Privacy Policy

This policy covers the GA-TaxPro Cloud web application and this website. It does not cover the separate GA-TaxPro Desktop product distributed at ga-taxpro.com, which stores data on your own computer, or the practices of any third-party site we link to.

This distinction matters more here than in most privacy policies, because most of the information in the Service is not about you.

• Account data is information about you and your firm — your name, email, organization, and billing record. We control this and use it to run the Service.
• Customer data is the client, taxpayer, and return information you enter or import. Your firm controls it. We process it only to provide the Service to you and only on your instructions.

If a taxpayer wants to know what information about them is in the Service, they should contact the firm that prepared their return. We refer such requests to that firm.

• Account and profile. Name, email address, organization name, role, and authentication records (login timestamps, password reset events). Passwords are stored only as salted hashes by our authentication provider.
• Customer data you enter. Client business names and status, mailing addresses, phone numbers, email addresses, county, and the contents of returns — asset, inventory, construction-in-progress, consigned goods, and leased equipment schedules; aircraft and marine details; freeport exemption figures; property records; and computed valuations.
• Imported legacy data. If you use the GA-TaxPro Desktop import, the contents of the files you upload, plus a record of each import batch so it can be undone.
• Billing. Your plan, tier, return limit, the tax year paid for, and a Stripe customer identifier. Card numbers never reach our systems— you enter them on Stripe’s hosted checkout, and Stripe tells us only that a payment succeeded.
• Technical logs. IP address, browser and device type, pages requested, timestamps, and error traces. Used for security, abuse investigation, and debugging.
• Support messages. Whatever you send us through the Help Center.

The Georgia forms we support do not call for Social Security numbers or bank account numbers, and the Service does not ask you for them. We do not collect advertising identifiers, and the application contains no third-party analytics, advertising, or session recording trackers.

• Provide and operate the Service — store your data, run calculations, generate PDFs.
• Authenticate users and enforce organization isolation so one firm can never see another’s data.
• Process payments and maintain billing and receipt records.
• Respond to your support requests.
• Monitor security, prevent abuse, and investigate incidents.
• Fix bugs and improve reliability and usability of the Service.
• Send service and account notices, and comply with legal obligations.

• We never sell or rent personal information, and we never share it for advertising or cross-context behavioral targeting.
• We never use your client or taxpayer data to train artificial intelligence or machine-learning models— not ours, and not anyone else’s.
• We do not use your data to market to your clients, or contact them at all.

The Service uses essential cookies only: the authentication session cookie set by our auth provider to keep you logged in, and cookies used for security. There are no advertising or analytics cookies, which is why you see no cookie consent banner. Blocking these cookies will prevent you from logging in.

We keep this list short on purpose. Each provider is contractually limited to using the information only to provide its service to us.

We may also disclose information when required by law or valid legal process, or when necessary to protect our rights, our customers, or public safety. If Taxforms is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction; this policy, or a successor policy no less protective, will continue to apply, and we will give notice before any material change in how your data is handled.

Your data is stored and processed in the United States, on infrastructure operated by Supabase and Vercel. We do not currently offer data residency in the European Union or any other region. If you are outside the United States, using the Service means your information is transferred to and processed there.

We take a small number of measures seriously rather than listing many vaguely:

• Row-level security on every user-facing table, scoping each row to a single organization, enforced by the database itself rather than by application code alone.
• Encryption in transit (TLS) and at rest.
• Privileged, service-role database access confined to server-side operations such as billing webhooks — never exposed to the browser.
• Least-privilege access for our personnel, used only to operate and support the Service.
• Provider-managed daily backups with point-in-time recovery.

No system is perfectly secure. If a breach affecting your data occurs, we will notify affected customers without undue delay and as required by applicable law.

We keep your data while your account is active, so that prior-year returns remain available to roll forward — that continuity is a core part of the Service.

On a written deletion request from an organization owner, we delete that organization’s data from our live systems within 30 days, and it ages out of encrypted backups within 90 days. You can also delete individual clients, returns, properties, and entire import batches yourself at any time.

Deletion is permanent and cannot be undone — download any PDFs you need before requesting it. We retain payment and tax records for as long as law requires, and we may retain limited records needed to resolve disputes or enforce our Terms of Service.

• Access and correction. View and edit your account information and all of your client and return data in the app at any time.
• Export. Generate PDFs of any return, for any tax year, whenever you want.
• Deletion. Delete records yourself, or request full account deletion through the Help Center.
• Communications. Opt out of any non-essential email. We will still send transactional notices about your account, payments, and security.

Residents of states with comprehensive privacy laws have rights to access, correct, delete, and obtain a copy of their personal information. We honor these requests for all users regardless of where you live. Because we do not sell personal information or use it for targeted advertising, there is no such activity to opt out of. We verify requests by confirming control of the account email address, and we will not discriminate against you for making one. Requests go through the Help Center contact form(opens in a new tab).

The Service is built for tax professionals, is not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it.

The Service links to sites we do not operate, including the GA-TaxPro Help Center, the GA-TaxPro Desktop site, and Stripe’s hosted checkout. Their own privacy policies govern what they collect.

If we change this policy, we update the “Last updated” date above. For material changes we give notice by email or in the app before they take effect. Continuing to use the Service after that means you accept the updated policy.

Questions, privacy requests, or concerns about this policy: reach us through the GA-TaxPro Help Center contact form(opens in a new tab). GA-TaxPro Cloud is operated by Taxforms LLC, a Wyoming limited liability company. See also our Terms of Service.