Privacy Policy
How we collect, use, and protect your information
Last updated: February 9, 2026
Overview
CK Reynolds Tax Service (“we,” “us,” or “our”) is committed to protecting the privacy and security of your personal and tax information. This policy describes what information we collect, how we use it, how we protect it, and your rights regarding your data.
As an IRS Enrolled Agent, we are bound by IRS Publication 4557 (Safeguarding Taxpayer Data) and maintain strict data security standards.
Information We Collect
Account Information
- Name, email address, phone number
- Mailing address
- Account credentials (password stored as a one-way hash)
Tax Documents & Financial Information
- Tax forms you upload (W-2s, 1099s, receipts, and other documents)
- Information you provide during consultations (income, expenses, deductions)
- Prior-year tax returns
Payment Information
- Service tier selected and payment amount
- Card brand and last 4 digits (for your reference only)
Technical Information
- IP address and browser type (for security and login history)
- Login timestamps
- Session identifiers (stored as encrypted HttpOnly cookies)
How We Use Your Information
Tax preparation
To prepare and file your tax returns accurately
Account management
To maintain your secure client portal
Communication
Appointment reminders, document requests, and filing updates
Payment processing
To process service payments through Square
Security
To detect unauthorized access and protect your account
Legal compliance
To comply with IRS requirements and applicable laws
How We Protect Your Information
Encryption
- In transit: All data transmitted over HTTPS (TLS 1.2 or higher)
- At rest: Documents encrypted with AES-256 server-side encryption
- Passwords: Stored using bcrypt with a cost factor of 12 (one-way hash, never stored in plain text)
Access Controls
- Every request for your data is checked against your account before it is answered, so you only ever receive your own records
- Admin access is role-restricted and logged in audit trails
- Session cookies are HttpOnly and secure (cannot be accessed by JavaScript)
- Password reset tokens expire after 15 minutes and are single-use
Infrastructure
- Database hosted on Supabase (AWS infrastructure, SOC 2 Type II compliant)
- Document storage on Backblaze B2 (encrypted at rest)
- Document uploads and downloads, administrative actions and sign-in events are recorded in an audit log
Third-Party Services
We use the following third-party services to operate our platform. Each processes only the minimum data necessary:
| Service | Purpose | Data Shared |
|---|---|---|
| Square | Payment processing | Card details (entered directly into Square's form; we never receive the full card number) |
| Supabase | Database hosting (United States) | Account, profile, appointment and payment records |
| Backblaze B2 | Document storage (United States) | Uploaded documents (encrypted at rest) |
| IONOS | Email delivery | Email address, message content |
| Hetzner | Server hosting (Germany) | Any data the portal is processing at the time, while it is being processed |
| Herakles Dev | Platform engineering and system administration | Administrative access to the systems holding your information |
| Sentry | Error monitoring | Error diagnostics, with personal details scrubbed |
| Upstash | Rate limiting and abuse prevention | IP address and request counts (no account data) |
| Plausible Analytics | Website analytics | Aggregate page views only — no cookies, no IP address stored |
| Google (Gmail) | Practice mailbox for enquiries and notifications | Name, email address, telephone number and message content from the contact form, and appointment and document notifications |
| Microsoft 365 | Business email | Correspondence you send to our email address |
We do not sell, rent, or share your personal information with any third parties for marketing purposes.
Data Retention
Tax documents
7 yearsPer IRS requirements (Pub 4557)
Account data
While activeRetained as long as your account is active
Payment records
7 yearsFor tax and legal compliance
Audit logs
3 yearsFor security purposes
These are the minimum periods we keep your information. They are not automatic expiry dates: nothing is erased on a timer. We review what is held and dispose of what is no longer needed as part of a periodic review, and a document is fully gone only once the encrypted backup copies that contain it have also expired on their own cycle.
Your Rights
You have the right to:
- Access — View all personal data we hold about you through your client portal
- Correct — Update your profile information at any time
- Delete — Ask us to close your account and withdraw your documents from the portal. Because the IRS requires us to keep records of the returns we prepare, the underlying tax records are retained for the periods above rather than erased, and backup copies expire on their own cycle
- Export — Request a copy of your data
- Opt out — Manage your email notification preferences in your profile settings
Contact Us
If you have questions about this privacy policy or how we handle your data:
- Email: ckreynoldstaxservice@gmail.com
- Or use our contact form
IRS Pub 4557 Safeguards
CK Reynolds Tax Service follows IRS Publication 4557 guidelines for safeguarding taxpayer data, including encryption at rest and in transit, access controls, secure document storage, and audit logging of document access, administrative actions and sign-in events.