Legal

Privacy Policy

Shoebox Tax, Inc. · Effective September 10, 2026 · Last updated September 10, 2026

This Privacy Policy explains how Shoebox Tax, Inc. ("Shoebox," "we," "us," or "our") collects, uses, and discloses information in connection with our website and our document-collection, organization, and return-delivery service for tax professionals (together, the "Service"). Please read it together with our Master Subscription Agreement, Data Processing Addendum ("DPA"), and Portal Terms of Use.

1. The two roles Shoebox plays

Shoebox handles information in two distinct capacities, and your rights differ depending on which applies.

As a Business (Controller). For information about visitors to our website and the firm personnel who administer a Shoebox account (for example, names and emails of preparers, billing contacts, and usage data), Shoebox decides how that information is used, and this Privacy Policy governs directly.

As a Service Provider (Processor). For the tax documents and information that a firm or a firm's client places in the platform, including Tax Return Information such as Social Security numbers and income, Shoebox acts only on the firm's instructions. The firm, not Shoebox, decides how that information is used. This is true whether the information arrives through the firm's portal, a secure link, or directly from a taxpayer by email or text message to the firm's Shoebox address or number. If you are a taxpayer whose documents were collected by your preparer, your preparer's firm is responsible for that data, and you should direct privacy requests about it to your preparer. Shoebox's handling of that data is governed by our DPA with the firm.

2. Information we collect

2.1 Information you provide (as a Business/Controller)

• Account and contact data: name, business email, phone, firm name, job title, and login credentials for firm personnel.
• Trial and demo requests: name, firm, email, tax software used, number of preparers, and anything you choose to tell us in a free-text field.
• Billing data: billing contact and, where applicable, payment information (processed by our payment processor; see Section 4).
• Support and communications: information you provide when you contact us.

2.2 Information collected automatically (as a Business/Controller)

• Usage and device data: IP address, browser and device type, pages viewed, and interactions, collected through cookies and similar technologies (see Section 8).

2.3 Tax data in the platform (handled as a Service Provider/Processor)

When a firm or its client places documents in the platform, the platform processes the information in them, which may include names, addresses, SSNs and ITINs, income and financial-account information, dependent information, and employer and wage data. Documents may arrive by portal upload, secure link, email, text message, or a cloud folder the firm connects, and may include photographs of documents taken on a phone. Shoebox processes this information only to provide the Service to the firm and does not use it for its own purposes. This information is Tax Return Information under IRC § 7216 and is subject to the additional restrictions in Section 5.

3. How we use information

As a Business/Controller, we use website and account information to:

• Provide, operate, secure, and improve the Service and our website;
• Authenticate users and administer firm accounts;
• Respond to trial and demo requests and provision accounts;
• Process billing and communicate about the account, service updates, and support;
• Comply with legal obligations and enforce our agreements;
• Detect, prevent, and respond to fraud, abuse, and security incidents.

As a Service Provider/Processor, we use the tax data in the platform only to provide the Service on the firm's behalf: receiving, storing, converting, naming, organizing, and making it available; sending reminders and delivering completed returns for review and signature at the firm's direction; and, where the firm enables it, extracting data to support the firm's workflow. We do not sell it, do not use it for advertising or profiling, and do not use it to train machine-learning or AI models, except with the firm's and, where required, the taxpayer's separate, specific, prior written consent obtained in compliance with IRC § 7216 and its regulations. We have not sought and do not currently hold any such consent.

We may generate and use aggregated and de-identified data about how the Service operates (for example, system performance and usage metrics), provided it does not identify and cannot reasonably be used to identify any firm, user, or taxpayer, and does not contain Tax Return Information. We do not treat data derived from the contents of tax documents as de-identified.

4. How we disclose information

We are not in the business of selling personal information. We disclose information only as follows.

Service providers and sub-processors. Vendors that help us run the Service, under written contracts requiring them to protect the information and use it only to provide services to us. Any sub-processor that handles Tax Return Information must be located in and process data exclusively within the United States and receives written notice that the penalties of IRC §§ 6713 and 7216 may apply to it. Our current sub-processors are:

• Cloud hosting and storage: Amazon Web Services, United States regions.

The complete and current list, including any vendor we engage for payment processing, document processing, electronic signature, or support, is published at shoebox-tax.com/subprocessors and in Annex B of our DPA. We add a sub-processor to that list before it processes any information, and we give firms at least ten business days' notice before adding or replacing a material sub-processor.

At the firm's direction. For tax data in the platform, we disclose or move information as the firm instructs, for example to the firm's own connected tools or to a taxpayer the firm designates.

Legal and safety. When we believe in good faith it is required by law, court order, or valid governmental request, or necessary to protect the rights, property, or safety of Shoebox, our users, or others. Where legally permitted, we will notify the affected firm of a request relating to its data and coordinate with the firm before responding.

Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to the recipient honoring commitments consistent with this Privacy Policy. Tax Return Information transferred in any such transaction remains subject to the restrictions of IRC § 7216 and the firm's agreement with Shoebox.

5. Tax Return Information (IRC § 7216)

Tax Return Information is subject to federal law (IRC § 7216) that restricts how it may be used and disclosed. Shoebox processes Tax Return Information solely to provide the Service to the firm and does not use or disclose it for any other purpose without consent obtained as required by law. Because the firm is the party with the direct relationship with the taxpayer, the firm is responsible for obtaining any consents required under § 7216. If you are a taxpayer, direct questions about the use of your tax information to your preparer.

If a firm asks Shoebox to help move client information into the platform during onboarding, the firm's administrator invites a named Shoebox employee into the firm's account as a user, and Shoebox does that work only for that purpose and under the same restrictions. The firm can remove that access at any time.

6. Data security

We maintain administrative, technical, and physical safeguards designed to protect information, consistent with the Master Subscription Agreement and DPA. These include:

• Encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent).
• Hosting on Amazon Web Services in the United States. We rely on AWS for physical and infrastructure security, with independent certifications including SOC 2 and ISO 27001.
• Role-based access controls. Each firm's data is kept separate from every other firm's. Shoebox staff cannot open a firm's client documents unless the firm's administrator invites a named Shoebox employee into the firm's account as a user (Section 5), and the firm can remove that access at any time.
• Multi-factor authentication available to every user. A firm administrator can turn it on for anyone in the firm and see who has it enabled. Multi-factor authentication is required for administrative access to Shoebox's own systems.
• One-time sign-in links for firm users, and client upload links that expire on a schedule the firm chooses.
• Logging and monitoring of access to personal information.
• Regular vulnerability testing, periodic independent security assessment, and a documented incident-response plan.

No system is completely secure, and we cannot guarantee absolute security. Shoebox has not yet obtained an independent certification of its own security program and does not claim one.

If we confirm a security incident affecting personal information we process, we will notify the affected firm without undue delay and provide, to the extent known, a description of the incident and the categories and approximate volume of information and individuals involved, a Shoebox contact, the likely consequences, and the measures taken or proposed. Because the firm holds the direct relationship with affected individuals and the primary legal notification duty under state breach-notification laws, we coordinate notice with the firm.

7. Text messages and email

At a firm's direction, Shoebox may send email and text-message reminders to the firm's clients about outstanding documents, organizers, engagement letters, and signature requests, and may deliver completed returns for review and signature by email or text. Each firm is responsible for obtaining its clients' consent to receive text messages from or on behalf of the firm before enabling text reminders. A client may stop text messages at any time by replying STOP, and may ask the firm to stop email reminders. Message and data rates may apply.

Each firm may receive a Shoebox email address and phone number to which its clients can send documents directly. Messages and attachments sent to those addresses are handled as tax data on the firm's behalf under Section 1 and are not used for any other purpose.

8. Cookies, analytics, and Global Privacy Control

We use cookies and similar technologies to operate the site, remember preferences, secure the Service, and understand usage. Any site analytics service we use is listed on our sub-processor page. We do not use cookies or any other technology to share personal information for cross-context behavioral advertising. You can control cookies through your browser settings; disabling some cookies may affect functionality.

We honor Global Privacy Control signals. Because we do not sell or share personal information, honoring the signal does not change how we handle your data. We do not respond to browser Do Not Track signals, for which there is no common standard.

9. Data retention

We retain website and account information for as long as needed to provide the Service and for legitimate business and legal purposes. Tax data in the platform is retained according to the retention period the firm selects within the range Shoebox makes available (for example, between three and seven years, reflecting preparers' recordkeeping obligations) and the firm's agreement with Shoebox.

A firm may request deletion of specific data or of a particular taxpayer's data at any time, and we will comply within a commercially reasonable period, subject to legal-retention requirements. When a firm's subscription ends, its data is available for export for thirty days, after which we delete or de-identify it, targeting ninety days after termination, except for data the firm has configured for longer retention, records we must keep by law, and backup copies purged on our standard rotation cycle.

10. Your privacy rights

10.1 State privacy rights (US)

Depending on your state of residence, you may have rights to know or access the personal information we hold about you; correct inaccurate information; delete your information; obtain a portable copy; and opt out of the "sale" or "sharing" of personal information or certain profiling. Shoebox does not sell personal information and does not share it for cross-context behavioral advertising.

Because Shoebox serves firms nationwide, we extend core access, correction, and deletion rights to residents of all US states, regardless of whether a specific state law currently requires it.

10.2 How to exercise rights

Submit a request to privacy@shoebox-tax.com. We may need to verify your identity. You may use an authorized agent where permitted. We will not discriminate against you for exercising your rights.

Routing rule. If your request concerns tax data your preparer collected, we will forward it to your preparer's firm, because the firm, not Shoebox, controls that data, and we will take no further action except on the firm's instruction.

10.3 CCPA/CPRA disclosure table (California)

The following summarizes, for the categories of personal information Shoebox handles as a Business, the sources, purposes, and recipients. Tax data handled as a Service Provider on a firm's behalf is excluded from this table, consistent with the CCPA service-provider framework.

11. Children's privacy

The Service is intended for use by tax professionals and is not directed to children. We do not knowingly collect personal information directly from children. Tax returns may contain information about dependents, including minors; that information is provided by the firm or taxpayer and is handled as tax data on the firm's behalf, not collected by Shoebox directly from a child.

12. International users

The Service is intended for use in the United States, and information is stored and processed in the United States. We do not currently offer the Service to individuals in the European Economic Area, United Kingdom, or Switzerland, and we do not engage sub-processors that process Tax Return Information outside the United States.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last Updated" date and, for material changes, provide additional notice as required by law or our agreement with your firm.

14. Contact us

Questions or requests regarding this Privacy Policy:

Shoebox Tax, Inc., Attn: Privacy
Email: privacy@shoebox-tax.com

End of Privacy Policy