privacy policy
This is a working draft. Our attorney has not finished reviewing it, and it is not in effect. We are publishing it early so you can see where we are headed. The final version will be posted here with an effective date before our filing service launches.
The short version.
- We collect what you give us on the waitlist — email, phone, state — and, as we add intake questions, your answers about how you filed in prior years.
- We use it to hold your spot, contact you, and get ready to help you review and file when we launch.
- We do not sell your information. The Meta pixel on this site may count as "sharing" under California law; you can opt out.
- No tax documents, SSNs, or bank connections yet. When that starts, stricter federal rules (IRC §7216) apply and we will ask for separate written consent first.
who we are
Sourdough Tax, Inc. is a company based in Los Angeles, California, building self-file tax software for gig workers. The service has not launched. Today, sourdough.tax is a waitlist and a set of informational pages. This policy covers what we collect through the site now and what we do with it.
what we collect today
- Waitlist details. Your email address, your phone number if you give one, and your state.
- Intake answers. As we start asking waitlist members short questions — for example, how you filed last year — we store your answers with your waitlist record.
- A Stripe customer record. When you join the waitlist, we create a customer record with Stripe, our payment processor, using your contact details. No payment is taken at signup, and we never see or store your card number.
- Usage data. Cloudflare Web Analytics measures page views, performance, browser and device type, and coarse location, without cookies. The Meta pixel records that your browser visited this site and sets a cookie to recognize it; Meta can connect that visit to your Meta account if you have one.
- Messages and calls. If you email us, we keep the email. If you call our support number, the call runs through AgentPhone, our voice platform, and may be recorded and transcribed.
what we don't collect yet
No Social Security numbers, no tax documents, no bank connections. When Sourdough Self-File launches, we will collect tax return information, and federal law - Internal Revenue Code §7216 - will restrict how we may use it: only to provide tax software, calculations, data organization, educational information, e-file transmission, or an Assisted service you separately authorize, unless you give separate written consent in the format the IRS requires. We will update this policy and collect those consents before any of that begins.
how we use information
- Hold your place on the waitlist and tell you when you can file.
- Contact you about your signup — by email, or by phone if you gave a number. Tell us to stop and we will.
- Answer questions you send us.
- Measure whether the site and our ads work (Cloudflare analytics, Meta pixel).
- Prevent fraud and abuse, debug problems, and keep records we are required to keep.
- Prepare to serve you at launch - for example, your state tells us when Self-File can open for you.
service providers
We use a small set of providers. Each receives only what it needs to do its job:
- Cloudflare — hosts the site, stores waitlist data (D1 and KV databases), routes our email, and provides analytics.
- Stripe — payment processing; holds your customer record.
- Resend — sends our email.
- AgentPhone — runs our support phone line.
- Meta — ad measurement, via the Meta pixel.
- Plaid — not yet live. When the filing product launches, Plaid will provide bank-account linking. Nothing is shared with Plaid today.
Our support tooling may also include AgentMail (support email). We will keep this list current: any processor that touches your personal information will be listed here before this policy takes effect.
how long we keep information
- Waitlist record. Kept while you are on the waitlist or have an account with us. Deleted when you ask.
- Audit trail. We keep an encrypted, append-only audit trail of significant events on your record — signup, changes, consents, deletion. If you ask us to delete your data, we delete the live record and keep only the minimal audit entries needed to show what happened and when, including that we honored your request.
- Usage data. Held by our analytics providers under their standard retention.
- Legal requirements. Some records must be kept longer by law - for example, filing approval records or tax-preparer records for any separate Assisted service.
your california privacy rights
The California Consumer Privacy Act (CCPA) gives California residents the following rights. We extend them to everyone on the waitlist, regardless of state:
- Know. Ask what personal information we have collected about you, where it came from, and why.
- Access and portability. Get a copy of it in a usable format.
- Delete. Ask us to delete it (subject to the audit-trail and legal-requirement notes above).
- Correct. Ask us to fix something that is wrong.
- Opt out of sale or sharing. We do not sell. The Meta pixel may count as sharing; your opt-out covers it.
- Non-discrimination. Exercising these rights never changes the service you get.
To exercise any of these, email shantanu@sourdough.tax. We verify the request before acting. Internally, support can generate a local data export or run a deletion workflow that removes waitlist, interest, provider-linking, and call records where safe, while retaining audit, tax, payment, filing-review, and privacy-request records when operationally required. Vendor-side records with processors such as Stripe, Plaid, or Argyle are reviewed separately. We will respond within 45 days; the law allows one 45-day extension, and we will tell you if we need it. You may use an authorized agent, in which case we will still confirm with you directly before acting.
In CCPA categories, today we collect: identifiers (email, phone number), commercial information (your customer record), internet activity (usage data), and coarse location (your state; approximate location derived from your IP address). We do not collect "sensitive personal information" as the CCPA defines it today. When the filing service launches and we do, this policy will be updated first.
children
Sourdough is a tax product for working adults. The site is not directed to children, and we do not knowingly collect personal information from anyone under 13 or sell or share the personal information of anyone under 16. If you believe a child has given us information, email shantanu@sourdough.tax and we will delete it.
security
Traffic to the site is encrypted in transit. Waitlist data lives in Cloudflare's databases, with access limited to the people who need it. The audit trail is encrypted. No system is perfectly secure; if a breach affects you, we will notify you as California law requires.
changes to this policy
This draft will change during attorney review. When the final version takes effect, the effective date will be posted here. After that, if we make a material change — collecting something new, or using existing data for a new purpose — we will email the waitlist before the change applies.
Our draft terms of service are published separately.
contact
Sourdough Tax, Inc. · Los Angeles, California
Privacy requests: shantanu@sourdough.tax
General support: support@sourdough.tax · (213) 699-5673