Last updated: June 30, 2026
RAG Tax AI ("RAG Tax AI", "we", "us", or "the App") provides AI-assisted tax return review, workpaper preparation, client request workflows, tax research support, document analysis, accounting software integrations, and related CPA firm productivity tools. This Privacy Policy explains what information we collect, how we use it, how we protect it, and what choices authorized users have.
This policy is written for firms and professionals using RAG Tax AI in connection with tax, accounting, and advisory work. The App is not intended for children, consumer social use, or unrelated personal data processing.
RAG Tax AI uses third-party AI model providers, including Anthropic Claude, to process prompts and user-provided materials for the requested workflows. Information submitted for AI-assisted review may be sent to those providers solely to generate the requested output. We do not sell client data, and we do not use client tax documents, Google Workspace data, accounting data, or uploaded files to train generalized AI or machine-learning models. Users should review all AI-generated outputs before relying on them. The App is a professional assistance tool and does not replace qualified tax judgment, CPA review, or firm quality-control procedures.
If you connect a Google account, RAG Tax AI uses Google data only to provide user-facing features requested inside the App, such as selecting Drive materials for review or creating Gmail drafts. The App does not sell Google user data, does not use Google user data for advertising, and does not transfer Google user data except as necessary to provide the requested feature, comply with law, or protect the App. OAuth tokens are stored server-side and are not exposed to the browser.
If you connect QuickBooks Online, Xero, or another accounting platform, RAG Tax AI uses the authorized connection to retrieve accounting reports and related business data needed for tax review, workpaper preparation, reconciliation, and analysis. OAuth tokens are stored server-side. Users can revoke access from within the relevant provider account or by contacting an administrator.
We do not sell personal information, client tax information, Google user data, or accounting data. We may share information only with:
Retention depends on the type of information and the purpose for which it is used. Account records, audit logs, cost logs, workflow records, access requests, and OAuth tokens may be retained while needed to operate the App, maintain security, support firm workflows, comply with legal obligations, or preserve business records. Uploaded files may be processed temporarily or retained when a workflow requires persistent storage. Stored document metadata includes retention information, and retained local documents may be removed when the configured retention period expires. Administrators may request deletion or revocation of user accounts, OAuth tokens, or stored records, subject to legal, tax, accounting, backup, and security requirements.
RAG Tax AI uses administrative, technical, and organizational safeguards designed to protect information, including authenticated access, role separation, tenant or firm identifiers, HTTPS transport, server-side token handling, password hashing, budget enforcement, rate limiting, audit logging, and restricted server-side storage. No system can guarantee absolute security, so users should avoid uploading unnecessary sensitive information and should promptly report suspected unauthorized access.
The App is designed so users, client records, budgets, and audit events can be associated with a firm or organization. Administrators should create accounts only for authorized personnel, assign appropriate roles, disable inactive users, and avoid sharing credentials. Access-control features are a safeguard, but each firm remains responsible for deciding who may access client materials.
If we become aware of unauthorized access, data loss, or another security incident affecting App data, we will take reasonable steps to investigate, mitigate, preserve relevant records, and notify affected administrators when legally or contractually required. Users should promptly report suspicious account activity, exposed credentials, or misdirected client data.
Users are responsible for ensuring they have authority to upload, connect, or process client materials in the App. Users should review generated outputs, preserve required source documents, follow firm policies, comply with applicable tax and privacy laws, and avoid sharing credentials or unauthorized access.
We may update this Privacy Policy as the App evolves, including when new integrations, workflows, vendors, or security features are added. The "Last updated" date reflects the latest version.
For questions about this Privacy Policy, access, data deletion, or connected accounts, contact us at ramiroflores@ragtax-ia.com.