income tax return for tax year 2026: whether United States Postal Service records confirm the mailing address you saved on our page, and, when USPS writes a deliverable address differently, its USPS form, which our page shows you to accept or retype. We do not store the USPS form Google returns; we keep only the address you then save.
FROM THE TAXING AUTHORITY: the acknowledgement, its submission identifier, and any rejection rule codes.
3. YOUR SOURCE DOCUMENTS STAY WITH YOU
There is no upload box, document vault, scanning intake, or document-custody service, and our filing page never asks you for a document. We receive the numbers your agent extracted, not your W-2s, 1099s, receipts, statements, scans, or photographs.
There are two exceptions. First, only if a state return we file for you requires one of your own documents attached, your agent may send that document to us, as a PDF, with your return. An example is the Form 1099-RRB that West Virginia requires when its return subtracts railroad retirement income. We take only a document that the state's own rules require for something your return claims. We do not read it or use it to calculate anything; we attach it, as it is, to that state's electronic return, which travels through the IRS electronic filing system to that state, and it goes to no one else. It is encrypted when stored and erased with your return's contents (section 10). We do not accept any such document yet: until we do for a given state, a return that needs one is refused before any filing session, and the refusal names the document.
Second, only if the federal return we file for you requires one of your own documents attached, your agent may send that document to us, as a PDF, with your return. An example is the court certificate showing a personal representative's appointment, which the IRS requires attached when a court-appointed or court-certified personal representative files the return of a person who died and claims its refund. We take only a document that the IRS's own rules require for something your return claims. We do not read it or use it to calculate anything; we attach it, as it is, to your federal electronic return, which goes to the IRS, and it goes to no one else. It is encrypted when stored and erased with your return's contents (section 10).
4. THE PERMISSIONS THAT COME BEFORE WE USE YOUR RETURN
THE ORDER. Your agent sends the completed return first; we check it mechanically in memory and, if anything is missing or cannot be filed, answer with every problem at once and keep none of it except the fixed codes listed in section 5; only a complete return is held, sealed, and only then does your agent receive your link. Every filing takes this order, a Form 1040-NR included: its Schedule OI answers come with the return and are held sealed with it.
FIRST, THIS NOTICE. Your agent hands you a link. The page shows you this notice at its exact version and hash and records that you acknowledged it. Acknowledging this notice confirms that you received and read it. It is not permission to do anything, and it is not a consent.
SECOND, PERMISSION TO KEEP AND USE THE RETURN AT ALL. On the same page you give a separate permission - its own text, its own version, its own hash - for Terminal Tax to keep and mechanically process the tax facts your agent assembled: the return your agent already sent, which we have held sealed and used for nothing else except the fixed codes listed in section 5. Nothing is prefilled. If you decline, the return held for you is erased at once; if your link expires first, it stops working at that moment and the daily retention job deletes the return. This permission is yours and no one else's. It does not claim authority for a spouse, a child, a dependent, or anyone else, though it does cover the facts about them that your own return carries, including the sensitive statements section 2 lists; it is not the permission of the person a statement describes. On a joint return this page shows this notice once for both of you; your spouse does not give this permission, and the third permission below is recorded for your spouse from it, as section 16 describes. You can withdraw this permission with the Withdraw permission and stop filing button, from the moment you give it until finalization of your signed return begins; withdrawing it after your return is bound to your filing session ends the session and erases that return.
THIRD, PERMISSION TO COLLECT THE VALUES YOU TYPE OR CONFIRM YOURSELF. Later in the session, after your possession code is verified and before we accept your Social Security number or Identity Protection PIN, or use the date of birth or bank details your agent sent or you type, or, for an Ohio or West Virginia return, driver's license or state ID details, or, for a Wisconsin return, your Wisconsin Identity Protection PIN, or, for an Oregon return, race or ethnicity data, this third permission must be in place. The same holds before we accept, for a Michigan return, the previous year's Michigan figures you type to sign it. The same holds before we accept, for an Illinois return, the Illinois signature alternatives you type to sign it. The second permission names those values, so when your code is verified the page records the third permission from it, with no new act and no separate screen. On a joint return it is recorded the same way for your spouse, who is not asked for a separate permission, as section 16 describes.
You can withdraw the third permission at any time until finalization of your signed return begins. Withdrawal is not a pause. It ends the filing session, consumes the draft so it cannot be used to file, and erases the sensitive identity, authentication, driver's license or state ID, race or ethnicity, source-form, bank, review, and signature values held for it, keeping only the record that you gave the permission and the time you withdrew it. It erases the return your agent sent too.
5. WHY WE USE INFORMATION
To create and protect a short-lived reservation and filing session.
To verify possession of your email address, and to record identity, review, permission, declaration, PIN entry, and prior-year authentication.
To mechanically check what your agent sent and to calculate deterministically from the values it supplied - never to supply a value it left blank.
To generate, transmit, and reconcile the return.
To tell you what the taxing authority said, and to support a correction after a rejection.
To authorize, capture, or release the filing charge.
To prevent fraud, duplicate filing, abuse, and security incidents.
To comply with tax, recordkeeping, consumer, privacy, security, and lawful-process obligations.
To answer and evidence privacy-rights requests and appeals.
To find and fix defects in the filing software, and to measure and improve how well the filing session works, for example where filings stop, how long a step takes, and which steps fail. For this we use only fixed codes our software assigns: the taxing authority's acceptance or rejection, its rejection rule codes and the return form family they belong to, and whether the filing charge was captured; our own server error and refusal codes; for each request the filing page or your agent's software makes to us, whether answered, refused, or not completed, its route with any identifier removed, its method, its status code, our own code for the answer, and which of four fixed bands our server took to answer it: under 1 second, 1 to 5 seconds, 5 to 30 seconds, or over 30 seconds; the class of any database error; positions in our own page code where a page error happened (the name of our script file, a line and a column), and the type of a page error, such as TypeError; each step of the filing session reached and completed, and which of four fixed timing bands the time on that step fell in: under 1 minute, 1 to 5 minutes, 5 to 30 minutes, or over 30 minutes; which of the same four bands passed between your agent creating your link and the link being opened, or that it was never opened; which of the same four bands passed between your agent creating your link and your signing; the name of each of our tools your agent's software called, the outcome of that call, and the fixed code of any blocker it was given; whether a possession code was sent, checked, or failed; whether Stripe's card fields in the filing page were opened, and whether a card was then saved, cancelled, or not added; which controls of the filing page were used, by fixed name only: pressing a step's button, going back, reloading, leaving, or returning to the page, asking for a new code or changing where it is sent, choosing to change a detail your agent sent (only which section, such as your identity or a bank account, never the detail), and opening or closing a folded text such as your complete return or this notice, and whether each was the first of its kind in that browser tab; the fixed kind of any problem message the page showed, such as a code that did not match, never its words; how the filing session ended on the page: filed, expired, withdrawn, declined, opened elsewhere, or left; when a joint return passed from one spouse to the other on the page; which version of this notice was recorded for your filing session, and which version our service was showing when each code was recorded; and which agent surface (ChatGPT, Claude, Gemini, or any other agent or direct connection) and browser family (Chromium-based browsers such as Chrome and Edge, WebKit browsers such as Safari, Firefox, or other) the session used. We record these for every filing session, not only one that hit a problem, and we never ask you to report a problem or answer a survey. Those codes carry no figure from your return, no name, no identifier, and nothing you typed, though a blocker or rejection code can show that your return included a particular form or situation. Inside our hosting provider we keep them with the filing session they came from, for as long as section 10 keeps that session's records, and in our logs for 30 days; four totals, of server errors on the filing page, of page errors and stalls, of possession-code refusals, and of failed tool calls, with no breakdown, are kept in our hosting provider's metrics service, which cannot delete them and keeps them for 15 months; other totals are counted from those logs when we look. To measure and improve the session we look only at totals, including totals by agent surface and browser family; to fix a defect we may also look at the codes of the filing session where it happened. We never use these codes to contact you, to change your filing session, or to tell your agent or anyone else anything about you. Requests that carry no return are not part of any filing and carry no information about you: reads of our public pages and discovery documents, connections to our tool server and reads of its tool list, and calls of our two tools that take no tax facts, the one that starts a filing session and the one that returns the packet schema. We count those exactly, by time, kind, outcome, and agent surface, and, for a public page, the site that linked to it, only as chatgpt.com, claude.ai, google.com or other. Those counts may leave our hosting provider, including to an AI model provider our company uses to analyze them. The one exception is the private page described in THE SHORT VERSION, which only our company's owner can open, on his own computer: it shows him exact, dated totals of filings made under this version of this notice or a later one, including totals of these codes for those filings, and, counted only from the moment this version was first published at terminal.tax/privacy, totals of these codes for every link, request, and tool call, including those refused before any link was issued and those that never led to an acknowledgment or a filing. It never lists or describes any one taxpayer, though a small total can be a count of one. Apart from that page, what leaves our hosting provider is only those codes, the exact counts of requests that carry no return described above, the totals of ten or more returns THE SHORT VERSION describes, the exact totals of steps, outcome codes, and blocker codes, including totals under ten, that THE SHORT VERSION lets our company show the AI model provider that helps us program and repair this software, for filings made under this version of this notice or a later one, and the general operational alert email described next. When one of these measures reaches its threshold, ten or more events of that kind within fifteen minutes, which a single filing session can cause, our hosting provider records that inside our account and counts it as one alert. The email that then reaches us is our general operational alert: it names no measure, no code, and no filing session, and says only how many alerts of any kind our system read in a five-minute period and when.
We do not use return information for targeted advertising, sale, lead generation, unrelated analytics, data-broker activity, credit decisions, or model training.
6. FRAUD AND BULK-FILING CHECKS ACROSS RETURNS
IRS e-file rules require an online filing service to protect itself against bulk filing of fraudulent returns and to limit how many returns it accepts from one email address and one phone number. We meet the first with the single-use code we send you before your return can be filed, and the second with the contact limits described below, which count across returns. No other comparison of your return with another filer's runs.
To make these comparisons without keeping a searchable copy of anyone's Social Security number or bank account, we compute a keyed fingerprint - a digest made with a secret key of ours, separate from the encryption keys that protect your return - of the taxpayer identifier, the refund account, the email address and phone number you gave, and the network address at the moment of transmission. These fingerprints are not anonymous. Someone able to compute fingerprints with our secret key could test guessed values against them, including possible Social Security numbers. We keep the fingerprints with the records described in section 10.
THE CONTACT LIMITS. For one tax year we accept at most five returns that give the same email address, and at most ten that give the same mobile number. A filing past either limit is refused before any payment is authorized; the refusal says that a limit was reached, not which one.
These limits use only a count of other filers' matching email and phone fingerprints. No other filer's fingerprint, identifier, or fact is read out or shown to anyone, and only our own operators see the counts. Within your own return, the same fingerprints are also compared among the people who sign it.
IRS e-file rules also require a provider that transmits more than 2,000 individual income tax returns in a year to analyse them for identity-theft patterns and report the results to the IRS weekly, following requirements the IRS says it will distribute. Our production system does not produce that report. If we come to owe it, a new version of this notice will describe it before we send one.
7. WHO RECEIVES YOUR INFORMATION, AND EXACTLY WHAT
THE TAXING AUTHORITY receives the filed return and its transmission envelope. That is the point of the service.
OUR APPLICATION HOST holds your return, and the contact details you or your agent give us, in memory while a request is being processed, and passes encrypted records through. Its request logs record the network address each request came from.
OUR DATABASE HOST holds the encrypted return, contact, signature, and filing records, and the operational log rows.
AMAZON WEB SERVICES receives your information through several of its services, each described below.
Its Key Management Service receives encryption-key operations: requests to create and to unwrap data keys, each with an encryption context naming our application, the envelope purpose and identifier, and, for test records, the record type; and requests to sign our own sign-in messages to the taxing authority, which carry our identifiers and no return content. It also receives requests for the public half of our signing key, which carry only the key's identifier. It never receives the encrypted data those keys open, so no return content reaches it.
Its CloudTrail service keeps a record of every management request made in our account, in every region: each request that sets up, changes, or reads the settings of one of our services, and each Key Management Service request described above. A record carries the time, the role or operator of ours that made the request, the request's terms, and where it came from, which is one of our systems, one of our operators, or Amazon itself, never your device. For a Key Management Service request, the terms include the encryption context, so a record can carry the envelope identifier of an encrypted record of your filing. When one of our operators searches our logs, the record carries the search terms, which can include an identifier of your filing, such as its Submission ID. Records of our systems' own requests carry no return content, figures, or contact details. CloudTrail does not record the email we send or the alerts we publish. Amazon Web Services keeps these records for us for seven years, in its storage service and its log service, in a United States region, and shows the last 90 days of them in its own event history for our account. Rules we set forward a few kinds of these records, whole, to our alert topic, described below: refused key requests, and changes to our keys, roles, database, network rules, logs, alarms, and alert rules.
Its container service runs our transmission worker, in a United States region. To transmit your return, the worker decrypts the complete signed return in memory and sends it to the taxing authority. To send you a filing-status message, it decrypts the stored email address and phone number you gave, and uses only the email address. The worker's logs, which Amazon Web Services keeps for us for 90 days, carry counts, fixed states, and fields drawn from the same fixed list as the operational alerts described next, including the Submission ID. If the worker process itself stops on an error, they also carry the error's type, a machine code when the error message is already one, and short digests of the error messages. They never carry return content, figures, or contact details.
Its Simple Notification Service receives our operational alerts, in a United States region. An alert can carry the event name, its level, a timestamp, request, transmission, finalization and filing-session identifiers, an HTTP method, a normalized path, a status code, fixed action and error tokens, a resource token, the taxing authority's Submission ID for your filing, the payment authorization identifier from our payment processor, the name of a provider, a retry flag, the tool name, a fixed code and reason, a database error-class code, browser stack positions, digests of the cause and message, a reviewer-lane-only detail field, and an audit-gap count. It carries no return figure, no name, no Social Security number, no bank detail, no email address, and no phone number: the fields are enumerated by name in code, so a new field cannot ride along silently. The Submission ID is the taxing authority's identifier for your specific filing, and we treat it as tax return information.
THE EMAIL PROVIDER is Amazon Web Services' Simple Email Service, in the United States East (Northern Virginia) region. It receives your email address, our sender address, the subject and plain-text message, the name of our email configuration, and an opaque identifier for the sending attempt. For a possession-code message, the body contains a one-time code and fixed instructions for using it, with no return content, taxpayer name, Social Security number, bank detail, or tax figure. For a filing-status message, the body states whether the taxing authority accepted, rejected, or reported a duplicate; the date; the Submission ID; rejection rule codes and our fixed explanations; any applicable paper-filing or Form 8453 instructions; whether your card was charged and the charge amount; and any applicable electronic-withdrawal outcome, cancellation instructions, and deadline. A filing-status message also goes once the taxing authority has received your return, before its answer; its body states the tax year and form of the return; when it was signed and when it was sent; that we will email the taxing authority's answer; the filing charge and that it is charged only after acceptance; and, when applicable, the electronic-withdrawal amount and date and the last four digits of its bank account, or the refund amount, whether it is paid by direct deposit or paper check, and the last four digits of the deposit account. It contains no Submission ID, Social Security number, or full account number. For a privacy-rights message, it contains a single-use link and the kind of request it concerns. Every filing-status message is tax return information. Under AWS's terms, AWS or its third-party providers may store and scan these messages to prevent harmful or unwanted email; that provision gives no retention period and does not identify those third-party providers or their locations.
AWS also sends message-event records through its notification and queue services. These records can contain the recipient address and original message headers, including the subject, but no message body. Delivery failures and complaints can include the receiving mail system's report. Our queue retains an unprocessed record for up to 4 days, or up to 14 days in its failed-processing queue. When our service processes a record, it stores the opaque attempt and provider message identifiers, event type, time, and a digest; it discards the address, headers, subject, and report. Our sending records contain a keyed recipient fingerprint and keyed message binding instead of the address or message. A permanent bounce or complaint marks that fingerprint to prevent further sends. AWS separately maintains an account suppression list containing affected addresses and reasons; addresses remain until removed, except that AWS automatically deletes them after our sending ability has been paused for 90 days. Our service does not remove them. AWS also adds hard-bounced addresses to its global suppression list.
MESSAGES PREVIOUSLY SENT THROUGH POSTMARK. Our former email provider, Postmark, is operated by AC PM, LLC, part of ActiveCampaign. Messages it already received remain subject to its handling and retention. Postmark stores message content and delivery events for 45 days. It offers account owners a way, which its support must first enable, to request earlier erasure of a recipient's data; our service does not make that request automatically. It keeps permanently bounced or spam-reported addresses on its suppression list, without the message and without an end date, and keeps sending statistics without an end date. We retain its message identifiers and the spending records described in section 10. Postmark says it hosts data with Amazon Web Services and at a Deft data center outside Chicago; its terms allow processing in the United States and other countries. Those terms allow it to view, copy, and internally use message content, and to use recipient addresses, to train and improve its service and detect issues. Changing our provider does not erase information Postmark already holds.
STRIPE receives an opaque customer reference, a filing-session reference, a purpose label, the amount, and the description "Terminal Tax service". Our servers send Stripe no name, no email address, no tax figure, and no return content. You type your card details into Stripe's own card fields shown inside the filing page. Those fields do not ask for your email address, and we do not give Stripe yours. Anything you type into Stripe's fields is governed by Stripe's notice.
GOOGLE (Google LLC) receives, only when your return includes a Louisiana individual income tax return for tax year 2026, the mailing address you save on our page: the street, any apartment or unit, the city, the state, and the ZIP code. Its Google Maps Platform Address Validation service checks that address against United States Postal Service records, because Louisiana requires e-file software to validate and standardize a filer's mailing address under USPS standards before the return is filed. Google receives no name, Social Security number, return, form, or figure, and the request comes from our server, not from your device. Because we send a request only for such a return, a request tells Google that someone is filing one through Terminal Tax. Google does not act only on our instructions: its terms for this service let Google and its affiliates use and retain this data to provide and improve Google products and services, subject to the Google Privacy Policy at https://policies.google.com/privacy, and that policy says Google may process information on servers outside the country where you live. That use is Google's, under its terms, not ours. When this version of this notice took effect, the service filed no Louisiana return and had sent no taxpayer's address to Google.
THE AI MODEL PROVIDER that helps us program and repair this software receives, for filings made under this version of this notice or a later one, the exact totals of steps, outcome codes, and blocker codes that THE SHORT VERSION describes, including totals under ten, only to find and fix where the filing session fails. It receives no return, no figure from a return, no name, no contact detail, and no identifier, and it has received the written notice sections 6713 and 7216 require of our contractors. Its setting that would let it train its models on our sessions is off; its own terms still let it train on material flagged for its safety review.
LAW ENFORCEMENT, REGULATORS AND COURTS receive only what law requires or what is necessary to protect rights and security.
YOUR OWN AGENT receives only a link and the field names of mechanical blockers with our fixed explanations. If a packet cannot replace an earlier filing, it receives the same recovery guidance regardless of that filing's phase. It receives no signing, transmission or taxing-authority result from us: your filing page and our email provide that information to you. No return content, no figure, no identity value, no signature value, no payment state, and no raw text from the taxing authority crosses that boundary.
OUR MAILBOX PROVIDER receives what you write to legal@terminal.tax, and what we write back, and keeps it in our mailbox. Section 17 asks you not to put a Social Security number, a PIN, a code, a bank account number, a return, or an identity document in an email to us.
OUR SUPPORT PHONE LINE only takes messages; it never connects you to a person. If you call it, Amazon Web Services' Amazon Connect service receives your phone number and records what you say, and keeps its own record of the call, with your number and the call's times, for 24 months. Its Amazon Transcribe service turns the recording into text and removes the Social Security, PIN, bank and card numbers it recognizes; we then replace any remaining number shaped like a Social Security number and email the text, your number, and the time of the call to our support mailbox, which our mailbox provider keeps. Do not say a Social Security number, a PIN, a code, a bank or card number, or details of your return in a message.
Some of the recipients above are described by role rather than by name, so that changing a supplier does not require reissuing this notice. If you want the current names, write to legal@terminal.tax and we will tell you.
8. WHERE YOUR INFORMATION IS PROCESSED
Our providers, and Google for the address check section 7 describes, may process, support, back up, replicate, or subprocess information outside the United States. None of them has given us a commitment that your information stays in the United States.
9. INTERNAL REVENUE CODE SECTION 7216
We treat return information as protected by sections 7216 and 6713 of the Internal Revenue Code. Ordinary processing, electronic filing, acknowledgement, security, payment, and required retention rest on specific exceptions in the regulations rather than on your consent. An exception is not permission for a broader use, and we do not use one that way.
THIS NOTICE IS NOT A SECTION 7216 CONSENT AND CANNOT BECOME ONE. A valid consent must be a separate written document, specific about recipient and purpose, signed and dated by you, and never a condition of filing.
The service asks you for no section 7216 consent. If one is ever required, it will be asked for separately, on its own screen, in the form the regulation requires.
10. RETENTION
Terminal Tax is not a return-history or document-storage product.
EXPIRED MEANS UNUSABLE FROM THAT MOMENT: an expired filing draft, reservation, capability, or credential stops working the instant it expires — every read re-checks the expiry, so nothing expired can be used again. DELETED ON SCHEDULE: a retention job purges expired filing drafts and the capabilities that pointed at them, expired browser and filing sessions, expired integration authorization records, rate-limit counters two days after they stop mattering, delivered operational events after 90 days, and undeliverable operational events after one year. The job runs every day.
KEPT, AND FOR HOW LONG: returns, signatures, transmissions, filing identities, audit records, and the permission, legal-text and payment evidence attached to them. For the email we send you, we also keep the sending records, message-event records, and do-not-send fingerprints described in section 7, none of which contains your email address or message body. A sending record for a possession code, with its message-event records, is deleted 90 days after the later of its last update and its last message event, once the code can no longer be sent or retried and its provider charge has settled. A sending record for a filing-status message, with its message-event records, is deleted with the proof of what was done for the filing it reported, and one for a privacy-rights message with the privacy-rights records of its request, both described below. A do-not-send fingerprint is deleted 2 years after the latest of when it was written, when a later bounce or complaint marked it again, and when it last stopped a send. For messages previously sent through Postmark, its identifier for a filing-status message is deleted with the proof of what was done for the filing it reported, described below, and its identifier for a privacy-rights message with the privacy-rights records of its request. Provider spending records are separate: they are deleted 90 days after they were last changed, except that a card-payment settlement record is kept for 18 months, an unsettled record remains until settlement, and a legal hold prevents deletion. Our adopted retention schedule sets the other periods listed below. The CloudTrail records described in section 7 are kept for the seven years stated there. In this section, the "filing year" is the later of the year your return was sent and the year its final acknowledgement from the taxing authority arrived. "Disposition" is the first of these: the return is accepted; it is rejected and no correction can still be claimed against that rejection; you withdraw; or the filing session ends without the return being sent. A filing that is never sent has no filing year, and its records are kept as follows instead. A filing is never sent when no transmission record was made for it, and its never-sent date is when its filing session, or a reservation no filing session reached, ended or expired. Its return contents, the network-address record from when its filing link was first opened, and the keyed fingerprints left on its records are erased 90 days after that date, and the proof of what was done for it is deleted 18 months after the later of that date and the release of its last payment authorization. Nothing of such a filing is erased while one of its payment authorizations is neither released nor captured, or while a fraud-review hold on it is open. A filing whose every send failed before the taxing authority received it, with no further send permitted, has as its filing year the calendar year in which its last send failed, and that failure is its disposition.
YOUR RETURN'S CONTENTS are erased at the later of December 31 of the filing year and 90 days after disposition. That covers the figures; the names and identification numbers and, where the return carries them, the dates of birth, occupations, and addresses of you, your spouse, your dependents, and the other people and businesses on the return; any driver's license or state ID details; your Identity Protection PIN answer and any Wisconsin Identity Protection PIN or answer; any Illinois signature alternatives; your source-form confirmations; your state answers; any document your agent sent for a state or federal return; your bank instructions; the complete review you approved; the email address and phone number you gave for the filing; and the network addresses and the device fingerprint digest recorded for your filing. Terminal Tax never signs a return as its paid preparer, so it keeps no list of returns under section 6107 of the Internal Revenue Code, which requires one only of a signing preparer.
PROOF OF WHAT WAS DONE FOR YOUR FILING is deleted at the later of December 31 of the filing year and 18 months after the latest of: your payment being captured, your payment authorization being released, and disposition. That covers your sealed signature record (the declaration you signed, your name, the figures it attests, when and by whom it was entered, the kind of prior-year answer you gave, and the possession check it seals); your acknowledgement of this notice and your acceptance of the permissions, terms, and declaration, each with its version and hash; the record that your spouse was shown this notice; the possession-check results; the hash of the review you approved; the digests that tie the return you reviewed and signed to the one that was sent; and the transmission record, including the taxing authority's rule messages, the Submission ID, and the acknowledgement. A card dispute opened before that date keeps this evidence until the dispute is finally resolved.
THE FRAUD-CHECK FINGERPRINTS described in section 6 are deleted on December 31 of the year after the filing year.
OUR PAYMENT RECORDS (the amount, fee, refund and dispute outcome, dates, and opaque Stripe and filing references; never your card details, your return's contents, or your contact details) are Terminal Tax's own business tax records. We keep them until no tax can still be assessed, and no credit or refund can still be claimed, for that year on Terminal Tax's own federal and state income tax returns. Ordinarily that is three years after the later of the day our return for that year was filed and its due date, or two years after the tax was paid if that is later. The law keeps a year open longer in some cases, and we keep these records for as long as it does: until our return for that year is filed, if it has not been, after which the periods above run from that filing; to the end of an agreed extension of the assessment period, and six months more where the law adds them; for six or seven years where those periods apply; and with no end if a return for that year is false or fraudulent, or the IRS asserts that it is, because the law then sets no time limit.
AUDIT RECORDS (filing-scoped references, the action taken, a keyed digest of the network address, and a fixed set of details; never return figures) are deleted two years after the event, unless the record of a security incident cites them.
PRIVACY-RIGHTS RECORDS (your request, our decision, any appeal, and how we fulfilled it) are deleted 24 months after the request, or its appeal, closes.
BACKUPS: our automatic database backups expire on their own within 7 days, so a deleted record can remain in a backup until that backup expires. A manual snapshot or export is deleted, or purged again, by the earliest deadline of anything it holds.
HOLDS: a litigation hold, a security incident, a government request, or an open card dispute pauses deletion of only the records it names, from a dated written start to a dated release. A hold can delay a deletion; it never shortens a period.
PHONE MESSAGES: the recording of a message left on our support phone line, and its text, are deleted from Amazon Web Services once the message is emailed to our support mailbox, and in any case within three days; the emailed message stays in our mailbox.
OUR MAILBOX: messages to and from our support, legal, and privacy addresses, including phone messages emailed to our support mailbox, are deleted no later than two years after the last message in their conversation, whichever mailbox provider holds them. A hold described above pauses this as it does any other deletion.
COPIES OTHERS HOLD: the copies held by Stripe, Amazon Connect's record of a call to our support line, and the current and former email providers described in section 7 are outside our own stores and follow those providers' terms.
Whatever we keep, for however long, we use only as the section 7216 regulations described in section 9 permit.
A daily retention job applies the periods in this section: the deletions listed under DELETED ON SCHEDULE; return contents, including those of a filing whose every send failed; the proof of what was done; the fraud-check fingerprints; provider spending records; email sending records, message-event records and do-not-send fingerprints; audit records; and privacy-rights records. Our payment records for a year are erased once that year's end date (the day after which no tax can still be assessed, and no credit or refund claimed, for it) has been recorded in our payment-books register and has passed; until then they are kept. The job does not delete a record whose date it cannot establish from our records; it keeps that record instead. While any hold is open, it also pauses the deletion of email sending records, do-not-send fingerprints, provider spending records, audit records, and privacy-rights records, not only of the records the hold names. In each of these cases a record can be kept after its period ends.
When a lawful deletion request conflicts with a retention duty, we restrict the information to that duty and explain the result.
11. SECURITY
Your return content, your computed figures, your contact details, your identity and bank entries, your Identity Protection PIN answer and any Wisconsin Identity Protection PIN, any Illinois signature alternatives, any document your agent sent for a state or federal return, your review copy, and your signature material are encrypted before they are stored. Each stored field gets its own fresh 256-bit key, used for a single encryption operation and then discarded. The database holds that ciphertext and its wrapped key, non-secret routing information, and the keyed fingerprints described in section 6. The encryption is bound to the record it belongs to, so a valid ciphertext copied to another return or another filing session fails to decrypt.
Our production application refuses to store tax data any other way. It refuses plaintext, and it refuses the older format that used an application-held key.
Your Self-Select PIN and your prior-year authentication answer are the signature and the identity check inside the return we send. We hold them encrypted only until your return package is built, when the filing-session copies are deleted, and the transport copy is deleted when the MeF submission receipt arrives, or when we confirm the send never reached the IRS; if a send times out, we keep the transport copy until we have confirmed with the IRS whether it arrived. If you withdraw from your filing session, they are deleted at once; if it expires without sending, they are deleted with the session as described in section 10. Encrypted database backups made before a deletion can still contain them until those backups expire. For a return signed under this notice, we keep no fingerprint that could be turned back into either: only the fact that you entered or confirmed them yourself, when you did, and which kind of prior-year answer you gave.
The filing page loads nothing from anywhere else. Its content-security policy permits scripts and connections from Terminal Tax's own origin only, forbids framing, sends no referrer, and disables camera, microphone, geolocation, and payment interfaces. Operational logs accept only an allowlist of fields, so a request body, an email address, a phone number, or a tax figure cannot reach them. The audit log records what happened, never what your return said.
We maintain physical, electronic and procedural safeguards that comply with applicable law and federal standards.
12. FILING SESSION SECURITY
Your filing link is a scoped capability for a reservation that holds the sealed return your agent already sent. Before the page shows any protected return, a fresh code must be emailed to the address your agent sent or you entered on the page, and then entered there. Terminal Tax sends no text messages. Once a mechanically admissible return is bound to it, the session is bound to that exact return and refuses replacement. The link is single-use, short-lived, dies on use or expiry, and is not an account credential.
13. ADVERTISING, TRACKING, AND LANGUAGE MODELS
THERE IS NO TRACKING TECHNOLOGY IN THIS SERVICE. No advertising cookies, no pixels, no web beacons, no session-replay tools, no advertising tags, no analytics kit. We do not permit any other party to collect personally identifiable information about your activity over time and across different websites or online services on any Terminal Tax surface where your information is present.
Our own server takes the measurements section 5 lists from the requests the filing page and your agent's software already make to it, and from the reports the filing page sends to our own server: any page error or stall, and the screens and controls section 5 lists. To tell a first use from a repeat, the page keeps the codes it has already reported in your browser's storage for that tab, which your browser clears when the tab closes. Nothing is loaded from anywhere else for them, nothing beyond your filing session's own credentials and those codes is sent for them, and they follow you to no other site and no other filing.
Because we do not track you across sites and never have, a browser Do Not Track signal or opt-out preference signal changes nothing about our behaviour. We treat it as a standing instruction never to do those things, which we already do not do.
WE DO NOT COLLECT, USE, OR SELL PERSONAL DATA FOR THE PURPOSE OF TRAINING LARGE LANGUAGE MODELS. Terminal Tax contains no language model, and your tax information is never used by us to train or evaluate one. Section 7 tells you that the terms of our former email provider, Postmark, let it use the message content it already received, and the addresses we gave it, to train and improve its own service. That is its use, not ours, and not one we can answer for it. Our current email provider, Amazon Web Services' Simple Email Service, is described in section 7. Section 7 also tells you that Google's terms let it use and retain the mailing address it checks for a Louisiana return to provide and improve Google products and services; that, too, is Google's use, not ours. Section 7 also tells you that the terms of the AI model provider that helps us repair this software let it train on material flagged for its safety review, even with its training setting off; we give it no feedback on our sessions and have asked it not to use that exception for them.
Stripe's own card fields are governed by Stripe's own notice.
14. SOCIAL SECURITY NUMBERS
We collect Social Security numbers in the course of business and maintain this policy for them specifically.
We protect their confidentiality. They are held only inside encrypted records, and never in audit records, operational logs, or any message to a service provider.
We prohibit their unlawful disclosure. Disclosure is limited to the taxing authority for the purpose of filing your return, and to what valid legal process requires.
We limit access to the systems that check, package, and transmit a return, and to the minimum personnel necessary to operate and secure the service.
15. WHAT THIS SERVICE CAN FILE, AND WHAT IT CANNOT CATCH
The service transmits only the individual income tax returns the filing session shows you before you sign, for one taxpayer or for a married couple filing jointly, and only to a taxing authority the service supports; a state return is transmitted only with its linked federal return and only for a state the service supports. Section 2 names the extra values a state return asks for when one is included. It refuses more than one federal filing, and any jurisdiction, return or filing kind it does not support.
Most unsupported situations are refused by name, before payment and before anything is transmitted, and the refusal tells your agent exactly which field caused it.
SOME REST ENTIRELY ON YOUR AGENT'S WORD, AND YOU SHOULD KNOW WHICH. Your agent states your federal residency or alien status and whether the return is original or amended. Terminal Tax mechanically refuses values outside the supported envelope, but it cannot verify that the stated values are correct: if your agent states them wrongly, a nonresident alien's facts could be built into a Form 1040, a citizen's or resident's into a Form 1040-NR, and an amended return's facts would transmit as an original, and Terminal Tax cannot detect any of these errors.
Because of that, the review screen of a Form 1040 or Form 1040-SR return states in its first block that what will be transmitted is an ORIGINAL return, that Form 1040 is the return for a United States citizen or resident alien, and that this return is not Form 1040-X, Form 1040-NR, or Form 1040-SS. The review screen of a Form 1040-NR states in its first block that what will be transmitted is an ORIGINAL Form 1040-NR, that Form 1040-NR is the return for a nonresident alien, and that this return is not Form 1040, Form 1040-SR, Form 1040-SS, an amended return (Form 1040-X), or a superseding return. Your own review of that screen is the only check on this. It is a real control, because reviewing and signing the complete return is what you are here to do - but it is a second line, not a refusal, and we are not going to describe it as one.
16. PEOPLE OTHER THAN YOU
The permission described in section 4, which you give before we use your return, is yours and no one else's, and it gives you no authority over anyone else's information. Some returns also carry another person's information: some of it your agent sends with the return and some a signer types directly, as this section describes.
A joint return needs both spouses. The first page of the filing session shows this notice once for both of you, on the same device. The sensitive-data permission is recorded for each of you from the second permission described in section 4, which names those values; your spouse is not asked for a separate permission. No identification number or other sensitive value of either of you is accepted until a one-time possession code sent to a contact on the return has been typed on the page. Your agent also sends a spouse's tax facts with the return: the spouse's amounts and elections, the statements of whether the spouse is blind and is 65 or older, and the other statements about a spouse that section 2 lists. On a joint return, your agent may also send the same details for your spouse in the separate identity section: the spouse's name, date of birth, and occupation, whether the spouse filed a federal income tax return for last year and has ever filed one, and the spouse's prior-year adjusted gross income, never the spouse's taxpayer identification number, Identity Protection PIN, or any PIN; our page shows them before you sign, and uses that prior-year answer only to authenticate the spouse's signature. Those are kept and used under your permission described in section 4, not your spouse's. Terminal Tax neither infers nor verifies them and handles them as part of your return. On a joint return the one possession code sent to the contact you gave admits both of you; your spouse is sent no code of their own, and each of you signs with your own PIN. Our page shows the identity details of both of you once, and either of you may confirm or correct them, enter both Social Security numbers, and give both Identity Protection PIN answers; the values for your spouse are recorded on your spouse's own record. Both of you review one complete return before either of you signs. On one signing screen, each of you accepts the terms and makes the declaration for yourself, and types your own Self-Select PIN and your own prior-year adjusted gross income or prior-year PIN in your own fields; each acceptance and signature is recorded for the person who made it.
On a married-filing-separately return the header requires the non-signing spouse's name and taxpayer identification number (name only where the spouse is a nonresident alien with no number): your agent may send the name in its separate identity section, and the signer confirms or corrects it and types the number in the session; that entry is return data, not the spouse's permission. A signer types the Social Security number or other taxpayer identification number of a dependent, a child claimed for the earned income credit, or another non-signing person the return lists, such as a spouse filing separately, a head-of-household qualifying person, or a person on Form 2441, 8615, 8863 or 8962, directly on our page; nothing else is asked first. For those people, and for the other people and organizations other supported returns list, such as a parent, a donee, a care provider, a student, a personal representative, or a former spouse, depending on the form, your agent may send in its separate identity section only the names and other details the short version of this notice lists, and our page shows them before you sign, at the latest in the complete return you review; every Social Security number or other taxpayer identification number of such a person, and any Identity Protection PIN issued to one of them, is typed by a signer on our page. The filter in front of your return refuses another person's identification number when it arrives from your agent, refuses a spouse's Identity Protection PIN from the agent packet before it is stored, and refuses a spouse's name, date of birth, or occupation anywhere but the separate identity section of a joint return. The one exception is the employer and payer identification numbers section 2 lists, which your agent may send only in the form of an employer identification number; a number sent in the form of a Social Security number is refused. Your agent may also send the employer identification numbers the short version lists for a business, a school, a care provider, a household employer, or a farm.
STATEMENTS ABOUT OTHER PEOPLE ON YOUR RETURN. Form 1040 asks whether a dependent listed on your return is permanently and totally disabled, Form 8862 asks whether a child or dependent it lists is a United States citizen or national, a married return with a nonresident-alien spouse asks whether the spouse is a nonresident alien, Schedule 3-A line 8 asks, on a return claiming the earned income credit, the additional child tax credit or the refundable American opportunity credit from tax year 2026, whether your spouse is a United States citizen, United States national, or qualified alien, and your return states what kind of taxpayer identification number each person on it has. Your agent may send each such statement with the rest of your return. It is your statement on your own return. Terminal Tax neither infers nor verifies it and does not ask the person it describes for permission. It keeps the statement with your return as section 10 describes, carries it on your federal return to the IRS, and uses it for nothing else.
Terminal Tax does not let a minor create an account, because it has no accounts. A return for a minor or a person who has died is not offered unless the form, the signer's capacity, the authority evidence, and the signature method are all specifically supported.
17. YOUR CHOICES AND PRIVACY RIGHTS
You may decline to continue at any point before transmission. Withdrawing the permission described in section 4 ends the session and erases the sensitive information held for it.
WHAT YOU CAN ASK FOR. Access to the personal data we hold about you; a portable copy of it; a correction; deletion; or withdrawal of the sensitive-data permission. You may appeal if we deny a request.
HOW TO ASK. Write to legal@terminal.tax. Do not put a Social Security number, a PIN, a one-time code, a bank account number, a tax return, or an identity document in an email to us.
HOW WE CHECK IT IS YOU. There is no account to log in to, so we send a single-use confirmation link to the email address on the request. That link expires in 30 minutes. Before we send you a copy of your information, or correct or delete it, we also check that the request is yours against what your filing holds: the email address and the mobile number on your filing, your legal name and date of birth (for a correction, not the item you say is wrong), and a short declaration you sign under penalty of perjury. We email you how to complete those checks; we never text you. We use what you give us for these checks only to verify the request and to prevent fraud.
WHAT AN ACCESS OR PORTABILITY RESPONSE WILL NOT CONTAIN. If we hold your Social Security number, a government-issued identification number, a financial account number, a health-insurance or medical identification number, a password, a security question and answer, or biometric data, we will tell you that we hold it, and which of those it is, but we will not send the value back to you. This follows the rule Connecticut law sets for access responses; we apply it to every access and portability response as our own commitment.
HOW LONG WE TAKE. We answer an access, correction, deletion, or portability request within 45 days of receiving it, counted from when the request arrives rather than from when verification finishes. A withdrawal of the sensitive-data permission is different and faster: we stop the processing it authorized no later than 15 days after we receive the request.
APPEALS. If we deny a request, you have 60 days to appeal. Once you appeal, we must answer you in writing within 60 days of receiving the appeal and tell you the reasons for the decision. Those are two different 60-day periods running in opposite directions: the first is yours to use, the second is our deadline to answer you.
HOW THE WORK IS ACTUALLY DONE. A correction, a deletion, or a withdrawal made through this channel is performed by a person at Terminal Tax and then recorded, with evidence, against your request. There is no automated correction or deletion facility, and a request is not marked fulfilled unless the person who did the work has recorded that they did it.
Your appeal is decided by the same person who made the original decision.
LIMITS. Correcting our records does not amend a return already filed with a taxing authority; that remedy is with the authority. Deletion is subject to filing, signature, tax, security, payment, dispute, and other legal retention duties. We will explain a material denial and the appeal or regulator-contact rights that apply.
18. SHARING WITH OTHER COMPANIES
What we collect is in section 2. What we disclose, and to whom, is in section 7.
We have one affiliate, Terminal Court Inc., a company under common control with Terminal Tax LLC. We do not disclose your information to it or to any other affiliate, for its everyday business purposes, for its marketing, or for any other purpose, so there is no sharing with affiliates for you to limit. We do not engage in joint marketing. We do not disclose your information to anyone for marketing purposes, and we do not disclose it to any third party for that party's own direct marketing.
The only recipients of your information are the service providers listed in section 7, Google for the address check section 7 describes, the taxing authority, and the law enforcement agencies, regulators, and courts section 7 describes; each service provider, Google, and the taxing authority receives only what it needs to perform the filing you asked for, and section 7 says what Google's own terms let it do with the address it receives. We make disclosures to other nonaffiliated companies only as permitted by law: to carry out the filing you asked for, to prevent fraud and keep records secure, with your consent, and to comply with law and legal process. Federal financial privacy law gives no right to opt out of disclosures of those kinds, and we make no other kind, so we do not offer an opt-out choice. If you believe a law gives you a choice we have not described, write to legal@terminal.tax and we will answer you.
We treat information about people who have stopped using the service exactly as we treat information about current users.
How we protect it is described in section 11.
19. STATE-SPECIFIC INFORMATION
CONNECTICUT. If you are a Connecticut resident: the information we receive and keep to provide the filing you asked for is nonpublic personal information subject to Title V of the federal Gramm-Leach-Bliley Act, and Connecticut law (Conn. Gen. Stat. 42-517(b)(17)) exempts data subject to Title V from the Connecticut Data Privacy Act. We still offer you the rights in section 17, with the response periods and the appeal process stated there. Your return carries a Social Security number or other taxpayer identification number; the statements section 2 lists under STATEMENTS THE LAW TREATS AS SENSITIVE, which can reveal a disability, health treatment, citizenship or immigration status, or religious belief, about you or about another person on your return; if you choose direct deposit, a financial account number; on Form 8938, the number of each foreign financial account; on an Ohio, West Virginia, or Illinois return, a driver's license or state ID number; and, on an Oregon return where you answer Yes on Form OR-VSI, data revealing racial or ethnic origin. As our own practice, we treat all of these as sensitive data and ask for your affirmative permission, as described in section 4, separately and never bundled into any other agreement. Until you give it, a return your agent sent first is only checked mechanically, held sealed, and counted in the fixed codes listed in section 5, and if you decline, it is erased at once; if your agent asked for the link first, it sends nothing until you give it. The permission that covers a statement about a spouse, a dependent, or another person on your return is yours, given as the filer of the return that carries it; we do not ask that person for one, and a spouse who signs a joint return is not asked for a separate one either. We process those statements only to provide the filing you asked for, and only as far as that filing requires. If we deny your appeal, we will give you the method to contact the Connecticut Attorney General.
CALIFORNIA. We do not sell or share personal information, and we do not disclose personal information to third parties for their own direct marketing purposes.
DELAWARE. This notice is provided under the Delaware Online Privacy and Protection Act.
NEW JERSEY. Terminal Tax LLC is a New Jersey limited liability company.
EVERYWHERE ELSE. We offer the rights in section 17 to everyone, regardless of where you live, subject to the limits stated there.
20. CHANGES
The version displayed and acknowledged in your filing session governs that filing. We do not silently replace the hash-bound version recorded in a completed evidence record.
If we change this notice, we publish the new version at terminal.tax/privacy with a new effective date and a new last-updated month and year, and the new version applies to filings made after that date. A change that materially affects how we handle information already collected requires fresh notice and, where the law requires it, fresh permission before that change is applied to you.
21. CONTACT
Privacy questions, rights requests, and appeals: legal@terminal.tax