Status note. This addendum covers the TracePrep product application, where firms build Studies. It takes effect for a Firm when that Firm first accepts the Product Application Terms at signup. The marketing site is covered separately by the Privacy Notice.
This addendum is part of the Product Application Terms between TracePrep Inc., a Texas corporation, and the subscribing Firm. Terms defined there have the same meaning here, including Subscription End Date and Retention Window.
Our liability under this addendum is capped by section 11 of the Product Application Terms, principally the Security Claims cap in section 11.4 and the Section 5 Claims cap in section 11.6. Read this addendum with those caps in view; the commitments here are real but they are not unlimited.
1. Who is responsible for what
The Firm decides what goes into the Application and why. TracePrep processes it on the Firm's instructions. The Firm's instructions are these Application Terms, this addendum, and the Firm's own configured use of the Application. We will tell the Firm if we believe an instruction requires us to break the law. In the language of privacy law, the Firm is the controller of Study Data and we are its processor. The Firm's engagement letter with its client, and the Firm's own confidentiality obligations, govern the client relationship. We are not a party to it.
We process Study Data only to provide, secure, and support the Application for the Firm, and to meet a legal obligation. We do not process it for our own purposes. We do not process it to improve or develop our products.
Statutory designation. Where the California Consumer Privacy Act as amended applies, TracePrep is a service provider to the Firm within the meaning of Cal. Civ. Code §1798.140(ag), and this addendum is the contract §1798.100(d) requires. Where an equivalent designation exists under another state privacy act, TracePrep takes it. Where the GDPR or UK GDPR applies, TracePrep is a processor and this addendum is the Article 28(3) contract.
California service-provider undertakings. Where the California Consumer Privacy Act applies, we process the personal information in Study Data only for the limited and specified business purposes in this section, we comply with the obligations that Act places on us as a service provider and provide the same level of privacy protection it requires of the Firm, the Firm may take reasonable and appropriate steps to ensure we use that information consistently with the Firm's obligations under that Act, we will notify the Firm if we determine we can no longer meet those obligations, and on notice the Firm may take reasonable and appropriate steps to stop and remediate any unauthorized use of that information by us. We will not sell or share that information, will not retain, use, or disclose it for any purpose other than those business purposes or outside our direct business relationship with the Firm, and will not combine it with personal information we receive from or on behalf of anyone else, or collect from our own interactions with a consumer, except as that Act permits a service provider to do.
Precedence. This addendum governs the processing of Study Data unless and until a data processing agreement signed by both parties supersedes it, in which case that agreement controls to the extent of any conflict. A signed DPA is a negotiated instrument, not a unilateral change, so it does not go through the section 12 publication-and-notice process; nothing else displaces this addendum without that process. No data processing agreement reduces the Firm's rights under section 5 of the Product Application Terms.
We hold ourselves to these commitments, and they do not depend on which privacy laws apply to a Firm:
- We do not use Study Data to train machine-learning models.
- We do not sell Study Data and we do not share it for cross-context behavioral advertising.
- We do not disclose Study Data to a third party except to the sub-processors listed in the section 5 sub-processor table, or where law compels it. One closed exception: Customer.io, which is in section 5a and not in that table, receives the notification email fields listed in section 5a. We send those fields to Customer.io only to deliver notification email, and section 5a says what we have and have not confirmed about its own use of them. Those fields carry none of a Study's content. Anthropic and OpenAI, the other vendors in section 5a, receive nothing.
- If law compels disclosure, we will tell the Firm before we produce anything unless we are legally barred from doing so, we will produce only what is compelled, we will seek to narrow or challenge a demand that reaches further than the law requires, and we will ask for confidential treatment.
For our own account holders, meaning the individual Authorized Users at a Firm, we act as controller for the limited account and login information described in section 3.
2. Categories of Study Data
| Category | Examples |
|---|---|
| Shareholder and engagement facts | Intake responses about duties, time, proficiency, and business economics for an S-corporation shareholder-employee |
| Business financial facts | Figures the Firm enters or imports to support the calculation |
| Wage evidence snapshots | Public wage source data captured with its version, occupation, geography, period, and transformation record |
| Calculation and adjustments | Inputs, results, Preparer adjustments, and the documented rationale for each |
| Deliverables | Rendered reports, structured exports, immutable evidence manifests |
| Audit-log entries | Who prepared, who changed what and when, who approved |
| Imported source bytes | Any file the Firm uploads, retained as part of the evidence record |
| Sensitive personal information | Where the Firm chooses to enter it, identifiers such as a Social Security number or an EIN, and wage documents such as a W-2 that carry them |
Study Data can contain personal information about the Firm's client and about a shareholder-employee. The Firm decides how much of that to enter.
Sensitive personal information. Reasonable-compensation workpapers routinely carry a Social Security number, an EIN, or a W-2. We treat that information as sensitive personal information within the meaning of Cal. Civ. Code §1798.140(ae) and its equivalents, and we do not use or disclose it for any purpose other than performing the Application for the Firm. We do not use it to infer characteristics about anyone. The Firm decides what to enter; that choice does not reduce our duty over what it enters.
3. Account and usage information
Separately from Study Data, we process:
- Account information for each Authorized User: name, work email, Firm, and role, held to authenticate the person and to scope access.
- Access and security logs: sign-in events, IP address, and user agent, held to detect and investigate misuse.
- Service-operations telemetry: counts of feature use, performance, and error rates. The aggregated counts we use for product decisions carry no Firm, client, or individual identity. That is a statement about the aggregates, not about the raw error reports that produce them: an individual error report can incidentally contain Study Data, is handled as Study Data, and is covered by the sub-processor entries for Sentry and PostHog in section 5. We do not build any wage, compensation, benchmark, or other Study-derived dataset out of Study Data, aggregated or otherwise. De-identification is not a permission slip under 26 U.S.C. §7216, and we do not treat it as one.
Our de-identification commitment. For any data we treat as de-identified, we take reasonable measures to prevent it being connected back to a person, we publicly commit here to keep it de-identified and to make no attempt to reidentify it, and we contractually bind any recipient to the same. This is the commitment Cal. Civ. Code §1798.140(m) requires, and it applies whether or not that statute reaches us.
4. Our own people, and your right to check
Personnel. Everyone at TracePrep with access to Study Data is bound by a written confidentiality obligation that survives their engagement with us, is granted access only where their work requires it, and loses it when it no longer does.
Audit. Once in any twelve-month period, and after a confirmed security incident affecting the Firm's Study Data, the Firm may ask us in writing for the information reasonably needed to verify that we are meeting this addendum. We will answer within 30 days with our then-current security documentation and written answers to the Firm's questions. If that is not enough for the Firm's own regulator or professional standard, the parties will agree in good faith on a proportionate alternative, at the Firm's cost, that does not put another Firm's data at risk. Where the GDPR or UK GDPR applies, we will also allow for and contribute to audits, including inspections, by the Firm or an auditor it mandates, on reasonable written notice, under a duty of confidentiality, at the Firm's cost, and in a way that does not put another Firm's data at risk. In that case we will also assist the Firm, taking into account the nature of the processing and the information available to us, with any data protection impact assessment and any prior consultation with a supervisory authority that concerns the Application, and we will not transfer that Firm's Study Data to a third country or international organization except on the Firm's documented instructions or where law requires it.
Return or delete on request. At any time, and on termination, the Firm may direct us in writing to return its Study Data, or to delete it. We return Study Data within 30 days of the direction. Deletion is carried out through the Firm-Admin-initiated deletion process in section 8, which we will help the Firm Admin complete within 30 days of the direction and will confirm in writing when it is done. Two things are carved out and we name them rather than hiding them behind "technical limitations": copies that cannot be selectively removed, which section 8 governs; and the metadata-only audit chain, chain head, and deletion tombstone described in section 8, which we deliberately keep so the log stays verifiable. Everything else goes. Before a Retention Window closes we delete nothing on our own initiative. After it closes we may, as section 6 describes; that is the only deletion we initiate, and it is preceded by the 60-day warning notice.
5. Sub-processors
We use a small set of vendors to run the Application, and we use each of them only for that purpose. Where the GDPR or UK GDPR applies to a Firm, before a vendor processes that Firm's Study Data we will impose on it by contract the same data protection obligations as this addendum sets for us, and we remain responsible to the Firm for that vendor's performance of them.
Section 7216 and these vendors. Where a Firm is a tax return preparer, we act as its auxiliary service provider under 26 U.S.C. §7216 and 26 CFR §301.7216-2(d), and we use each vendor below only to assist us in providing the Application to the Firm, and for no other purpose. We do not treat de-identification as a permission slip under §7216, and we do not disclose tax return information to any vendor not listed here. Obtaining any taxpayer consent §7216 requires remains the Firm's responsibility.
| Sub-processor | Role |
|---|---|
| Neon | Managed Postgres database holding Study Data |
Amazon Web Services (S3, us-east-1) |
Object storage for Study artifacts — evidence snapshots, rendered reports, structured exports, imported source bytes — in both the primary bucket and the backup bucket |
| Sentry | Application error and performance monitoring. An error report can incidentally contain Study Data present in the failing request, which is why Sentry is listed here as a sub-processor rather than treated as identity-free telemetry. We configure it to scrub request bodies and known identifier fields. |
| PostHog | Application error events only; every other analytics event is dropped before it is sent. An error event keeps the exception message, which can incidentally contain Study Data present in the failing request, which is why PostHog is listed here. We configure it to keep only an allowlisted set of fields. |
| Inngest | Durable execution of long-running Application work |
| Vercel | Application hosting and request handling |
| WorkOS | Identity, organization, and membership management for Authorized Users |
| Stripe | Subscription billing: the Firm's plan, prices, invoices, and subscription, and the payment details, billing email, and name a Firm Admin enters on Stripe's own checkout and billing pages. It receives no Study Data. |
| Cloudflare Turnstile | Bot check at sign-up, sign-in, and password reset: the challenge token from the person's browser and, where available, that person's IP address. It receives no Study Data. |
Both AWS S3 buckets are held in the us-east-1 region. For the other vendors in the table we do not pin a processing region in our configuration today, so we make no United States-only processing commitment for them. If we pin one, we will say so here as a change under section 12.
We will publish a change to this list at least 30 days before a new sub-processor begins processing Study Data, and notify Firm Admins by email. A Firm that objects on reasonable data-protection grounds may terminate before the change takes effect and receive a pro-rata refund of prepaid fees for the unused remainder of the term.
No Study Data flows to any practice-management system today. If that ever changes, the system becomes a sub-processor and is added to the table above under the notice rule in this section.
5a. Vendors not yet in the section 5 table
No vendor in this subsection processes the content of a Study today. A vendor named here does not yet meet every condition in the right-hand column of the table below. We list it anyway so that a Firm knows before it signs where we intend to take this, rather than meeting the name for the first time in a change notice.
On notification email specifically. The Application sends it through Customer.io, from info.traceprep.com. Those emails carry the sender and recipient addresses, a subject and heading built from the event name, the event name, whether the event concerns a Study or the Firm, an opaque identifier for that Study or Firm, a link into the Application (which repeats the identifier for a Study and carries none for the Firm), and a fixed footer line. They carry none of a Study's content: no intake response, figure, rationale, evidence, report, audit-log entry, or client name. Customer.io may record whether a notification email was opened and whether a link in it was clicked, using identifiers it attaches to each message. Customer.io's own terms, not this addendum, set what else it may do with that data, and we have not confirmed that they exclude using it to improve its own products and services. We do not yet hold a written commitment from Customer.io to the §7216 limit or to United States processing, so Customer.io stays outside the section 5 table. It moves into that table only once it is bound in writing to those representations.
| Vendor | What it does, or would do | What has to be true before it joins the section 5 table |
|---|---|---|
| Customer.io | Delivery of Application notification email (live since 2026-09-23; carries none of a Study's content) | It is bound in writing to confidentiality, to use Study Data only to assist us in providing the Application to the Firm (the §7216 limit), and to process it only in the United States |
| Anthropic, PBC | AI-assisted work on Study Data through the Claude API, in the agent and API integrations we intend to build | A TracePrep-controlled commercial account, a signed data processing agreement, a configuration confirmed in writing that keeps no copy of the request and uses no Study Data to train models, and a written commitment to use Study Data only to assist us in providing the Application to the Firm (the §7216 limit) and to process it only in the United States |
| OpenAI OpCo, LLC | AI-assisted work on Study Data through the OpenAI API, in the agent and API integrations we intend to build | A TracePrep-controlled commercial account, a signed data processing agreement, a configuration confirmed in writing that keeps no copy of the request and uses no Study Data to train models, and a written commitment to use Study Data only to assist us in providing the Application to the Firm (the §7216 limit) and to process it only in the United States |
Moving an entry out of this subsection and into the section 5 table is a change to the list under this section, so it carries the same 30 days' notice, the same email to Firm Admins, and the same right for a Firm to object on reasonable data-protection grounds, terminate before the change takes effect, and receive a pro-rata refund. Being named here early costs a Firm none of that.
Until every condition in the right-hand column is met, sending Study Data to a vendor in this subsection would breach section 1 of this addendum, which limits disclosure to the sub-processors listed in the section 5 table. The only exception is the one section 1 names: the notification email fields Customer.io receives to deliver notification email. We hold ourselves to that.
6. Retention
- While the subscription is active, Finalized Studies, their evidence manifests, reports, and structured exports are retained for as long as the Firm wants them.
- After the subscription ends for any reason, they stay downloadable for three years from the Subscription End Date (the Retention Window in section 5 of the Product Application Terms), after which we may delete them. We email the Firm Admin at least 60 days before that window closes.
- Three years is a storage commitment, not a workpaper-retention policy. Accounting workpaper retention periods commonly run longer, and the applicable period is the Firm's to determine. Export each Finalized Study into the Firm's own document system when it is finalized.
- In-progress Studies are retained while the Firm keeps them, and are deleted when the Firm deletes them.
- Account information is retained while the Authorized User has access, and for a limited period afterwards for security and audit purposes.
- Access and security logs are retained for 12 months, then deleted.
- Audit-log entries are append-only and are not deleted on a schedule. They record who prepared, who changed what and when, and who approved, so they contain Authorized User names and timestamps and we keep them indefinitely. That is an exception to the account-information rule above, and it exists because a log with holes in it cannot be verified. Section 8 explains what survives a Study deletion.
7. Export and access
A Firm Admin can export any or all of the Firm's Finalized, Delivered, and Superseded Studies at any time while the subscription is active and throughout the Retention Window that follows it, as report, structured export, and evidence manifest together. Each Study can be exported on its own. A bulk export takes up to 50 Studies per request, so a Firm with more than 50 Studies exports them in more than one request; there is no single export of every Study once a Firm holds more than 50. Export is never gated on account state, billing state, or payment status. If the Firm has no active Firm Admin, a person who establishes authority to act for the Firm may request the export directly from us, and we will honor it after verifying that authority.
If an individual asks a Firm to exercise a privacy right over information the Firm put into the Application, that request goes to the Firm, because the Firm is the controller. We will give the Firm what it needs to answer within 10 business days of the Firm's written request, at no charge, so the Firm can meet its own statutory deadline. If such a request reaches us directly, we will refer the individual to the Firm rather than acting on it ourselves, unless the Firm instructs otherwise.
8. Deletion, and how it propagates
Finalized artifacts cannot be edited. They can be destroyed only through an explicit Firm-Admin-initiated deletion process, which is logged and offers an export before proceeding.
Deletion covers every stored artifact belonging to the Study, including evidence snapshot bytes, rendered reports, structured export archives, and any retained import-source bytes. An object is removed once no surviving Study still references it.
Copies behave differently by storage type:
- Primary storage and deletable backup copies are deleted directly.
- An immutable copy, or a point-in-time-recovery source that cannot be selectively changed, keeps the deletion pending until that copy expires on its own schedule, or until verifiable cryptographic erasure makes it unreadable. We do not claim a deletion is complete while a recoverable copy still exists.
What survives a deletion: the metadata-only audit chain for the Study, its chain head, and a deletion tombstone. These stay so the log's integrity remains verifiable end to end. Study content values do not survive through those records: the chain retains the fact and actor of a change and a hash of it, not the changed value.
Timing. On a verified deletion request, and on the closing of a Retention Window, Study Data is removed from active systems within 30 days. Backup and point-in-time-recovery copies are removed as they expire on their own schedules, and we operate those schedules so that every such copy expires within 90 days. If a copy would survive past 90 days, we tell the Firm the actual date and why. We retain data past those windows only where law requires it, and we say so when it happens.
The 30-day and 90-day clocks run from a verified request and from the day a Retention Window closes. Expiry-driven deletion is on the same clock as a requested one.
9. International transfer
The Application is offered to US accounting firms for US engagements. Section 5 states which processing locations we have set and which we have not.
We do not publish a standard-contractual-clauses or UK Addendum package today. That is a gap, not a defense. Whether the GDPR or UK GDPR reaches a given engagement turns on establishment and on whether the Firm's own processing is in scope, not on whom we market to, and a Firm that is itself in scope brings us with it. A Firm with a shareholder-employee, a client, or an establishment outside the United States must raise that through Support before entering any Study Data, so we can put the right transfer mechanism in place or tell the Firm plainly that we cannot support that engagement yet.
10. Security
The controls behind the Application are described on the Security page, including the append-only tamper-evident audit log, the Preparer and Reviewer role separation, encryption in transit and at rest, and the list of what we do not yet have.
If we become aware of a security incident affecting a Firm's Study Data, we will investigate promptly and notify that Firm immediately after we discover it, as Tex. Bus. & Com. Code §521.053(c) requires of a party that holds data for its owner. This timing controls over any longer period stated on the Security page.
The notice will describe what happened as far as we know it, the categories and approximate volume of data involved, the likely consequences, what we are doing about it, and what the Firm should do. We will keep the Firm updated as we learn more. The Firm, as controller and owner, decides what to tell its own client, affected individuals, and any regulator, and we will give the Firm what it needs to make that decision. The Firm may have its own notice duties under the laws that apply to it; it should confirm them with its own counsel.
Where a law also requires notice to a regulator, such as a state attorney general, we will support the Firm in giving it, and we will give it directly where that law requires us to.
11. Data processing agreement
A Firm that needs a signed data processing agreement should ask through Support. We do not publish a DPA template today, and this addendum is not one. Until a signed one exists, this addendum is the contract, and section 1's precedence rule says a later executed DPA supersedes it.
11a. If we cease to operate
Section 13 of the Product Application Terms governs a wind-down and applies to this addendum too: at least 90 days' written notice before access ends, then either a self-contained archive delivered to each Firm or custody transferred to a successor that agrees in writing to honor section 5 for the remainder of each Firm's Retention Window. A successor takes the Study Data subject to this addendum, and we will not transfer custody to anyone who does not agree in writing to it. A Firm inside its Retention Window is in the notice population whether or not it still subscribes.
12. Changes
This addendum is versioned and append-only. Each version is published under /legal/versions/, indexed by its version date, and stays available there. A material change, including any change to sub-processors, retention, deletion behavior, processing location, or breach-notice timing, takes effect no sooner than 30 days after publication and notice to Firm Admins. The prior version controls until then. A Firm that objects on reasonable data-protection grounds may terminate before the change takes effect and receive a pro-rata refund of prepaid fees for the unused remainder of the term, the same right section 5 gives for a sub-processor change, now available for every material change to this addendum. Notice reaches a Firm inside its Retention Window as well.
13. Contact
Privacy questions about the Application go to [email protected] or through the Support page. Written notice may be sent to TracePrep Inc., 214 S Main St Ste 101-C, Duncanville, TX 75116.