What happens to the return you upload

What you give us. Your name, email address, the organization named on the return and its EIN if you provide it, notes you add to an order, board questions you post, and the Form 990 PDFs you upload. Consultants in the referral program also give us a business name and how they want to be paid.

Payment. Payments are taken by PayPal or Stripe. We receive the name and email you gave them, the amount, the plan, and a payment reference. We never see or store your card number.

What we produce. The extracted text of your return, the analysis, the report and its PDF, status history, and any notes a CPA adds while reviewing it.

Technical. Standard server logs, and one cookie named ref990 set only when you arrive through a consultant's referral link, so the consultant is credited. It lasts two years and holds only the referral code. We keep a hashed form of your IP address with the time and kind of each form submission for 90 days, to limit abuse. Your sign-in session is kept in your browser's local storage, and the site assistant keeps its transcript in your browser's session storage. We do not run advertising trackers.

To produce your report and deliver it, to answer your questions, to check that a file is the form you paid for, to run your board pack or firm plan, to credit a consultant who referred you, and to send you the emails described below. We also read reports internally to improve the checklist and the wording the software uses.

After a one-off report, we send two follow-up emails: one asking whether the report answered the question, and one about the pre-filing review and the referral program. Each carries a link that stops them; opening it, or using your mail program's unsubscribe button, stops the rest at once. You can also stop them by replying. Emails about your order itself, such as a report being ready, are sent while you have an active order.

The text of your return is sent directly from our server to OpenAI, the AI model provider, to draft the analysis. For a scanned return with no text layer, the PDF pages themselves are sent so the model can read them. That return is a copy of a document that is either public or one you have chosen to share with us. We send the return, the organization name you typed, and the EIN and tax period you confirmed; we do not send your email address or payment details to the model. The draft that comes back is stored with your order and, where a red flag appears, read by a licensed CPA before release.

Two assistants use the same provider. The report assistant on your report page sends your finished report and your questions; that transcript is stored with your order. The site assistant on the public pages sends your questions; that transcript is stored for 90 days against a hashed form of your IP address, not your name.

When you give us an EIN, or the return you upload carries one, we also look up that organization's public IRS e-file record through ProPublica's Nonprofit Explorer. That gives the report exact totals from the IRS's own data and prior years for comparison, and lets us pull the public filing when you have only an EIN. The lookup sends the EIN and nothing else.

Staff of R.S. McDuffie CPA & Associates who review reports and answer questions.

Service providers that run the site for us: Supabase (database, sign-in and file storage, where uploads and reports are kept), Vercel (hosting), OpenAI (the AI model described above), Resend (email), PayPal or Stripe (payments), ProPublica Nonprofit Explorer (the public IRS record lookup), Plausible (privacy-focused analytics, when enabled: page views and the plan and amount of a purchase, with no cookies), and Google Fonts (the site's fonts are loaded from Google, so Google sees the request). Each processes data only to provide its service to us.

A consultant who referred you can see the organization name and the amounts of payments that earned a referral fee. They never see your uploaded return or the contents of a report.

Nobody else. We do not sell or rent your information. We disclose it only if the law requires it or to protect the rights and safety of our clients and our firm.

Uploaded returns and finished PDFs sit in private storage that is never publicly listable. Customers reach their own report through a private link with a long random token, or through their signed-in account, and downloads use short-lived signed URLs. Database access is restricted by row-level rules so a signed-in client can read only their own orders. Staff access is limited to accounts with a review role.

The private link is a key. Anyone who has it can see the report, so share it only with people who should read it.

We keep uploaded returns, reports and order records for three years after the order, so you can come back to a report and so a board pack can compare year to year. A scheduled job removes uploaded returns, reports and order records three years after the order. The form-submission log and the site assistant's transcripts are removed after 90 days. Payment records are kept as long as tax and accounting rules require. Referral records are kept for the life of the referral relationship plus the period needed to settle payouts.

You can delete an uploaded return and its report sooner yourself, from your portal, or ask us to. When you ask, we will do so within 30 days unless we are required to keep a record of the transaction, in which case we keep the minimum needed and delete the return and report.

You can see and download your reports in your portal at any time. In your portal you can also download a copy of your data as a file and delete your account, which removes your orders, reports, uploaded returns and messages; payment records are kept as tax and accounting rules require. Email rolanda@rsmcduffiecpa.com to correct your details or if you would rather we do any of this for you. You can stop follow-up emails at any time with the link in them. Residents of states with consumer privacy laws have the rights those laws provide, and we honor them on request.

The service is for organizations and the adults who run, fund and advise them. It is not directed at children under 16 and we do not knowingly collect their information.

When this policy changes, the effective date at the top changes with it. Questions about your data go to rolanda@rsmcduffiecpa.com. The terms of service and refund policy cover the rest of the relationship.