Privacy Policy

1. Information we collect

Only what a return needs, and only what you or your documents give us:

• Identity and contact details — name, address, date of birth, email address and mobile phone number.
• Social Security Numbers for you, your spouse and your dependents.
• Income and tax information — W-2s, 1099s, schedules, deductions and credits.
• Bank routing and account numbers, when you ask for a direct-deposit refund or a direct-debit payment.
• Documents you upload, when you ask us to prepare the return for you.
• Account security data — a password hash, a PIN hash, and session records.

We never collect or store your card number. Payments run through Stripe Checkout, which handles card data entirely. No card number reaches this system at any point.

2. How we use it

To prepare, review, sign and electronically file your return; to verify that you are who you say you are; to take payment for the filing fee; and to answer you when you ask for help.

Federal law is stricter than general privacy law here. Under 26 U.S.C. §7216 and 26 CFR 301.7216, a tax return preparer may not use or disclose the information in your return for any purpose other than preparing it without your separate, written, informed consent. We do not ask for that consent and we do not use your return information for marketing, advertising, analytics, model training or resale.

3. Who we share it with

We do not sell your information. We do not rent, trade or disclose it for anyone else’s marketing. It is shared only with:

• The IRS and state tax authorities — the return itself, which is the purpose of the service.
• Service providers that operate this system, each limited to what its job requires: Vercel (hosting and private document storage), Prisma Postgres (the database), Stripe (payments), Resend (transactional email), and Twilio (verification text messages).
• Anyone you explicitly ask us to share with, or where a law, subpoena or court order requires it.

4. How we protect it

• Social Security Numbers and bank account numbers are encrypted at the field level with AES-256-GCM envelope encryption — each value gets its own data key, and a tampered or truncated ciphertext fails closed rather than being accepted.
• Duplicate-SSN checks run against a one-way HMAC index, never against a plaintext value.
• Only the last four digits of an SSN or account number are ever displayed.
• Uploaded documents are held in a private store and served only through a route that re-checks that the file belongs to you.
• Passwords and PINs are stored as bcrypt hashes, never in plain text.
• All traffic runs over HTTPS/TLS, and the database connection requires a fully verified certificate.
• Opening any return requires re-entering your 6-digit PIN, so a shared or unattended browser is not enough on its own.

No system is perfectly secure, and we maintain a written information security plan that records our known risks and what we are doing about them, as the FTC Safeguards Rule requires.

5. Text messages (SMS)

When you create an account you enter your own mobile number, and we send a one-time 6-digit code to it so we can confirm the number belongs to you. Submitting the sign-up form is what requests that code.

• We do not share, sell, rent or trade your mobile phone number with anyone for marketing purposes, and we do not share it with third parties for their own purposes at all. It is passed only to our SMS provider (Twilio) for the sole purpose of delivering the code you asked for.
• Message frequency: one message per verification request. These are transactional messages only — you will not receive recurring, promotional or marketing texts from us.
• Message and data rates may apply.
• Reply STOP to any message to opt out of further texts, or HELP for help. Opting out means we can no longer verify your phone number by text.

6. How long we keep it

We keep your account and return records for three years after the return is filed, and dispose of them after that. As an Authorized IRS e-file Provider we are required to retain certain return records for three years (IRS Publication 1345), and the FTC Safeguards Rule requires us to dispose of customer information no later than two years after the last time we used it, unless a law or a legitimate business need requires longer. When records are disposed of, they are deleted from the database and from document storage.

7. Your choices

• You can ask for a copy of the information we hold about you, or ask us to correct it.
• You can ask us to delete your account and its data, subject to the retention rules above.
• You can decline to provide information — but a return cannot be prepared or filed without the data the form requires.

8. Children

This service is for adults filing their own returns. We do not knowingly let anyone under 18 create an account. A dependent’s details appear on a return only because the adult filing it entered them.

9. Changes and contact

If this notice changes materially we will update the effective date above and, where the change affects how your information is used, tell you directly.

Questions, requests, or a suspected security problem: info@awtax.services · (346) 212-9431 · 2440 Texas Pkwy, Missouri City, TX 77489