Privacy Policy

Last updated: August 18, 2026

This Privacy Policy explains how TaxSpring (“we”, “us”, or “our”) collects, uses, discloses, and protects personal information when you use our bookkeeping and quarterly tax estimation service for creators, freelancers, and independent sellers (the “Service”). It also summarizes your rights under the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA). By creating an account or using the Service, you agree to the practices described in this Policy.

Data Controller

TaxSpring is the data controller responsible for the personal information processed in connection with the Service. If you have questions about this Policy or how your data is handled, please contact us at support@taxspring.top.

Information We Collect

We collect the following categories of personal information:

• Account information — your email address, name, and password (stored as a salted hash), used to create and manage your account and to authenticate you.
• Transaction data — the income and expense records you enter or import (dates, amounts, merchant names, descriptions, categories, platforms, and mileage entries), used to provide bookkeeping and quarterly tax estimates.
• Tax preferences — your filing status, state, prior-year taxes paid (used as your safe harbor baseline), and deadline reminder settings.
• AI classification content — the merchant names, descriptions, and platform names you submit so our AI can suggest categories. This content is processed only to generate categorization suggestions and is not used for advertising.
• Analytics and usage data — pages visited, features used, device and browser type, referrer, and approximate location, collected through PostHog to understand and improve how the Service is used.
• Communications — messages you send us through support, used to respond to your requests.

How We Use Your Information (Processing Purposes)

• Provide, operate, and maintain your account and the Service.
• Record and organize your bookkeeping data and generate quarterly tax estimates, safe harbor progress, and filing deadline reminders.
• Run AI-powered transaction categorization (through DeepSeek) so you can classify transactions faster.
• Send transactional and reminder emails (through Resend), such as deadline alerts you have opted into.
• Process subscriptions and payments (through Gumroad). We never store or process your card details; payment information is handled by Gumroad under its own terms and privacy policy.
• Analyze usage patterns (through PostHog) to improve the Service and its features.
• Monitor the availability, performance, and security of the Service (including error monitoring through Sentry).
• Comply with legal obligations, prevent fraud and abuse, and enforce our Terms of Service.

Legal Bases for Processing (GDPR, Article 6)

• Performance of a contract — providing the Service you signed up for, including account management, bookkeeping, and tax estimation features.
• Legitimate interests — security, fraud prevention, error monitoring, and product improvement, balanced against your interests and rights.
• Legal obligation — retention and disclosure of records where required by tax, accounting, or other applicable law.
• Consent — for non-essential analytics cookies and any other processing where we ask for your consent. You may withdraw consent at any time, and withdrawal does not affect the lawfulness of processing before withdrawal.

Third-Party Processors

We share personal information only with the following service providers, who process it on our behalf, under our instructions, and subject to appropriate data processing agreements. Each provider publishes its own privacy policy describing its practices:

• Supabase — hosting, database storage, and authentication. Receives account credentials, profile information, and your financial records.
• DeepSeek — AI-powered transaction categorization. Receives the merchant names, descriptions, and platform names you submit for classification. Categorization results may be cached to avoid repeated API calls.
• Resend — transactional email delivery. Receives your email address and the content of reminder emails we send you.
• Gumroad — payment processing and subscription management. Receives your email address and order details so we can confirm your plan; we do not receive or store your card details.
• PostHog — product analytics. Receives usage and analytics data to help us understand how the Service is used.
• Sentry — error monitoring. Receives technical logs and error reports that may contain limited identifiers (such as your user ID) for diagnosing issues.

Data Retention

We retain personal information only for as long as necessary to provide the Service and to fulfill the purposes described in this Policy. Specifically: account information is kept while your account is active and for a reasonable period after closure; financial records are retained as required by applicable tax and accounting laws; analytics and error logs are kept in aggregated or limited form; and communications are kept as needed to respond to you. When personal information is no longer needed, we delete or anonymize it. You may request deletion of your data as described below, subject to legal retention requirements.

International Data Transfers

The Service is operated on infrastructure located primarily in the United States, and your personal information may be transferred to and processed in the United States and other countries where we or our processors operate. If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we rely on appropriate safeguards for such transfers, including standard contractual clauses adopted by the European Commission or an adequacy decision where available. You may request a copy of the relevant safeguards by contacting us.

Your Data Subject Rights (GDPR)

If you are located in the EEA, the United Kingdom, or Switzerland, you have the right to:

• Access — obtain a copy of the personal data we hold about you.
• Correction — request that we rectify inaccurate or incomplete personal data.
• Deletion — request erasure of your personal data, subject to legal retention requirements.
• Restriction — request that we restrict processing in certain circumstances.
• Export (data portability) — receive your personal data in a structured, machine-readable format and transmit it to another controller.
• Objection — object to processing based on legitimate interests, including for direct marketing.
• Withdraw consent — where processing is based on consent, withdraw it at any time.
• Complaint — lodge a complaint with your local data protection supervisory authority.

Your Rights (CCPA/CPRA)

California residents have the right to know the categories and specific pieces of personal information we collect, the right to delete personal information, and the right to correct inaccurate personal information. We do not sell your personal information, and we do not share it for cross-context behavioral advertising, so there is no need to opt out of such practices. Where we process sensitive personal information (such as financial records), we use it only to provide the Service, and we do not sell or share it. You also have the right to non-discrimination for exercising your privacy rights, and you may designate an authorized agent to make requests on your behalf.

How to Exercise Your Rights

To exercise any of the rights described above, email us at support@taxspring.top with the subject line “Privacy Request”. We will verify your identity before acting on your request and will respond within the timeframe required by applicable law (generally 30 days under the GDPR and 45 days under the CCPA/CPRA). We may need to retain certain information for legal or legitimate business purposes even after a deletion request.

Contact Us

For privacy questions, to exercise your rights, or to request details about international data transfers, email us at support@taxspring.top.