Taxpayer Privacy Policy & Data Safeguards

1. Statutory Governance & IRS Publication 4557 Compliance

UniFinTax Inc. ("UniFinTax," "we," "our," or "us") operates as a licensed Certified Public Accounting and tax preparation firm headquartered in Charlotte, North Carolina. We recognize that tax filings involve the most sensitive personal and financial information an individual or corporation can possess.

Our information security framework complies fully with IRS Publication 4557 (Safeguarding Taxpayer Data: A Guide for Your Business) and the Federal Trade Commission (FTC) Standards for Safeguarding Customer Information (16 C.F.R. Part 314). We implement rigorous administrative, technical, and physical safeguards designed to guarantee the security, confidentiality, and integrity of all taxpayer records.

2. Internal Revenue Code § 7216 Strict Disclosure Rules

UniFinTax strictly adheres to IRC § 7216 and Treasury Regulation § 301.7216. We will never use, share, or disclose your tax return information for marketing third-party financial products, life insurance, credit cards, or loans without your explicit, voluntary, and separate written consent executed on a formal IRC § 7216 consent document.

3. Gramm-Leach-Bliley Act (GLBA) Financial Privacy Rule

Under the Financial Services Modernization Act of 1999 (GLBA, 15 U.S.C. § 6801 et seq.), tax preparation firms are classified as non-bank financial institutions. As such, UniFinTax provides this annual notice informing you that we collect Non-Public Personal Information (NPI) strictly to deliver tax preparation, accounting, and advisory services. We maintain physical access controls, multi-factor electronic barriers, and strict employee non-disclosure covenants to guard your NPI.

4. Categories of Taxpayer Information Collected

To accurately prepare your federal Form 1040/1040-NR, state tax returns, and FinCEN Form 114 filings, we collect the following categories of information:

• Personal Identification Data: Full legal names, dates of birth, Social Security Numbers (SSN), Individual Taxpayer Identification Numbers (ITIN), physical residential addresses, telephone numbers, and email addresses.
• Immigration & Physical Presence Records: Visa classifications (F-1, J-1, H-1B, L-1, O-1), passport copies, visa foil stamps, Form I-94 arrival/departure transcripts, and physical presence day counts required for Substantial Presence Test audits.
• Income & Compensation Records: Forms W-2, 1099-NEC, 1099-MISC, 1099-INT, 1099-DIV, 1099-B (stock transactions), Schedule K-1 (pass-through business income), and 1042-S slips.
• Foreign Financial Assets (FBAR/FATCA): Overseas bank account numbers, maximum calendar year balances, Indian NRE/NRO/FCNR accounts, Demat statements, EPF/PPF balances, and foreign mutual fund holdings (PFIC).
• Business Financials: Profit and loss statements, balance sheets, corporate EINs, articles of incorporation, and cross-border reportable transactions for Form 5472 filings.

5. Permissible Uses of Your Information

We use the information collected exclusively for legitimate professional accounting purposes:

1. Evaluating statutory tax residency under IRC § 7701(b) and applicable bilateral tax treaties;
2. Computing your optimal tax liability, standard vs itemized deductions, and eligible tax credits;
3. Assembling complete, accurate federal and state returns and generating IRS Form 8879 e-file signature authorizations;
4. Transmitting encrypted returns to the IRS Modernized e-File (MeF) gateway and state Departments of Revenue;
5. Representing you in audit examinations, discrepancy reconciliations (CP2000), or penalty abatement petitions.

6. Cryptographic Vault Storage & Physical Isolation

Unlike consumer platforms that store sensitive documents in public cloud storage with shared links, UniFinTax implements enterprise-grade cryptographic isolation:

• Encryption at Rest: All files uploaded to our Document Vault are encrypted using AES-256-GCM (Galois/Counter Mode) with 128-bit authentication tags before touching disk storage.
• Isolated Root Storage: Client tax files are saved entirely outside the public web root (`unifintax_core/storage/app/vault/`), making direct HTTP URL file access technically impossible.
• Tamper-Evident Ledger: Every file upload, decryption, viewing session, and CPA audit action is cryptographically signed and logged in an HMAC-SHA256 audit ledger.

7. Third-Party Disclosures & Statutory Exceptions

We do not sell, rent, or lease taxpayer data to anyone. Period. We share your information strictly with:

• The Internal Revenue Service (IRS) via authorized Modernized e-File (MeF) transmission channels;
• State Departments of Revenue (e.g. NC Department of Revenue, CA FTB, NYS Taxation) for state return processing;
• The US Department of the Treasury (FinCEN) for mandatory BSA E-Filing of Form 114 (FBAR);
• Subpoenas or court orders issued by a federal court of competent jurisdiction under IRC § 7216(b).

8. California Consumer Privacy Act (CCPA / CPRA) Client Rights

For California residents, the California Consumer Privacy Act and CPRA grant specific consumer privacy rights. Although tax return information is primarily exempt from CCPA under the GLBA exemption (Cal. Civ. Code § 1798.145(e)), UniFinTax voluntarily extends the following rights to all clients:

• Right to Know: You may request an itemized export of all personal information maintained in your client profile.
• Right to Rectification: You may correct inaccurate biographical, wage, or tax data at any time via your client portal.
• Right to Non-Discrimination: We provide identical professional service and pricing regardless of whether you exercise statutory privacy rights.

9. Statutory Retention Schedules & Deletion Protocols

Under IRC § 6501, the general statute of limitations for the IRS to assess additional taxes is 3 years from the date of filing. In cases of substantial omission of gross income (>25%) or foreign asset omissions (IRC § 6501(e)), the statute extends to 6 years.

Accordingly, UniFinTax retains completed tax returns, workpapers, and source documents for a minimum statutory period of 7 years following transmission, after which records are scheduled for cryptographic data purging in accordance with DoD 5220.22-M wiping standards.

10. Contacting Our Data Protection Officer

For privacy inquiries, record inspection requests, or questions regarding our information safeguards, contact our Charlotte compliance office: