Tax Portal Privacy Policy

Quote form: your name, email address, the answers you give about your tax situation (for example, whether you have a business, rental properties or sales of investments), any notes you add, and the service tier you choose. We ask you not to put Social Security numbers or account numbers in the notes field.

Client portal: your filing status, names and dates of birth for you, your spouse and dependents, your mailing address, Social Security numbers for you, your spouse and dependents, the tax documents and prior-year return you upload, and your electronic signatures on the engagement letter, the Section 7216 consent and your return approval. When you sign, we record the date, time and the IP address the signature came from as part of the signed record.

Technical data: a session cookie that keeps you signed in, and limited request data used to stop abuse (see “Security”).

We use your information to prepare a quote, prepare and file your tax returns, communicate with you about your engagement, and meet our legal and professional obligations.

We do not sell your information, and we do not use your tax return information for marketing without your separate written consent.

• Social Security numbers are encrypted with AES-256-GCM before they are stored, and are never stored in plain text. Staff screens keep them hidden; a preparer can reveal one number at a time for return preparation, it hides again after 30 seconds, and each reveal is logged (who and when, never the number).
• Documents are stored in a private storage bucket. Each time you or our team open a file, the portal creates a link that expires after one hour.
• All traffic uses HTTPS. Your portal session is kept in a secure, HTTP-only cookie that expires after 8 hours; your password is checked once at login, stored only as a bcrypt hash, and never kept in your browser.
• Every staff account requires a password plus a one-time code from an authenticator app (multi-factor authentication). Deactivated staff accounts lose access immediately.
• Login, password-reset and quote submissions are rate-limited. For this, IP addresses are stored only as a keyed one-way hash.
• Staff actions on your file are recorded in an activity log that notes what changed, not the sensitive values themselves.

Our team. Your return is prepared by Prosynergy staff in the United States and by our preparation team in India (Prosynergy Professional Services Pvt. Ltd., Dehradun, Uttarakhand). Sharing your tax return information with our India-based team requires your consent under Internal Revenue Code Section 7216, which you give, and can review, in the portal before we begin. Staff access the portal through individual accounts with multi-factor authentication.

Service providers that run parts of the portal for us, under their own security commitments:

• Supabase — database and document storage [TO CONFIRM: hosting region shown as US West; confirm and list in the final policy].
• Netlify — hosts the portal website.
• Resend — sends portal emails (your name, email address and the email content).
• Cloudflare Turnstile — checks that quote-form submissions come from a person, not a bot.
• Anthropic (Claude) — AI document analysis, described below.
• Drake Tax Software — used to prepare and e-file your return, and to send the Form 8879 e-file authorization.

Government agencies. We file your returns with the IRS and state tax agencies, and may disclose information when the law requires it.

With your Section 7216 consent, our preparers use Claude, an AI assistant from Anthropic, to help read your prior-year return and documents, for example to draft your document checklist and pre-fill return figures for our preparers to verify. Before text is shared with Claude, the portal extracts only the text from the PDF and strips Social Security numbers, ITINs, EINs, other long account and ID numbers, and dates that could be dates of birth. The file itself is never sent. AI results are suggestions: a preparer reviews them, and nothing is saved until a person confirms it.

[TO CONFIRM: confirm the Anthropic terms in use, including data retention and whether submitted content may be used for training, and state them here]

The portal uses one essential cookie to keep you signed in. On the public quote page we may use Plausible Analytics (which does not use cookies) and the Meta Pixel to understand how visitors find us and whether they request a quote, and we remember which campaign link brought you to us so we can attribute your quote. These tools never receive your name, email, Social Security number or any document data. Inside the client portal and on password-reset pages, page addresses are stripped of access tokens before any analytics event, and the Meta Pixel does not load on password-reset pages at all.

We keep your engagement records, signed agreements, documents and copies of filed returns for as long as needed to provide our services and to meet legal and professional record-keeping requirements. Federal law requires tax preparers to keep a copy or list of each return they prepare for at least three years.

[TO CONFIRM: retention period for client documents and SSNs after an engagement ends, and how deletion requests are handled — the portal does not currently delete files automatically]

You can review and correct your personal information in the portal until your return is in review, or by contacting us. You may revoke your Section 7216 consent in writing, although we may then be unable to complete your return. To ask about your information or request deletion where the law allows, contact us below.

The Synergists Inc. dba Prosynergy Bookkeeping · 717-203-9756 · divyanshu@prosynergy.co [TO CONFIRM: mailing address and privacy contact]

Back to Prosynergy Tax