Privacy Policy

1. Information we collect

Only what a return needs, and only what you or your documents give us:

• Identity and contact details — name, address, date of birth, email address and mobile phone number.
• Social Security Numbers for you, your spouse and your dependents.
• Income and tax information — W-2s, 1099s, schedules, deductions and credits.
• Bank routing and account numbers, when you ask for a direct-deposit refund or a direct-debit payment.
• Documents you upload, when you ask us to prepare the return for you.
• Account security data — a password hash, a PIN hash, and session records.
• Filing-security data the IRS requires on every e-filed return to help prevent fraud — when you start and when you file a return, the public IP address you connect from, your browser's time zone setting, and a device identifier: a random code in a long-lived cookie this site sets in your browser, of which only a one-way hash is stored and sent to the IRS (the cookie itself contains no personal information).

We never collect or store your card number. Payments run through Stripe Checkout, which handles card data entirely. No card number reaches this system at any point.

2. How we use it

To prepare, review, sign and electronically file your return; to verify that you are who you say you are; to take payment for the filing fee; and to answer you when you ask for help.

Federal law is stricter than general privacy law here. Under 26 U.S.C. §7216 and 26 CFR 301.7216, a tax return preparer may not use or disclose the information in your return for any purpose other than preparing it without your separate, written, informed consent. We do not ask for that consent and we do not use your return information for marketing, advertising, analytics, model training or resale.

3. Who we share it with

We do not sell your information. We do not rent, trade or disclose it for anyone else’s marketing. It is shared only with:

• The IRS and state tax authorities — the return itself, which is the purpose of the service.
• Service providers that operate this system, each limited to what its job requires: Vercel (hosting and private document storage), Prisma Postgres (the database), Stripe (payments), Resend (transactional email), and Amazon Web Services (the phone calls between you and your tax expert).
• Google, from our two advertising pages only (vordanatax.com/start and vordanatax.com/empezar). When you open one of those pages, the Google Ads tag lets Google set cookies in your browser and learn that you visited, which ad brought you there, and whether you clicked “Start my return” — nothing else. The tag does not run on any other page of this site, so nothing you enter in this service — your name, email, Social Security number or anything on your return — ever reaches Google through it, and we have turned off Google’s use of your visit to personalize ads. Google handles what it receives under its own privacy policy. You can block or delete these cookies in your browser settings.
• Anyone you explicitly ask us to share with, or where a law, subpoena or court order requires it.

4. How we protect it

• Social Security Numbers and bank account numbers are encrypted at the field level with AES-256-GCM envelope encryption — each value gets its own data key, and a tampered or truncated ciphertext fails closed rather than being accepted.
• Duplicate-SSN checks run against a one-way HMAC index, never against a plaintext value.
• Only the last four digits of an SSN or account number are ever displayed.
• Uploaded documents are held in a private store and served only through a route that re-checks that the file belongs to you.
• Passwords and PINs are stored as bcrypt hashes, never in plain text.
• All traffic runs over HTTPS/TLS, and the database connection requires a fully verified certificate.

We maintain physical, electronic and procedural safeguards that comply with applicable law and federal standards.

No system is perfectly secure, and we maintain a written information security plan that records our known risks and what we are doing about them, as the FTC Safeguards Rule requires.

5. Your phone number

When you create an account you enter your own phone number. It is how a person here reaches you about your return — a call from your tax expert, or a call back when you ask for help.

• We do not send you text messages. No verification code, no reminders, no marketing — nothing is texted to the number you give us. Your account is verified by email instead.
• We do not share, sell, rent or trade your phone number with anyone for marketing purposes, and we do not share it with third parties for their own purposes at all. It reaches our telephony provider only at the moment a call is placed, so that the call can connect.
• You can change or correct the number at any time from your account page, and you are never obliged to answer a call to use this service.

6. How long we keep it

We keep your account and return records for three years after the return is filed, and dispose of them after that. As an Authorized IRS e-file Provider we are required to retain certain return records for three years (IRS Publication 1345), and the FTC Safeguards Rule requires us to dispose of customer information no later than two years after the last time we used it, unless a law or a legitimate business need requires longer. When records are disposed of, they are deleted from the database and from document storage.

7. Your choices

• You can ask for a copy of the information we hold about you, or ask us to correct it.
• You can ask us to delete your account and its data, subject to the retention rules above.
• You can decline to provide information — but a return cannot be prepared or filed without the data the form requires.

8. Children

This service is for adults filing their own returns. We do not knowingly let anyone under 18 create an account. A dependent’s details appear on a return only because the adult filing it entered them.

9. Changes

If this notice changes materially we will update the effective date above and, where the change affects how your information is used, tell you directly.