Privacy Policy

1. The headline: your documents are not retained

When you paste or upload a tax notice, it is processed in memory to produce your analysis and discarded when processing completes. We do not store documents, do not log their contents, do not sell them, and do not use them to train any model. If processing uses a third-party AI provider (Anthropic), the document is transmitted to that provider solely to produce your analysis, under API terms that do not permit training on the data. [ATTORNEY: confirm current Anthropic API data-use terms at launch.]

2. The only data we keep

• Email address — only if you explicitly opt in to updates. Deleted on request.
• Payment records — processed and held by Stripe when you buy a Response Pack. We see what Stripe shows merchants (amount, date, receipt email); we never see card numbers.
• Anonymized outcome reports — only if you explicitly choose to share how your case went, with identifying details removed.

3. Operational data

Standard web server logs (IP address, timestamp, page requested) exist for security and abuse prevention and rotate on a short schedule. We use no advertising trackers and no third-party analytics that profile you. [ATTORNEY: enumerate hosting provider (Vercel) log practices at launch.]

4. Your rights

Email us to access or delete anything we hold about you (which, per section 2, is very little). California (CCPA), Oregon (OCPA), and Washington (My Health My Data, where applicable) residents have additional statutory rights. [ATTORNEY: finalize rights section per state privacy statutes; add contact email and postal address.]

5. Children

NoticeKey is not directed to children under 13 and we do not knowingly collect their information.

6. Changes

Material changes will be posted here with a new effective date. We will never weaken the document-retention promise in section 1 without conspicuous notice.