Privacy Policy

Effective: [EFFECTIVE DATE] · Last updated: August 3, 2026

This Privacy Policy explains what information ScorpEase LLC (“Keystead,” “we,” “us”) collects through Keystead Vault (the “Service”), how we use and protect it, and the choices you have. By using the Service you agree to this Policy.

1. What we collect 2. How we use it 3. AI & tax documents 4. Sharing 5. Subprocessors 6. Retention & deletion 7. Your rights 8. Security 9. Other 10. Contact

1. Information we collect

Information you give us

Account information — your name and email address when you create an account.
Vault content — everything you choose to enter or upload: business details (e.g., EIN, entity type, formation info), tax profile and estimated-payment records, key contacts, service providers, insurance, recurring tasks, notes, successor instructions, and pointers to where your logins are kept (not the passwords themselves). Documents you upload — such as tax returns — may contain sensitive personal information, including Social Security numbers.
Sharing information — the email addresses (and optional names) of people you invite to a vault.
Payment information — processed by Stripe. We receive limited billing details (such as your billing country and card brand/last four) but we do not receive or store your full card number.
Support communications — messages you send us.

Information collected automatically

Technical and usage data — IP address, browser/device type, pages and actions, and timestamps, used to operate and secure the Service.
Error and diagnostic data — captured via our monitoring provider (Sentry) to detect and fix problems.
Local storage & essential cookies — we use browser storage to keep you signed in and remember display preferences. We do [not use advertising or cross-site tracking cookies — confirm].

2. How we use information

To provide, maintain, and secure the Service and your vault;
To read fields from a tax return you upload, so we can pre-fill your vault (see §3);
To process your subscription and payments (via Stripe);
To send transactional messages — reminders about upcoming deadlines, confirmations, and important notices;
To provide support and respond to your requests;
To detect, prevent, and investigate fraud, abuse, and security incidents;
To comply with legal obligations.

We do not sell your personal information, and we do not use your data to train AI models. We do not use your vault content for advertising.

3. AI processing and tax documents

If you upload a tax return so Keystead can fill in details for you, our server removes Social Security numbers and account numbers from the extracted text before it is sent to our AI provider (Anthropic). Only the redacted text is processed, solely to identify fields for that upload, and you review the results before anything is saved. The original file you upload is stored in your encrypted vault storage and is not sent to the AI provider.

We share information only as follows:

With people you choose. When you share a vault, the people you invite can see the content you’ve shared, at the access level you set. You control and can revoke this at any time.
With subprocessors that operate the Service on our behalf, under contract and only as needed (see §5).
For legal reasons — to comply with law, valid legal process, or to protect the rights, safety, and security of our users, the public, or Keystead.
In a business transfer — if Keystead is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction; we’ll notify you of any change in control of your data.

5. Subprocessors

We rely on a small set of vetted providers. We aim to keep this list current; material changes will be reflected here.

Provider	Purpose	Data involved
Supabase	Database, authentication, file storage	Account & vault data, uploaded files
Render	Application hosting	Data in transit through the app server
Stripe	Payment processing	Billing details (no full card number to us)
Anthropic	AI reading of tax-return text	Redacted text only (SSNs/account numbers removed)
Resend	Transactional email	Email address, message content
Sentry	Error monitoring	Diagnostic/technical data

Data is processed and stored in the [United States — confirm hosting region with Supabase/Render].

6. Data retention and deletion

We keep your information for as long as your account is active or as needed to provide the Service. You can delete an individual vault or your entire account; deleting a vault removes its contents and uploaded files from storage. [Describe account-deletion request path/SLA once built.]

For integrity, the per-vault change log is append-only and retained as a security and continuity record; it stores which fields changed, who changed them, and when (including changes to who has access), not copies of your documents. [Confirm with counsel how the append-only audit log interacts with deletion/erasure requests.]

7. Your rights and choices

You can access and update most information directly in the app, and while your subscription is active you can export your vault as a PDF or full backup. Regardless of subscription status, you can request a copy of your personal information at any time using the address below. Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to appeal a decision about a request. To exercise these rights, contact us at privacy@keysteadvault.com; we will verify your request and respond as required by law. We will not discriminate against you for exercising these rights.

[If you have California users: add the CCPA/CPRA categories-collected disclosure, “Do Not Sell/Share” (we don’t sell), and the sensitive-personal-information handling notice. Add other state disclosures as counsel advises.]

8. Security

We protect your information with row-level data isolation, encryption in transit and at rest, redaction of sensitive identifiers before AI processing, and an append-only audit trail, among other measures. A plain-language overview is on our Security & Trust page. No method of storage or transmission is 100% secure, but we work hard to protect your data and to notify you promptly if a breach affecting it occurs.

9. Other

Children

The Service is for business use and is not directed to anyone under 18. We do not knowingly collect information from children.

Changes to this Policy

We may update this Policy as the Service evolves. We’ll change the “Last updated” date and, for material changes, provide additional notice.

10. Contact us

ScorpEase LLC — Keystead Vault
[Legal mailing address]
Privacy: privacy@keysteadvault.com · Support: support@keysteadvault.com