Privacy Policy

Atamatax — raison individuelle, Suisse (registration pending CHF 100k revenue threshold) ("Atamatax", "we", "us") operates the Atamatax tax-filing service at atamatax.com. This Privacy Policy describes what information we collect from you, how we use it, with whom we share it, and the controls you have over it.

What we collect

• Account information — your email address and an authentication password hash stored in Supabase Auth.
• Tax-return inputs — your US tax status (citizen or green-card holder), country of residence, filing status, and the figures you enter directly into the wizard.
• Brokerage data — the positions CSVs, statements and holdings files you upload, and the holdings, transactions, security identifiers and balances we read from them. A read-only Plaid connection for US brokerages is built and opens once Plaid's production review completes; until then no brokerage credential and no Plaid data is collected.
• Payment information — when you pay to generate a package, Stripe processes the payment. We receive the resulting Checkout Session id and amount; we never receive your card number.
• Operational logs — Vercel records request IPs, timestamps, and user-agent strings for the routes you hit. We review these only to debug or investigate abuse.
• Cookieless measurement — by default we count page views and tool usage in PostHog (EU region) without cookies or local storage: a random identifier that lasts only for the current page session, no user profile, no session recording, no automatic capture, and never tax-return, account or brokerage details. The requests go through our own domain. Choose “No thanks” on the analytics prompt and nothing at all is sent.
• Optional cross-visit analytics — only after you choose “Allow” on the analytics prompt, the same de-identified identifier is kept in your browser’s local storage so we can see whether a visit later became a purchase. Still no profile, no recording, and nothing about your taxes. You can withdraw it at any time by clearing site data.

How we use it

• Generate a draft PDF package with figures mapped to IRS forms and lines. Your return data stays in your account and in the package you download; you file it yourself outside the Service, so nothing is sent by Atamatax to IRS or FinCEN filing systems.
• Compute PFIC determinations, foreign-tax credit estimates, and treaty positions from your imported holdings.
• Send transactional emails that the current product triggers, such as account welcome, requested checklist delivery, scanner results, and a package-availability notice via Resend. These are not IRS or FinCEN acknowledgements.
• Improve the product. Aggregated, de-identified usage statistics inform what we build next.

Plaid specifically

The Plaid connection is not in use. When it opens, connecting a brokerage will mean agreeing to Plaid's End User Privacy Policy, Plaid will act as a service provider to Atamatax for brokerage data access, and the access tokens we receive will be encrypted at rest with AES-256-GCM and never returned to the browser. This policy will be updated on the day that happens.

Who we share it with

• IRS Modernized e-File & FinCEN BSA — your data reaches these filing systems only when you file. You review the draft package and submit required filings yourself; we share nothing with the IRS or FinCEN through those systems.
• The tax professional assigned to your case — where your engagement includes preparation or review by a credentialed professional, and only after you authorize it on your own case. They receive the case itself: your confirmed facts, your uploaded documents, the figures computed from them and the filings prepared from them, for the sole purpose of completing your engagement. You are shown who they are, you are told if the case is reassigned, and you can withdraw the authorization at any time from your case — which ends their access immediately. If you do not authorize it, nothing in your case reaches a professional.
• Stripe, Inc. — only the data needed to charge you (email, amount, IP address as part of fraud signals).
• Supabase / Vercel / Resend — sub-processors that host the database, the application servers, and transactional email. None of them sell your data; they act under their own DPAs.
• PostHog — de-identified product analytics under the restrictions described above; cookieless by default, persistent only with your consent. Declining analytics does not affect any product feature.
• Law enforcement — only when compelled by a valid US legal process and only the minimum scope demanded.

We do not sell your personal information to advertisers, data brokers, or any third party.

Where we store it

Tax-return data, brokerage tokens (encrypted), and account credentials live in a US-hosted Supabase Postgres database. Static assets and serverless functions run on Vercel. Backup availability and retention depend on the active Supabase project configuration; this policy does not promise a specific backup window.

How long we keep it

We retain return records, generated-package records, and associated brokerage snapshots for seven years after the tax year, matching the IRS standard for return reconstruction. Account credentials are kept for as long as the account is active and deleted within 90 days after you ask us to close the account.

Your rights

You can request a copy of your data, ask us to correct it, or ask us to delete it. Email support@atamatax.com from the address on file. We respond within 30 days.

Residents of the EU/EEA, the UK, and Switzerland. For these users, Atamatax acts as a data controller within the meaning of Regulation (EU) 2016/679 (the "GDPR") and the UK GDPR. Our legal basis for processing your tax-return inputs, brokerage data, and account information is the performance of the contract you enter into when you create an account and use the Service (Art. 6(1)(b) GDPR); for technical and operational logs we also rely on our legitimate interest in maintaining a secure and functional service (Art. 6(1)(f) GDPR). You have the right to:

• access the personal data we hold about you (Art. 15);
• have inaccurate data rectified (Art. 16);
• request erasure of your data (Art. 17), subject to our seven-year retention obligation for return records and supporting workpapers;
• restrict our processing (Art. 18);
• receive your data in a portable, machine-readable form (Art. 20);
• object to processing based on legitimate interest (Art. 21);
• withdraw any consent you previously gave (without affecting prior processing).

To exercise any of these rights, email support@atamatax.com. You also have the right to lodge a complaint with a supervisory authority — for residents of France, the CNIL (cnil.fr/en/plaintes); for other EU/EEA member states, the authority listed at edpb.europa.eu; for the UK, the ICO (ico.org.uk).

California residents. You have additional rights under the CCPA / CPRA: to know what personal information we collect and disclose, to delete personal information, to correct inaccurate personal information, and to opt out of any sale or sharing. We do not sell or share personal information for cross-context behavioural advertising.

Security

Production database access is restricted to two server-side keys. All connections to Atamatax and our sub-processors are encrypted in transit (TLS 1.2+). Social-security numbers, brokerage access tokens and other sensitive fields are encrypted at the application layer (AES-256-GCM) before they hit the database. Service-role keys never reach the browser.

No system is perfect. If we discover a security incident affecting your data we will notify you within 72 hours of confirming the incident, and we will publish a post-mortem on the same domain.

Children

Atamatax is not directed at and does not knowingly collect information from individuals under 16. If you believe a child has provided us data, email support@atamatax.com.

Changes to this policy

We will notify you by email at least 14 days before material changes take effect. The effective date at the top is updated whenever the policy changes.

Contact

Atamatax — raison individuelle, Suisse (registration pending CHF 100k revenue threshold)
Email: support@atamatax.com