Privacy Policy
In short: we collect what we need to prepare your tax return and run your portal account, we encrypt your documents, we do not sell your personal information, and we never use the contents of your tax return for advertising.
1. Who we are
PapeTax is a trading name of St Fin Corp, a licensed CPA practice that prepares and electronically files individual federal income tax returns for clients across the United States. The practice operates entirely online.
Postal address for privacy and legal notices:
St Fin Corp, 23330 Mill Creek Dr Ste 250, Laguna Hills, CA 92653-7917
contact@papetax.com · 213-286-0355
2. Information we collect
- Account information — your name, email address, and a password. The password is stored only as a one-way hash and cannot be read or recovered by us.
- Tax documents you upload — W‑2s, 1099s, 1098s, brokerage statements, prior-year returns and similar records. These commonly contain Social Security numbers, taxpayer identification numbers, income figures and financial account information.
- Information you give us directly — by email, phone or during a consultation.
- Technical information — server logs recording the date, the page requested, the browser type, and a hashed form of your IP address. We do not retain raw IP addresses in application logs.
- Analytics and advertising data — if you arrived from an advertisement, or if analytics is enabled, our advertising and analytics providers may set cookies and receive standard web data such as the page viewed, referring URL, approximate region, device and browser. See section 5.
We do not ask for payment card details anywhere on this site, because preparing and e‑filing your return costs nothing.
3. How we use your information
- To prepare, review, sign and electronically file your tax returns.
- To communicate with you about your return and your account.
- To operate and secure the portal, detect abuse, and meet our professional record-keeping obligations.
- To measure how well our advertising works — in aggregate, and never using the contents of your tax return or your uploaded documents.
We do not sell your personal information. We do not use your tax return information or your uploaded documents for marketing, and we do not disclose them for any purpose not permitted by law.
4. Tax return information (IRC §7216)
Federal law restricts what a tax return preparer may do with your tax return information. We will not disclose or use your tax return information for any purpose other than preparing, or assisting in preparing, your return, except as permitted by Internal Revenue Code §7216 and its regulations, or with your prior written consent in the specific form those rules require.
Your tax return information is never shared with an advertising network, an analytics provider, or any other third party for their own purposes.
5. Cookies, analytics and advertising
This site uses a small number of cookies:
| Cookie | Purpose | Lifetime |
|---|---|---|
sid | Keeps you signed in to the client portal. Strictly necessary. | Session, up to 12 hours |
csrf | Protects forms against cross-site request forgery. Strictly necessary. | Up to 4 hours |
ads_optout | Records that you have opted out of advertising cookies. Set only if you use the control in section 6. | 1 year |
Google cookies (_ga, _gcl_au and similar) | Analytics and measurement of our advertising. Set only when analytics is enabled and you have not opted out. | Up to 2 years |
Where analytics or advertising measurement is enabled, we use Google services (Google Analytics and Google Ads conversion measurement). Google acts as our service provider for this purpose and processes the data in accordance with its own terms. We do not send Google, or any other advertising provider, your name, email address, Social Security number, financial information, or anything from your tax documents. Conversion measurement records only that an action happened — for example that an account was created — and never who created it.
We use Google Consent Mode. If you opt out under section 6, or if your browser sends a Global Privacy Control signal, advertising and analytics storage is set to denied before any Google tag loads, and ad personalisation is switched off.
You can also opt out of Google Analytics across all sites with Google’s browser add-on (opens in a new tab), and manage ad personalisation in Google My Ad Center (opens in a new tab).
6. Your privacy choices
Use the control below to opt out of advertising and analytics cookies on this site. This covers what California law calls the "sharing" of personal information for cross-context behavioural advertising. Your choice is stored in a cookie on this device, so you will need to set it again on another device or after clearing your cookies.
Strictly necessary cookies (sid and csrf) are not affected by this control;
the portal cannot function without them.
7. How your information is protected
- All traffic to this site is encrypted in transit with TLS (HTTPS), and HTTP requests are redirected to HTTPS.
- Every uploaded document is encrypted at rest with AES‑256‑GCM using a key unique to that file. Documents are never written to disk in unencrypted form, and they are stored outside the public web directory so they cannot be reached by guessing a URL.
- Access to a document is restricted to the client who uploaded it and to authorised firm personnel. Every request is checked against the account that owns the file.
- Passwords are stored using a one-way hashing algorithm (Argon2id) and cannot be read by us.
- Repeated failed sign-in attempts temporarily lock an account, and portal sessions expire automatically after a period of inactivity.
- Application logs are filtered so that Social Security numbers, taxpayer identification numbers, account numbers, passwords and document contents are not written to them.
- Access to client information within the firm is limited to personnel who need it for their work.
No method of transmission or storage is perfectly secure. If a breach affecting your personal information occurs, we will notify you and the relevant authorities as required by applicable state law, and follow the reporting steps the IRS sets out for tax professionals.
8. How long we keep your information
We retain client tax records, including uploaded documents and prepared returns, for seven years from the end of the tax year to which they relate, which reflects professional record-keeping practice and the IRS periods for assessment and amended returns. Portal account records are kept for as long as the account is open and for the same seven-year period afterwards. Server logs are retained for a shorter period for security monitoring.
You may ask us to close your account at any time. Records we are required to retain for professional or legal reasons are kept for the remainder of the retention period and then deleted.
9. Your rights
You may request a copy of the information we hold about you, ask us to correct it, ask us to delete information we are not required to retain, or ask us to stop using it for a particular purpose. Contact contact@papetax.com or call 213-286-0355. We will verify your identity before acting on a request, and we will not discriminate against you for exercising these rights.
Depending on where you live, additional rights may apply — for example under the California Consumer Privacy Act as amended by the CPRA, or comparable statutes in other states. Note that information collected to prepare a tax return is generally subject to the Gramm‑Leach‑Bliley Act rather than those statutes; the choices in section 6 apply to website and advertising data regardless.
10. GLBA privacy notice
As a tax preparation practice we are treated as a financial institution under the Gramm‑Leach‑Bliley Act. We collect non-public personal information about you from the information you give us and from the documents you upload. We do not disclose that information to anyone except as permitted by law — for example to service providers who help us prepare and transmit your return, each of whom is bound to keep it confidential. We restrict access to it to personnel who need it to serve you, and we maintain physical, electronic and procedural safeguards to protect it.
11. Children
This site is not directed to children and we do not knowingly collect information from anyone under 18. Portal accounts are for adults filing their own returns, which may include information about dependants.
12. Changes to this policy
We will post any changes on this page and update the effective date above. If a change materially affects how we handle your information, we will tell existing clients by email before it takes effect.
13. Contact us
St Fin Corp (PapeTax)
23330 Mill Creek Dr Ste 250, Laguna Hills, CA 92653-7917
contact@papetax.com · 213-286-0355