Privacy policy

This policy explains how Paperwork Labs LLC handles information in connection with Distill, available at distill.tax. Distill is still in development. We are publishing this policy now so our practices are documented and reviewable ahead of general availability, and we will update it as the product changes and before any service launches.

If you create an account, we collect your name, work email address, and your firm's organization name.

Distill is built to let your firm upload and store client tax documents inside an engagement workspace, so you can prepare returns without emailing files back and forth. That feature is not available yet. When it ships, we will collect and store whatever you or your firm submits there, which may include documents containing a client's tax identifiers, in order to provide that feature back to you.

We also automatically collect basic technical and analytics information when you visit Distill, described in "How we use information, and who we share it with" below.

We use the information we collect to operate Distill, provide the features you use, respond to support requests, maintain your account, and keep the service secure.

We do not sell or share the information you provide, and we do not use content you provide to serve advertising.

We work with a small number of service providers to run Distill: a hosting provider for the application itself, which also runs the site's analytics, and an error-monitoring tool that helps us catch and fix problems. These providers receive only the information needed to do their job for us, and they are not permitted to use it for their own purposes.

The hosting provider's analytics tool receives, on every page you load, the page's address and the time, the page that sent you there when your browser reports one, any tracking parameters already in the URL, your approximate location, and your browser, operating system, and device type. It does not use cookies or a persistent visitor ID, and it never receives your account details, documents, or anything else you type into the product.

The error-monitoring tool, on any page load where it's turned on, receives a description of the error along with the page address and the type of request that triggered it, so we can find and fix bugs. It is not configured to collect the content of your documents or account.

Signing in to Distill is handled by Paperwork ID, our own sign-in system at accounts.paperworklabs.com, not an outside identity vendor, so your sign-in details are not passed to a third party.

We do not use any advertising or ad-tech vendor, and we do not sell information to data brokers.

We may share your information if we're required to by a subpoena, court order, or other legal process, or if we believe in good faith that sharing is necessary to protect our rights or someone's safety, investigate fraud, or respond to a lawful government request.

If we're involved in a merger, acquisition, or sale of some or all of our assets, we'll notify you by email or a notice on this site before your information changes hands.

Distill is a document-processing tool for CPA and accounting firms. We keep the account information you give us, and any content you upload or store through Distill, for three years after the close of the return period in which the related return was presented to your client for signature. A return period runs from July 1 to the following June 30, so in practice that means three years past the first June 30 after the signature date.

That period is not a number we picked. It is the tax return preparer's own federal recordkeeping duty under 26 U.S.C. §6107(b) and Treas. Reg. §1.6107-1(b)(2), which requires a preparer to keep a copy of the return, or the client's name and taxpayer identification number, for three years after the return period closes. We hold your Distill data for that same period, so we are never keeping it longer than your own duty already requires. If your firm gives us a written instruction to keep something for a longer period, we follow that instead.

The security of your personal information is important to us. We follow generally accepted standards to protect the personal information submitted to us, both during transmission and once it is received. If you have any questions about the security of your personal information, you can contact us at privacy@distill.tax.

Every response from Distill includes an HSTS header telling your browser to only ever connect over HTTPS, so your connection to the site is never sent unencrypted.

The cookie that keeps you signed in is marked HttpOnly and Secure: a script running on the page can never read it, and your browser will never send it over an unencrypted connection. While Distill isn't open to the public yet, visiting it may also set a second cookie that only remembers you entered the shared pre-launch password; every visitor who has that password gets the exact same cookie value, so it can't identify you individually.

Your account record is stored in a managed database that encrypts data at rest.

Distill's document-upload feature is not available yet, so no client document is stored anywhere today. When it ships, we will describe how that content is protected here.

You can contact us to ask what information we hold about you, to correct it, or to request that we delete it. If you access Distill through an organization's account, your request may need to go through that organization first. We will take reasonable steps to confirm your identity before completing a request involving personal information.

We confirm we received your request within 2 business days and complete it within 30 days. If the law that applies to you allows more time and we need it, we will tell you before the 30 days are up.

Denials and appeals. We may deny a request only if we can't verify your identity, the specific data is under a retention duty or an active legal hold, or the request is manifestly unfounded or excessive. If we deny a request, we'll tell you why in writing, and you can appeal by replying to the same email within 60 days. You can also complain to the California Privacy Protection Agency, your state attorney general, or the Federal Trade Commission.

Because Distill is still in development, we expect this policy to change. If we make a material change to how we collect or use information, we will update this policy and change the effective date above before the change takes effect. We will publish a revised version here before Distill becomes generally available to new users.

Questions about this policy, complaints, or requests about your information, can be sent to privacy@distill.tax.

If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.