Privacy Policy

What we collect, how we use it, and the choices you have. We do not sell your personal information.

Version 1.0 · Effective: June 14, 2026 · Contact: privacy@deduckt.ai

1. Information we collect

Tax documents and tax return information you upload, such as a Form 1040, W-2, and 1099 forms. Financial account data if you choose to link accounts, accessed through our provider Plaid (account balances, holdings, and investment transactions). Account and contact information such as your name and email. Usage and device data collected through privacy-respecting analytics.

2. How we use your information

We use your information to analyze your tax situation, produce estimates and findings, power year-round monitoring of tax thresholds, and operate and improve the service. Your most sensitive data is processed inside our deterministic tax engine, which performs all tax calculations.

3. Account linking through Plaid

When you connect a financial account, we use Plaid Inc. to securely access your investment holdings and transactions on your behalf. Plaid handles your credentials; we receive account and holdings data, not your bank login. Plaid's handling of your data is governed by Plaid's own end user privacy policy. We use this data only to provide Deduckt's analysis and suggestions to you, and you can disconnect an account at any time.

4. We do not sell your data

We do not sell your personal information, and we do not share your tax return information or financial-account data with third parties except service providers who help us operate the service, and only with your consent where the law requires it.

5. Service providers and subprocessors

We use vetted providers for hosting, document reading, account linking (Plaid), and email. Each is bound by a data processing agreement with confidentiality and security obligations and, where applicable, terms that prohibit using your data to train their models and require limited or zero data retention. See our current list of subprocessors.

6. Artificial intelligence and your data

We use automated models to help explain findings in plain language. We do not send raw identifiers such as Social Security numbers or financial account numbers to third-party model providers; sensitive values are removed or replaced before any such processing. All tax math is performed by our own deterministic engine.

7. Security

We encrypt data in transit (TLS 1.2 or higher) and at rest (AES-256), apply access controls and logging, and field-encrypt highly sensitive secrets such as linked-account access tokens. See our Information Security Policy for details.

8. Data retention and deletion

We retain your data only as long as needed to provide the service or as required by law. You can delete your account and all linked data at any time from your settings, after which we remove it from active systems within a defined window, subject to legal retention requirements.

9. Cookies and analytics

We use strictly necessary cookies to keep you signed in and to secure your session. We use privacy-respecting, aggregate analytics to understand how the service is used and to improve it; we do not use third-party advertising trackers and we do not sell or share this data for cross-context behavioral advertising. You can control cookies through your browser settings.

10. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or port your data and to opt out of certain processing. California residents have rights under the CCPA as amended by the CPRA, including the right to know, delete, correct, and to opt out of sale or sharing (we do not sell or share your personal information). We will not discriminate against you for exercising these rights. To exercise rights, contact privacy@deduckt.ai; we may need to verify your identity before acting on a request.

11. Children

Deduckt is intended for adults and is not directed to children under 18. We do not knowingly collect personal information from children under 18. If you believe a child has provided us information, contact us and we will delete it.

12. Changes and contact

We may update this policy from time to time. When we make material changes, we will post the updated policy here with a new effective date and, where appropriate, notify you. Questions or privacy requests: privacy@deduckt.ai.

This Privacy Policy describes how Deduckt handles your information. It is provided for transparency and is not legal advice.