Privacy Policy

Effective August 20, 2026 · Taxana (taxana.ai)

Taxana shows solo business owners where their business stands, using transactions from bank accounts they choose to connect. This page says what we collect, why, who touches it, and how you delete it — in plain language, because that is how the product speaks.

What we collect

• Account information. Your email address and, if you use Google sign-in, your name from that profile. Passwords are handled by our sign-in provider (Clerk) and never reach our systems.
• Financial data you connect. When you link a bank account through Plaid: transactions, balances, and account names for the accounts you select. Your bank username and password are entered inside Plaid, never on Taxana — we never see or store them. Our access is read-only: Taxana cannot move money under any circumstances.
• Business profile. The business name and timezone you enter.
• Product usage. Key events (signing up, connecting a bank, categorizing transactions) recorded server-side for product analytics. We do not run advertising trackers.

We do not collect card numbers, Social Security numbers, or government identifiers.

What we use it for

One thing: showing you your own books — your dashboard, profit & loss, and transaction list. Transaction descriptions are sent to an AI service (Anthropic) to be sorted into bookkeeping categories; that data is not used to train their models. We do not sell your data, rent it, or share it with advertisers. Ever.

Who processes it

Taxana runs on a small set of infrastructure providers, each receiving only what their role requires:

• Plaid — connects your bank and retrieves transactions (read-only)
• Clerk — sign-in and account security
• Vercel — application hosting
• Neon — database (encrypted at rest, US region)
• Anthropic — AI categorization of transaction descriptions
• Sentry — error monitoring (configured to exclude request contents)
• PostHog — product analytics (server-side events only)
• Resend — service email, such as bank-reconnection alerts

Data is stored and processed in the United States.

How it’s protected

All traffic is encrypted in transit (TLS), all stored data is encrypted at rest, and the credentials that grant bank access are additionally encrypted at the application layer. Every database query is scoped to your account, and that isolation is enforced by automated tests before each release. The full technical detail lives in our security policy, available on request.

Retention and deletion

• We keep your data while your account is active, so your books stay continuous.
• Disconnecting a bank (Settings) revokes our access at Plaid immediately, and you choose whether the already-imported history is kept or deleted.
• Deleting your account (Settings → Delete account) permanently removes your account, bank connections, and every stored transaction. This is immediate, enforced by the database itself, and cannot be undone. Your sign-in identity at Clerk is deleted with it.
• You can export everything we hold about you first — Settings → “Export all data as CSV.”

Your choices and rights

You can access, export, correct, or delete your data yourself from Settings at any time — no request process needed. Depending on where you live (for example, California’s CCPA), you may have additional rights to request access or deletion; write to us and we will honor them. We do not sell personal information, so there is nothing to opt out of selling.

Cookies

We use only the cookies required to keep you signed in. No advertising cookies, no cross-site tracking.

Changes and contact

If this policy changes in a way that matters, we will say so in the product before the change takes effect. Questions, requests, or concerns: support@taxana.ai — a person reads that inbox.

Taxana reads transactions only. It can never move money.