Privacy Policy

Atamatax — raison individuelle, Suisse (registration pending CHF 100k revenue threshold) ("Atamatax", "we", "us") operates the Atamatax tax-filing service at atamatax.com. This Privacy Policy describes what information we collect from you, how we use it, with whom we share it, and the controls you have over it.

What we collect

• Account information — your email address and an authentication password hash stored in Supabase Auth.
• Tax-return inputs — your US tax status (citizen or green-card holder), country of residence, filing status, and the figures you enter directly into the wizard.
• Brokerage data — the positions CSVs, statements and holdings files you upload, and the holdings, transactions, security identifiers and balances we read from them. A read-only Plaid connection for US brokerages is built and opens once Plaid's production review completes; until then no brokerage credential and no Plaid data is collected.
• Saved assessments — when you use the Tax Map or the PFIC / Form 8621 assessment, the answers you give are saved to that assessment so you can come back to it: statuses, yes/no answers and value ranges, plus — in the PFIC assessment only — any fund name, ticker, ISIN or provider you choose to type. They are never an exact balance or an account number, are tied to a private cookie on your device (or your account, or the email you save them to), and are never sent to analytics.
• Payment information — when you pay to generate a package, Stripe processes the payment. We receive the resulting Checkout Session id and amount; we never receive your card number.
• Operational logs — Vercel records request IPs, timestamps, and user-agent strings for the routes you hit. We review these only to debug or investigate abuse.
• Cookieless measurement — by default we count page views and tool usage in PostHog (EU region) without cookies or local storage: a random identifier that lasts only for the current page session, no user profile, no session recording, no automatic capture, and never tax-return, account or brokerage details. The requests go through our own domain. Choose “No thanks” on the analytics prompt and nothing at all is sent.
• Optional cross-visit analytics — only after you choose “Allow” on the analytics prompt, the same de-identified identifier is kept in your browser’s local storage so we can see whether a visit later became a purchase. Still no profile, no recording, and nothing about your taxes. Campaign labels, the landing route and a coarse device category can be retained for up to 30 days after consent. You can withdraw consent using the controls below; our stored measurement records are then removed from this browser.
• On-site notices — your browser’s local storage keeps a note of which notices you have already seen on this site, so they are not repeated. It stays on your device and is not sent to us.
• Google Ads click identifier — if you reach us from one of our Google ads and then submit a PFIC case request, the click identifier the ad adds to the link (gclid, gbraid or wbraid) is kept with your request, but only if you chose “Allow” on the analytics prompt and your browser sends no Global Privacy Control signal. We use it to tell Google Ads which ad led to a request, a qualified lead, an accepted quote or a payment: the identifier, the step, its time and, for a payment, the amount — never your name, email address, answers or tax facts. The identifier is deleted 90 days after the request.

How we use it

• Generate a draft PDF package with figures mapped to IRS forms and lines. Your return data stays in your account and in the package you download; you file it yourself outside the Service, so nothing is sent by Atamatax to IRS or FinCEN filing systems.
• Compute PFIC determinations, foreign-tax credit estimates, and treaty positions from your imported holdings.
• Send transactional emails that the current product triggers, such as account welcome, requested checklist delivery, scanner results, and a package-availability notice via Resend. These are not IRS or FinCEN acknowledgements.
• Email you US tax deadline reminders, only if you ask for them. We keep your address and when and where you asked until you unsubscribe; after that we keep only a keyed hash, so that we do not email you again.
• Improve the product. Aggregated, de-identified usage statistics inform what we build next.

Plaid specifically

The Plaid connection is not in use. When it opens, connecting a brokerage will mean agreeing to Plaid's End User Privacy Policy, Plaid will act as a service provider to Atamatax for brokerage data access, and the access tokens we receive will be encrypted at rest with AES-256-GCM and never returned to the browser. This policy will be updated on the day that happens.

Who we share it with

• IRS Modernized e-File & FinCEN BSA — your data reaches these filing systems only when you file. You review the draft package and submit required filings yourself; we share nothing with the IRS or FinCEN through those systems.
• The tax professional assigned to your case — where your engagement includes preparation or review by a credentialed professional, and only after you authorize it on your own case. They receive the case itself: your confirmed facts, your uploaded documents, the figures computed from them and the filings prepared from them, for the sole purpose of completing your engagement. You are shown who they are, you are told if the case is reassigned, and you can withdraw the authorization at any time from your case — which ends their access immediately. If you do not authorize it, nothing in your case reaches a professional.
• Stripe, Inc. — only the data needed to charge you (email, amount, IP address as part of fraud signals).
• Supabase / Vercel / Resend — sub-processors that host the database, the application servers, and transactional email. None of them sell your data; they act under their own DPAs.
• PostHog — de-identified product analytics under the restrictions described above; cookieless by default, persistent only with your consent. Declining analytics does not affect any product feature.
• Google Ads — the conversion records described above (click identifier, step, time, amount), only for a click identifier kept with your consent.
• Law enforcement — only when compelled by a valid US legal process and only the minimum scope demanded.

We do not sell your personal information to advertisers, data brokers, or any third party.

Where we store it

Tax-return data, brokerage tokens (encrypted), and account credentials live in a US-hosted Supabase Postgres database. Static assets and serverless functions run on Vercel. Backup availability and retention depend on the active Supabase project configuration; this policy does not promise a specific backup window.

How long we keep it

We retain return records, generated-package records, and associated brokerage snapshots for seven years after the tax year, matching the IRS standard for return reconstruction. Account credentials are kept for as long as the account is active and deleted within 90 days after you ask us to close the account.

Your rights

You can request a copy of your data, ask us to correct it, or ask us to delete it. Email support@atamatax.com from the address on file. We respond within 30 days.

Residents of the EU/EEA, the UK, and Switzerland. For these users, Atamatax acts as a data controller within the meaning of Regulation (EU) 2016/679 (the "GDPR") and the UK GDPR. Our legal basis for processing your tax-return inputs, brokerage data, and account information is the performance of the contract you enter into when you create an account and use the Service (Art. 6(1)(b) GDPR); for technical and operational logs we also rely on our legitimate interest in maintaining a secure and functional service (Art. 6(1)(f) GDPR); for the optional cross-visit analytics and the Google Ads click identifier we rely on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. Residents of Switzerland have the same rights under the revised Federal Act on Data Protection (nFADP / revDSG). You have the right to:

• access the personal data we hold about you (Art. 15);
• have inaccurate data rectified (Art. 16);
• request erasure of your data (Art. 17), subject to our seven-year retention obligation for return records and supporting workpapers;
• restrict our processing (Art. 18);
• receive your data in a portable, machine-readable form (Art. 20);
• object to processing based on legitimate interest (Art. 21);
• withdraw any consent you previously gave (without affecting prior processing).

To exercise any of these rights, email support@atamatax.com. You also have the right to lodge a complaint with a supervisory authority — for residents of France, the CNIL (cnil.fr/en/plaintes); for other EU/EEA member states, the authority listed at edpb.europa.eu; for the UK, the ICO (ico.org.uk); for Switzerland, the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch).

California residents. You have additional rights under the CCPA / CPRA: to know what personal information we collect and disclose, to delete personal information, to correct inaccurate personal information, and to opt out of any sale or sharing. We do not sell personal information. The one disclosure that may count as “sharing” for cross-context behavioural advertising is the Google Ads conversion record described above: it happens only after you choose “Allow”, never when your browser sends a Global Privacy Control signal (which we honour as an opt-out), and you can opt out at any time with “No thanks” on the analytics controls or by email.

Security

Production database access is restricted to two server-side keys. All connections to Atamatax and our sub-processors are encrypted in transit (TLS 1.2+). Social-security numbers, brokerage access tokens and other sensitive fields are encrypted at the application layer (AES-256-GCM) before they hit the database. Service-role keys never reach the browser.

No system is perfect. If we discover a security incident affecting your data we will notify you within 72 hours of confirming the incident, and we will publish a post-mortem on the same domain.

Children

Atamatax is intended for adults and knowingly collects information only from individuals aged 16 or over. If you believe a child has provided us data, email support@atamatax.com.

Changes to this policy

We will notify you by email at least 14 days before material changes take effect. The effective date at the top is updated whenever the policy changes.

Contact

Atamatax — raison individuelle, Suisse (registration pending CHF 100k revenue threshold)
Email: support@atamatax.com