Draft status: The actual data flows, vendors, retention periods, security controls, and user-rights process must be confirmed by TaxFlow AI and reviewed by qualified counsel before publication. Effective date: [insert date].
1. Who is responsible
The proposed service provider is [insert registered legal entity, address, and privacy contact]. Confirm whether additional entities act as controllers or processors and identify the privacy contact responsible for requests.
2. Information that may be processed
Depending on the features used, the Service may involve account and contact details, business profile information, invoices and transaction records, tax identifiers, support messages, and technical usage data. Confirm precisely which categories are collected, whether sensitive or financial data is involved, and which fields are optional.
3. Purposes and legal bases
Potential purposes include providing requested features, account administration, support, service security, and compliance with legal obligations. [Document the actual purposes and applicable legal basis for each processing activity in every relevant jurisdiction.] Do not use customer financial records for model training or unrelated purposes unless this is specifically assessed, disclosed, and lawfully authorized.
4. Service providers and disclosures
List the hosting, analytics, communications, payment, AI, and support providers that may receive data, what they receive, where they process it, and the safeguards in place. [Insert verified vendor list and international-transfer details.] The final notice must explain any legally required disclosures.
5. Retention and deletion
Set a retention period or clear criteria for each data category, including uploaded source documents, derived records, support communications, backups, and closed accounts. Describe export and deletion requests, backup expiry, and any records that must be retained by law. [Insert confirmed retention schedule.]
6. Security
Describe only security measures that have been implemented and verified. Do not promise absolute security. [Have the technical team document current access controls, encryption, monitoring, incident response, and vendor safeguards for counsel review.]
7. Your choices and rights
Explain the rights available to users under laws that apply to them, how to submit a request, how identity is verified, expected response times, and any appeal process. [Insert a monitored privacy-request channel and confirm the applicable rights with counsel.]
8. Children and changes
Confirm whether the Service is intended for adults or businesses only and establish a process for handling data submitted about minors. Describe how material changes to this notice will be communicated and when they take effect.
9. Contact
For privacy questions, contact info@taxflowai.net only if this inbox is monitored and approved for privacy requests. Replace it with the designated privacy contact if needed.