Privacy Policy

Hub Software, LLC, which provides CPA Hub ("we," "us," or "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services (collectively, the "Service"). Please read this Privacy Policy carefully. By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

1. Information We Collect

1.1 Information You Provide to Us

We collect information that you voluntarily provide when using our Service, including:

Account Information: Name, email address, firm name, and password when you create an account.

Billing Information: Payment card details and billing address processed through our payment provider (Stripe).

Firm Information: Firm branding assets such as logos, contact information, and practice details.

Client Data: Information about your tax clients that you enter into the system, including names, contact information, tax documents, and financial data.

Communications: Information you provide when contacting us for support or feedback.

1.2 Information Collected Automatically

When you access or use our Service, we automatically collect certain information, including:

Log Data: IP address, browser type, operating system, referring URLs, pages viewed, and access times.

Device Information: Device type, unique device identifiers, and device settings.

Usage Data: Features used, actions taken, and interaction patterns.

Cookies and Similar Technologies: We use cookies and similar tracking technologies to maintain sessions and improve your experience.

1.3 Website Visit Counting

We count visits to the public pages of cpa-hub.com so we can tell how many people reach them. We do not use a third-party analytics service, an advertising network, or a tracking cookie to do it.

A visit is recorded against a one-way hash of that day's random secret combined with your IP address, your browser's user-agent string, and the site address. The secret is generated at random, exists only in the server's memory, and is discarded when the day ends in US Pacific time. The result is that the hash cannot be reversed, cannot be matched to you, and cannot be connected to your visit on any other day.

We do not store your IP address, your user-agent string, or a cookie for this purpose. What we keep is a count of visits per page per day, and the host name of the website that referred you, if there was one.

1.4 Information from Third Parties

We may receive information from third-party services you connect to CPA Hub, including QuickBooks Online for client synchronization and other integrations you authorize.

2. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, maintain, and improve our Service
• To process transactions and send related information, including confirmations and invoices
• To create and manage your account
• To authenticate users and ensure account security
• To respond to your comments, questions, and support requests
• To send technical notices, updates, security alerts, and administrative messages
• To provide AI-powered document classification and data extraction services
• To generate tax profiles and compliance reports for your clients
• To monitor and analyze usage trends and preferences
• To detect, investigate, and prevent fraudulent transactions and unauthorized access
• To comply with legal obligations
• To enforce our Terms of Service and protect our rights

3. Client Data and Tax Information

3.1 Tax Document Processing

3.2 Data Isolation

CPA Hub is a multi-tenant platform with strict data isolation. Each firm's data is logically separated, and firms cannot access other firms' data, client information, or documents.

3.3 WISP Compliance

CPA Hub includes tools to help you comply with IRS Written Information Security Plan (WISP) requirements. We maintain security practices consistent with IRS Publication 5708 guidelines.

4. Data Retention

4.1 Active Accounts

We retain your information for as long as your account is active or as needed to provide you with our Service.

4.2 After Account Termination

Upon account termination or deletion, we will delete or anonymize your personal information within 30 days, except where we are required to retain information for legal, accounting, or regulatory purposes.

4.3 Audit Logs

System audit logs containing access records, login attempts, and security events may be retained for up to 12 months for security and compliance purposes.

5. Information Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

5.1 Service Providers

We share information with third-party service providers who perform services on our behalf, including:

• Stripe for payment processing
• Railway for cloud hosting infrastructure
• Cloudflare for document storage. Every document your firm or your clients upload — tax returns, source documents such as W‑2s, 1099s and K‑1s, and any file exchanged through a client portal — is stored in Cloudflare R2 object storage, in a bucket restricted to the United States jurisdiction, which Cloudflare guarantees keeps that data stored and processed within the United States. Under Cloudflare’s Data Processing Addendum it processes that content only on our written instructions (§3.1(a)), does not use it for marketing or advertising (§3.1(b)), and limits access to authorised personnel under obligations of confidentiality (§3.1(d)).
• Brevo (formerly Sendinblue) for transactional email
• Anthropic for AI-powered document processing. Document content necessary for extraction is transmitted for processing and may include personal information contained within tax documents. This provider does not use the transmitted content to train its models and does not retain it after processing.
• Sentry for application error monitoring. When a request fails, we transmit the error type and message, the stack trace with our own source lines, the request method and path, and a reference code that also appears in the response you receive. The Sentry SDK is configured so that request bodies, query strings, HTTP headers, cookies, user identifiers, the content of AI requests and responses, and the values of local variables at the point of failure are not transmitted, and those fields are stripped again immediately before an event is sent. Our Sentry organization stores its data in Sentry’s United States region, which Sentry states is held at rest in Iowa and cannot be relocated once chosen. Sentry retains error events for the period set by its published retention schedule — currently 30 days on its Developer plan and 90 days on its paid plans.
• OpenAI for tax-research search. When a member of your firm runs a tax-research query, the text of that query is transmitted to OpenAI to generate a search embedding, and the text of ingested public IRS publications is transmitted for the same purpose. Before a query is transmitted we remove Social Security and taxpayer identification numbers, employer identification numbers, email addresses, telephone numbers, and the full names of your firm's individual and business clients. OpenAI does not use data submitted through its API to train its models, and retains it for up to 30 days for abuse monitoring. Your clients' tax documents are not sent to OpenAI.

5.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court order, subpoena, or government agency request).

5.3 Business Transfers

If we are involved in a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or uses of your personal information.

6. Data Security

We implement appropriate technical and organizational measures to protect your information, including:

• Encryption of data in transit using TLS/SSL
• Field-level encryption for sensitive data (Social Security numbers and bank routing and account numbers) using AES-256-GCM
• Secure password hashing using bcrypt
• Two-factor authentication (2FA) support
• Role-based access controls
• Session management with trusted device tracking
• Comprehensive audit logging
• Regular security assessments and monitoring

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

If we determine that a security incident has resulted in unauthorized access to or acquisition of your information, we will notify affected Customers without undue delay and within the timeframes required by applicable law.

7. Your Rights and Choices

7.1 Access and Update

You may access and update your account information at any time by logging into your account settings.

7.2 Data Portability

You may request a copy of your data in a structured, commonly used, and machine-readable format.

7.3 Deletion

You may request deletion of your data by contacting us. We will delete your information within 30 days, except where retention is required for legal or legitimate business purposes.

7.4 Marketing Communications

You may opt out of receiving promotional emails by following the unsubscribe instructions in those emails. You will continue to receive transactional emails related to your account.

8. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• The right to know what personal information we collect, use, and disclose
• The right to request deletion of your personal information
• The right to opt out of the sale of personal information (we do not sell personal information)
• The right to non-discrimination for exercising your privacy rights

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Effective Date" above. Your continued use of the Service after any changes indicates your acceptance of the updated Privacy Policy.

10. Contact Us

If you have questions about this Privacy Policy, please contact us at: