Privacy policy

This policy describes how GhimTech handles personal information in connection with the GhimTech Tax website and the GhimTech Tax software (together, the “service”). It covers the public pages you are reading now, the preparer workspace, and the client portal.

Where a tax practice uses the software to prepare returns for its own clients, that practice decides what information is collected and why, and we process it on their instructions. In that arrangement the practice is the party a taxpayer should approach first about their own records; we will support any request that reaches us and tell the practice about it.

This policy does not cover any website or service operated by someone else, including a taxing authority, even where we link to it.

We collect three kinds of information, and no more than the service actually needs.

Information you give us directly. Account details such as a name, email address and role. Messages you send us, including anything you choose to put in them.

Tax return information, given by you or by your preparer. Identifiers for the filer, a spouse and dependants; income, deduction and credit figures; bank details where a direct deposit or electronic payment is requested; uploaded source documents; and the signatures and authorizations that permit a return to be filed.

Technical information.Server logs recording requests to the service, including IP address, timestamp, and the page or endpoint requested, kept for security monitoring and troubleshooting. Application access logs recording which signed-in user viewed or changed which record, which exist so that a practice can answer the question “who has seen this file”.

We do not use advertising pixels, third-party analytics tags, session-replay tools or fingerprinting scripts. Typefaces are served from our own infrastructure, so visiting this site does not disclose your visit to a font provider.

Federal law places specific limits on what a tax return preparer may do with tax return information. In general, using or disclosing that information for any purpose other than preparing the return requires a separate, specific, written and informed consent from the taxpayer, given before the use or disclosure occurs.

We treat all return information — the figures, the documents, and the identifiers — as falling within that standard, and we do not rely on general agreement to this policy as consent for anything of the kind. If we ever need such a consent, we will ask for it plainly, on its own, and it will be refusable without losing access to the service.

We use the information described above to:

• prepare, review, transmit and keep a record of tax returns;
• operate the service — authenticate users, maintain sessions, deliver documents, send transactional notices such as a document request or a filing status change;
• run the diagnostics that check a return before it is filed;
• keep the service secure, investigate suspected misuse, and satisfy record-retention obligations;
• answer messages you send us; and
• improve reliability using aggregate, non-identifying operational measurements such as error rates and response times.

We do not use client documents or return figures to train machine-learning models. We do not sell, rent or otherwise make personal information available for anyone else’s marketing.

Information leaves our systems in a small number of defined circumstances.

Taxing authorities. A completed return is transmitted to the relevant federal, state or local authority when it has been authorized for filing.

Service providers. We use a small set of providers for cloud hosting and database, object storage for documents, transactional email, and the channel that carries an electronic filing. They act on our instructions under contract and may not use the information for their own purposes. A current list is available on request.

Within your practice. Where a practice uses the service, its administrators, assigned preparers and reviewers see the records their role permits, as described on our security page.

Legal process. Where a valid legal obligation requires disclosure. Where we are permitted to tell you that it has happened, we will.

A change of ownership. If the business or the service is transferred, information may transfer with it, subject to the same commitments as this policy — and, for tax return information, subject to the consent rules described in section 3.

Connections are encrypted in transit, documents and databases are encrypted at rest, access is limited by role, identifiers are masked to their last four digits everywhere in the interface, and reads as well as writes are recorded in an access log.

The mechanisms are described in detail — including the ones we deliberately do not claim — on our security and privacy page. No system is perfectly secure, and we do not claim otherwise.

Tax records are subject to retention obligations that fall on preparers and on taxpayers, and those obligations outlast most people’s wish to have a record deleted. A practice therefore sets a retention period for completed returns and their source documents within the limits those obligations impose, and records are purged on a schedule once the period elapses.

Account records are kept while the account is active and for a reasonable period afterwards. Server logs are kept for a short operational window. Access logs are kept for as long as the records they describe, because an audit trail that expires before the record it documents is not an audit trail.

Deletion removes information from live systems promptly; encrypted backups are not surgically edited, and deleted records fall out of them as those backups age out of their rotation.

You can ask us for a copy of the personal information we hold about you, ask us to correct it if it is wrong, ask us to delete it, or ask us to explain where it came from. Write to tax@ghimtech.org and we will respond.

Two honest limits. First, where a retention obligation applies, we may not be able to delete a record even if we would like to — we will say so and explain why. Second, where your information sits inside a practice’s account, we will route the request to that practice rather than acting on their records unilaterally.

Privacy rights vary by state and are changing. Where a law that applies to you grants a right beyond what is described here, we will honour it; we would rather do that than publish a list of statutes that goes stale.

The service uses a session cookie to keep you signed in. It is strictly necessary — the service cannot work without it — and it carries no advertising or tracking function.

Your light or dark theme choice is stored in your own browser under the key gt-theme. It never reaches our servers and identifies nothing about you.

There are no advertising cookies, no cross-site tracking cookies and no third-party analytics cookies on this site, which is why you are not being asked to dismiss a banner.

The service is intended for adults. We do not knowingly create accounts for children. Information about a child does appear in tax returns — a dependant has a name, a date of birth and an identifier — and that information is provided by the adult preparing the return and is protected exactly as the rest of the return is.

The service is operated for taxpayers and practices in the United States, and personal information is stored on infrastructure located in the United States. We do not offer the service to people outside the United States, and we do not routinely transfer personal information abroad.

When this policy changes we will update the date at the top of the page. If a change materially affects how we use information that we already hold, we will tell affected users directly rather than relying on you to notice a new date.

Questions about this policy, or a request about your own information, should go to tax@ghimtech.org. Putting “Privacy” in the subject line will get it to the right person sooner.