Privacy Policy
Velocity Tax Group, LLC (Texas) · Last updated August 23, 2026
1. What we collect
- Account information: name, email, role, profile photo, and integration identifiers you provide (e.g., your Fathom account email).
- Engagement records: documents and tax information you or your preparer upload, client records, and notes.
- Meetings: where meetings are recorded (e.g., via Fathom), transcripts, AI summaries, and action items derived from them.
- Platform activity: logins, document access, edits, deletions, approvals, and questions asked of AI-assisted features. Activity logs are tamper-evident and retained.
2. How it's used
- To perform tax and accounting services for clients under the supervision of credentialed professionals.
- To operate AI-assisted features: document classification, meeting summaries, question answering, and meeting preparation. AI context is scoped to the requesting account — a client's questions are answered only from that client's records plus the firm's general knowledge, never from other clients' data.
- To supervise quality: authorized staff may review AI conversations and platform activity.
- To secure the platform and meet legal and professional obligations.
3. Tax return information (IRC §7216)
Federal law restricts use and disclosure of tax return information. Where §7216 consent is required — including for certain AI-assisted processing — we obtain written consent before that use. Consent records are retained.
4. Who we share it with
We do not sell personal information. We share it only with service providers who process it to run the platform, under contractual confidentiality: Supabase (database, authentication, storage), Netlify (hosting), Anthropic (AI processing — Anthropic does not train its models on our API data), Resend (transactional email), and Fathom (meeting recording, where used). We may disclose information when required by law or to protect rights and safety.
5. Security
- Encryption in transit and at rest; row-level access controls enforced in the database.
- Mandatory two-factor authentication for staff; session limits (30-day maximum, 7-day inactivity).
- Every access and change is logged in a tamper-evident audit record.
- Departing personnel are deactivated immediately and retain no access.
6. Retention
Engagement records are retained in accordance with professional standards and applicable law. User accounts are deactivated rather than deleted so audit history remains intact. Some transient content (such as raw chat messages, where a purge schedule applies) may be summarized into the engagement record before removal.
7. Your choices
- Clients may request a copy of their documents and records at any time through their preparer.
- Questions or concerns: team@velocitytax.io.
8. Changes
We may update this policy; the version presented at sign-in is the operative one, and material changes require re-acceptance.