ClearNotice privacy policy
The short version
- We collect the minimum: your uploaded notice, the data extracted from it, your email if you buy, and standard technical logs.
- We never sell your data. Not to advertisers, not to "partners", not to anyone, not ever.
- Your documents are encrypted in transit and at rest, and automatically deleted on a fixed schedule.
- AI processes your documents to generate your explanation, under contracts that prohibit using your data to train models.
- You can delete everything with one email or one click, anytime.
- We're a French company, your data is protected under the GDPR, one of the world's strictest privacy laws, on top of your U.S. state rights.
- Tip: you may redact (black out) your SSN on your notice before uploading, the analysis works without it.
1. What we collect
Information you provide
- Your uploaded documents, photos, scans or PDFs of IRS notices. These may contain sensitive information: your name, address, Social Security number (often partially masked by the IRS), tax amounts and tax years. You may redact your SSN before uploading; the service works without it.
- Extracted notice data, the structured information our software reads from your document (notice type, amounts, dates, tax year).
- Questionnaire answers, if you purchase a response package, the answers you give to prepare your documents.
- Contact information, your email address, if you purchase or contact support.
- Payment information, processed entirely by Stripe; we never see or store your card number. We receive only confirmation of payment and the last four digits.
Information collected automatically
- Standard technical logs: IP address, browser type, pages visited, timestamps, for security, debugging and aggregate analytics.
2. How we use your information, and our legal bases
We use your information only to:
- Provide the service: analyze your notice, generate your explanation, prepare your response documents (legal basis: performance of our contract with you);
- Send you your purchased documents and the deadline reminders you requested (contract);
- Process payments and refunds, and respond to support requests (contract; legal obligation for accounting records);
- Secure, debug and improve the service, using aggregate or de-identified data wherever possible (legitimate interests, balanced against your rights);
- Comply with legal obligations (legal obligation).
That list is exhaustive. We do not use your documents or extracted data for advertising, profiling, or any purpose unrelated to serving you, and as a company subject to the GDPR, we identify a legal basis before any processing, as shown above.
3. What we never do with your data
- We never sell your personal information, and we have never sold it. We do not "share" it for cross-context behavioral advertising as defined by the CPRA.
- We never run advertising on the service and never give advertisers access to any of your data.
- We never use your documents to train AI models, and we contractually require the same of our AI providers (see §4).
- We never disclose your information to the IRS or any government agency, except if legally compelled by valid legal process, in which case we will notify you unless legally prohibited.
4. AI processing disclosure
Our service uses artificial intelligence to read your uploaded notice and generate your plain-English explanation and draft documents. This means your uploaded document and extracted data are transmitted, encrypted, to enterprise AI infrastructure providers acting as our data processors. Our agreements with these providers prohibit the use of your data to train their models and require deletion in line with our retention commitments.
AI-generated output can contain errors. Every explanation and document is provided for your review, see our Disclaimer, and nothing is sent anywhere without your action.
5. Retention & deletion
| Data | Retention |
|---|---|
| Uploaded documents (free analysis, no purchase) | Deleted automatically within [24 hours / 7 days, À DÉFINIR] |
| Uploaded documents & prepared packages (purchase) | Retained [90 days, À DÉFINIR] so you can re-download, then deleted |
| Email + purchase records | Retained as required for tax, accounting and legal compliance |
| Technical logs | Deleted or de-identified within [30-90 days, À DÉFINIR] |
You can request immediate deletion of your documents and personal information at any time,one email suffices. We honor deletion requests within[30 days], except for minimal records we must keep by law (e.g. proof of purchase).
6. Service providers & international transfers
We share data only with the service providers strictly necessary to operate, each bound by a data processing agreement (GDPR Art. 28) limiting use to our instructions:
- [Hébergeur cloud, ex. AWS/Vercel, préciser la région : UE si possible], hosting and storage (encrypted);
- [Fournisseur IA], document analysis and text generation (no-training terms);
- Stripe, payment processing (their policy);
- Resend, transactional email delivery;
- Google Analytics / Google tags (only if you allow analytics or advertising cookies), measurement and optional ads under Google Consent Mode.
International transfers.We are established in France; some of our providers process data in the United States. Where personal data leaves the European Economic Area, we rely on safeguards recognized by the GDPR: the provider's certification under theEU-U.S. Data Privacy Framework, or the European Commission'sStandard Contractual Clauses, together with encryption in transit and at rest.
We may also disclose information if required by valid legal process, or in connection with a merger or acquisition, in which case this policy's protections follow the data.
7. Security
Your documents are encrypted in transit (TLS) and at rest. Access to production data is restricted, logged, and limited to what operating the service requires. No system is perfectly secure, and we cannot guarantee absolute security, but we treat your tax documents with the sensitivity they deserve, and in the event of a breach affecting your personal information, we will notify you without undue delay as required by applicable law.
8. Your privacy rights, GDPR & U.S. state laws
Because we are a French company, everyone who uses ClearNotice, including U.S. customers, benefits from the rights guaranteed by the EU General Data Protection Regulation (GDPR):
- Access, obtain a copy of the personal data we hold about you;
- Rectification, correct inaccurate data;
- Erasure ("right to be forgotten"), have your data deleted;
- Portability, receive your data in a structured, machine-readable format;
- Restriction and objection, limit or object to certain processing, including any processing based on legitimate interests;
- Withdraw consent at any time, where processing relies on consent.
If you are a resident of California or another U.S. state with a privacy law (CCPA/CPRA and similar), you additionally hold your state-law rights, to know, delete, correct, port, and to non-discrimination for exercising them. Since we do not sell or share personal information, there is nothing to opt out of on that front, but the right exists and we honor it structurally.
To exercise any right, contact us; we verify requests using your checkout email and respond within the legally required timeframe (one month under the GDPR, extendable once if complex). We will never require you to create an account to exercise a right. You also have the right to lodge a complaint with a supervisory authority, in our case the French CNIL (cnil.fr), or with your local authority.
9. Cookies & analytics
We use strictly necessary cookies so the service works (for example, keeping your session during checkout and account access). These do not require consent.
Optional analytics and advertising cookies (for example Google Analytics or ads tags, if enabled) are used only after you accept them in our cookie bar. Until then, Google Consent Mode keeps those storage signals denied. You can change your mind anytime via Cookie settings in the footer.
We store a record of your choice (consent ID, categories, timestamp, policy version, hashed IP, and browser type) so we can demonstrate consent if required. We do not use social media pixels by default.
Details and your rights: this page and our contact form. Supervisory authority for ClearNotice: the French CNIL (cnil.fr).
10. Children
The service is intended for adults and is not directed at anyone under 18. We do not knowingly collect information from children under 13. If you believe a child has provided us information,contact us and we will delete it.
11. Changes to this policy
If we change this policy, we will update the date above and, for material changes affecting how we handle your documents or personal information, we will notify you by email (if we have it) or by a prominent notice on the site before the change takes effect. We will never retroactively weaken the protections applying to data you already gave us.
12. Contact us
The data controller is [RAISON SOCIALE], a company organized under the laws of France, registered office: [ADRESSE DU SIÈGE SOCIAL], RCS[VILLE + NUMÉRO].
Privacy questions and requests: clearnotice.com/contact orprivacy@clearnotice.com.
Supervisory authority: CNIL, 3 Place de Fontenoy, 75007 Paris, France,cnil.fr.