Privacy Policy

This policy covers blanctax.live and the Blanc Tax engine and demo (the “Service”). “Blanc Tax”, “we”, and “us” refer to the people who build and operate the Service; Blanc Tax is a product and is not yet incorporated as a separate legal entity. This policy applies to visitors, people who request a demo, and customers whose financial data we process to prepare a return.

Client data and our role. Many of our customers are accountants and firms who upload their own clients’ financial data. For that data, the customer is the “controller” (or business) and Blanc Tax acts as a “processor” (or service provider) that processes the data on the customer’s behalf and instructions, solely to provide the Service. If you upload data about other people or businesses, you confirm you have the authority and any consents needed to do so, and you remain responsible for how you handle it under your own privacy obligations.

Contact and demo request details. When you request a demo or contact us, we collect your name, work email, phone number, firm name, firm size, website, and any message or bottleneck details you send. This is how we schedule your demo, follow up, and understand whether the Service is a fit.

Demo parser submissions. If you try the parser, we collect the email and firm details used to start the demo, the filename and sheet name you submit, and parsed account-level data such as account names, amounts, descriptions, vendors, dates, and suggested tax classifications. We use this to run the demo, show results, and help our team understand what you tested.

Financial data you upload. To prepare or demonstrate a return, you may upload a trial balance, general ledger, or similar accounting export. This can include account names, balances, journal entries, entity information, EINs, tax year details, and other tax or accounting information contained in the file. We process it solely to produce the tax workpapers, forms, and demo output you asked for.

Account, login, and password reset data. If you create an account, we store your email and a securely hashed password. We also process account setup links, invite tokens, reset tokens, login timestamps, and related authentication records needed to create accounts, sign users in, and send password reset emails.

Security and abuse-prevention data. We collect standard server logs such as IP address, browser type, timestamps, request metadata, and CAPTCHA or similar anti-spam verification results. We use these signals to block spam, protect login and signup flows, investigate abuse, and keep the Service reliable.

Analytics data. We keep limited, privacy-friendly product analytics, such as which pages load and which calls to action are used. We do not use cross-site tracking cookies or third-party advertising trackers.

• To run the parser and compute your Form 1120 / 1120-S / 1065, schedules, and workpapers.
• To schedule demos, respond to your requests, send account setup emails, and support password resets.
• To operate, secure, debug, and improve the Service.
• To prevent spam, credential abuse, automated signups, and malicious traffic.
• To meet legal, tax, and accounting record-keeping obligations.

The tax computation is deterministic. Your return is computed by a rules-based engine, not generated by a language model, so the same inputs always produce the same numbers.

Bookkeeping categorization is our own engine. If you use the optional AI bookkeeping, it categorizes transactions using our own categorization system, not a third-party chatbot, and you review its suggestions. We use your bookkeeping data to improve that categorization over time. We do not sell your data, and we do not use it to train a general-purpose or generative AI model.

Optional document scanning. If you choose to upload a photo or scan of a document (for example, a receipt), we may use a third-party vision model to read the text from that image so you don’t have to type it. That is the only place your data is sent to an outside AI provider, it is limited to the image you upload for that feature, and the provider is contractually restricted from using it to train its models. If you don’t use document scanning, none of your data is sent to an outside AI provider.

We do not sell your personal or financial information. We share it only:

• Service providers who host and run the Service (cloud hosting, database, email delivery, analytics, security, CAPTCHA, and abuse-prevention providers), under contract and only as needed to operate it.
• A qualified professional in the review-and-approve workflow, where your engagement includes expert sign-off.
• Legal compliance when required by law, or to protect rights, safety, and the integrity of the Service.
• A successor in a merger or acquisition, subject to this policy.

We keep contact/demo details for as long as needed to follow up and for our legitimate business records. Account records are kept while the account remains active and for a reasonable period after deactivation. Financial data, demo parser submissions, and computed returns are retained for the period required to deliver the Service, support auditability, and meet tax and accounting record-keeping requirements, after which they are deleted or anonymized. Security logs and CAPTCHA results are kept for a limited period needed to detect abuse and investigate incidents. You can ask us to delete data sooner (see §8), subject to legal retention limits.

We encrypt data in transit (TLS) and at rest, isolate each client’s data, and restrict access on a least-privilege basis: the public demo can only add a lead, never read existing records or reach the tax engine. No method of transmission or storage is perfectly secure, but we work to protect your information and limit what any one component can access.

Depending on where you live (including under the GDPR and CCPA/CPRA), you may have the right to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent. We do not sell or “share” personal information for cross-context behavioral advertising. To exercise any right, contact us using §14; we will respond as required by law and will not discriminate against you for exercising a right.

We may need enough information to verify your request and confirm that we are acting for the right person or account. If you ask us to delete information, we may retain limited records where required for security, legal compliance, tax/accounting obligations, or dispute handling.

Legal bases (EEA/UK). Where the GDPR or UK GDPR applies, we process personal data on these bases: to perform our contract with you (providing the Service), our legitimate interests (operating, securing, and improving the Service and preventing abuse), your consent where we ask for it, and compliance with legal obligations. You may lodge a complaint with your local supervisory authority.

This section is intended as a California notice at collection. In the last 12 months, the categories of personal information we may have collected include identifiers (such as name, email, phone number, IP address, and firm details), commercial or professional information you submit, internet or electronic network activity information, account login information, and financial or tax data you upload for demo or product use.

We collect this information directly from you, from files you upload, from your browser or device, and from service providers that help us operate the Service. We use it for the business purposes described in this policy. We disclose it to service providers and other parties only as described in §5. We do not sell personal information, and we do not “share” personal information for cross-context behavioral advertising.

Sensitive personal information. The financial and tax data you upload (and account credentials) may be “sensitive personal information” under the CPRA. We use and disclose it only to provide the Service you requested, to secure it, and as otherwise permitted by law, not to infer characteristics about you. We retain each category only as long as described in §6. California residents may use an authorized agent to submit requests.

We use only essential cookies needed to run the site and keep you signed in, plus privacy-friendly, cookieless analytics that do not track you across other sites. We do not use third-party advertising trackers.

We operate in the United States and our providers may process data there. If you access the Service from outside the U.S., you understand your information may be transferred to and processed in the U.S. under appropriate safeguards.

The Service is for businesses and is not directed to children under 16. We do not knowingly collect their information.

We may update this policy. We will revise the “Last updated” date above and, for material changes, provide a more prominent notice.

Questions or requests about this policy or your data? Email privacy@blanctax.live.