Data Processing Addendum

This Data Processing Addendum ("DPA") supplements the TaxSlate, Inc. Terms of Service and Privacy Policy and describes how TaxSlate, Inc. processes data that accounting firms and their clients provide through the Service. "TaxSlate, Inc.," "we," or "us" refers to the operator of the platform. "Firm" or "you" refers to the accounting firm that subscribes to the Service. "Client data" refers to taxpayer and client information the firm uploads or generates while using the tools.

This DPA is informational. It is not a substitute for legal advice, and firms should have qualified privacy and tax counsel review it before relying on it for compliance with IRS Section 7216, GLBA, state privacy law, or professional conduct rules.

The Firm is the controller of client data. The Firm determines the purposes and means of processing client data and is responsible for having the legal authority and any consents required to upload it. TaxSlate, Inc. acts as a processor on behalf of the Firm, processing client data only to provide, secure, maintain, and support the tools the Firm has subscribed to.

The Firm is responsible for the accuracy of the data it uploads, for obtaining any taxpayer consents required under IRS Section 7216 or other applicable law before sharing data with the Service or its service providers, and for configuring retention settings appropriate to the Firm's practice.

• Account information: Staff names, email addresses, firm name, role, and subscription status.
• Client records: Client names, entity types, preparer assignments, and notes the Firm chooses to save. Client records persist until the Firm manually deletes them.
• Tool inputs and outputs: Financial figures, entity details, generated analyses, and reports the Firm enters or produces using the tools.
• Uploaded files: Tax returns, workpapers, bank statements, pricing sheets, and other documents the Firm uploads for processing.
• Document-request submissions: Files and answers a client provides in response to a Firm-initiated document request.
• Usage data: Timestamps, tool interactions, and aggregate metrics used to operate and improve the Service.

TaxSlate, Inc. processes client data to:

• Provide the tax analysis, planning, and workpaper tools the Firm has subscribed to.
• Generate reports, analyses, summaries, and recommendations based on Firm inputs.
• Process uploaded files for extraction, classification, and sorting.
• Route document requests and reminders between the Firm and its clients.
• Secure, maintain, and support the platform.

TaxSlate, Inc. does not sell, rent, or trade client data, and does not use client data for advertising. We do not use client data to train AI models. Specific provider data-use terms should be verified by the Firm before relying on them for compliance.

• Firm isolation: Data is isolated per firm using row-level security. Users can only access data belonging to their own firm.
• Private file storage: Uploaded files are stored in private storage and accessed through time-limited signed URLs. Files are not publicly accessible.
• Encryption: Industry-standard encryption is used for data in transit (TLS) and at rest.
• Authentication: Access requires authentication. Two-factor authentication is available and enforced for sensitive operations.
• Audit logging: Sensitive actions are recorded in an audit log available to firm administrators.

No system is completely secure. These measures reflect reasonable safeguards but do not guarantee absolute security. Specific technical and contractual safeguards provided by infrastructure and service providers should be verified by the Firm where compliance depends on them.

TaxSlate, Inc. uses third-party service providers to operate the platform, including cloud infrastructure, payment processing, email delivery, and AI processing for specific features. These providers process only the data necessary to perform their functions.

AI processing is used only for specific features that send data for AI analysis, such as return summarization, workpaper classification, reasonable compensation research, and tax description parsing. Not every tool or action in the Service uses AI. The Firm should verify which features involve AI processing and whether any taxpayer consent is required before using those features with client data.

A current list of subprocessors, their locations, and their data-handling terms is available on request. The Firm is responsible for confirming that any provider locations or safeguards relevant to its compliance obligations are acceptable before uploading data subject to those obligations.

Retention varies by data category. The Firm controls when client records and saved outputs are deleted; TaxSlate, Inc. does not delete saved client data unless the Firm requests it or the account is terminated.

• Client records: Persist until the Firm manually deletes them. TaxSlate, Inc. does not automatically remove client records.
• Draft tool data: Unsaved draft reports, unsorted workpaper batches, incomplete primers, and draft analyses are automatically deleted approximately seven (7) days after creation.
• Document-request submissions: Files and answers a client uploads in response to a document request are purged approximately thirty (30) days after receipt. The request itself is retained; only the received content is cleared.
• Finalized records: Completed and finalized analyses are retained according to the Firm's configured retention period (default seven years) and then automatically deleted.
• Account termination: Upon termination, the Firm's data is deleted in accordance with these policies. Deletion of copies held by service providers or in backups may take additional time.

The Firm can delete saved records at any time through the tools. The Firm is responsible for maintaining its own permanent records in compliance with IRS recordkeeping requirements and applicable law. TaxSlate, Inc. is not a permanent archival system.

Because the Firm is the controller of client data, the Firm is responsible for responding to client or data subject requests regarding access, correction, deletion, or export of their data. TaxSlate, Inc. will assist the Firm with reasonable requests to access, export, or delete data stored in the Service where technically and contractually feasible.

If TaxSlate, Inc. becomes aware of a security incident affecting the Firm's client data, we will notify the Firm without undue delay and provide reasonable information about the incident and any remediation steps. The Firm is responsible for any notifications to its clients or to authorities that may be required under applicable law, including GLBA or state breach notification requirements.

TaxSlate, Inc. and its service providers may process data in locations outside the Firm's country. If any taxpayer data is subject to restrictions on cross-border transfer, the Firm is responsible for confirming that the processing locations are acceptable and for obtaining any consents required under IRS Section 7216 or other applicable law before uploading that data. Specific provider locations should be verified before relying on this DPA for compliance.

The Firm may request information about TaxSlate, Inc.'s security and data-handling practices to support its own compliance obligations. TaxSlate, Inc. will provide reasonable information and, where appropriate, assist the Firm with audits or assessments, subject to confidentiality and operational limitations.

This DPA remains in effect for the duration of the Firm's subscription. Upon termination, TaxSlate, Inc. will delete the Firm's data in accordance with the retention and deletion policies in Section 7, except where retention is required by law.

For questions about this DPA, data processing, or to request subprocessor information, contact your firm administrator or TaxSlate, Inc. support.