Privacy Policy

NoticeInbox ("we", "us", "our") is an IRS and state tax notice deadline tracker for CPA firms. Our contact email is support@noticeinbox.com.

This Privacy Policy explains what data we collect, how we use it, and the measures we take to protect it — including specific details about how we handle sensitive client information contained in forwarded tax notices.

Account data

• Name and email address of each team member.
• Firm name and billing information (handled by Paddle).
• Login sessions managed by Supabase Auth.

Notice and deadline data

• Notice type (e.g., CP2000), issue date, and computed response deadline.
• The email subject and sender of the forwarded notice, for audit purposes.
• Confirmation status and the CPA who confirmed each deadline.

Original notice content

• The forwarded notice email and, where present, the original source PDF are retained — restricted to your firm only — so your team can cross-reference the AI's extracted fields against the source document before confirming a deadline.
• This is separate from the redacted copy sent to Google's Gemini API for classification (see section 3) — the AI never sees taxpayer identifiers, but the original notice your firm retains naturally contains them, the same as it would in your own inbox.

When a notice is forwarded to your firm inbox, we extract the text and apply an automated redaction step before any further processing:

• Social Security Numbers (format 000-00-0000) are replaced with [SSN].
• Employer Identification Numbers (format 00-0000000) are replaced with [EIN].
• Dollar amounts, phone numbers, email addresses, street addresses, ZIP codes, and title-cased name patterns are similarly redacted.

Only after redaction is the text sent to Google's Gemini API for notice classification. The AI receives no taxpayer-identifying information. Redaction is applied even when classification can be done by our local rule-based catalog.

This redaction applies only to the copy sent to Gemini. The original notice — the one your firm retains for its own records — is not redacted, since a CPA reviewing it needs to see the real document to verify the AI got it right.

• To provide the Service: classify notices, compute deadlines, and display them in your dashboard.
• To send transactional emails: deadline reminders, trial expiration notices, account confirmations.
• To enforce billing via Paddle and manage your subscription.
• To improve the notice classification catalog based on aggregated, non-PII patterns (notice codes and response-day counts only).

We do not sell your data, share it with advertisers, or use it for purposes beyond operating and improving the Service.

All tables that hold firm-specific data enforce PostgreSQL Row-Level Security (RLS). Each query is automatically scoped to your organization ID — a user in one firm is physically unable to read another firm's notices, clients, or deadlines, even through an application bug.

• Active subscription: notice and deadline data — including the original notice email and source PDF — is retained for the life of the subscription.
• After account termination: data is retained for 30 days, then permanently deleted, unless a longer period is required by law.

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data. To make a request, email us at support@noticeinbox.com. We will respond within 30 days.

Note: the AI classification pipeline never receives client taxpayer data (SSNs, EINs, etc. — see section 3). The original notice document your firm retains is not redacted and may contain it; if you have a request relating to a specific taxpayer, that must be directed to your own firm as the data controller, not to us.

We use only functional cookies required for authentication (session tokens managed by Supabase). We do not use advertising cookies or cross-site tracking. We may use privacy-respecting analytics (e.g., aggregate page-view counts) with no personally identifiable information collected.

We use industry-standard measures including HTTPS in transit, encryption at rest via Supabase, row-level access controls, and automated PII redaction before any third-party AI call. No system is perfectly secure; if you discover a vulnerability please disclose it responsibly to support@noticeinbox.com.

The Service is intended for professional use by adults. We do not knowingly collect data from anyone under 18.

We may update this policy to reflect changes in our practices or the law. Material changes will be communicated by email at least 14 days before they take effect.

Questions or requests: support@noticeinbox.com