Privacy Policy

We collect information in three ways: information you provide directly, information generated as you use the platform, and operational signals from the systems you choose to connect.

• Account information — your name, work email, company name, role, and password credentials when you create an account.
• Billing information — subscription plan and billing details. Payments are processed by Stripe; we do not store full card numbers on our servers.
• Usage data — pages viewed, features used, actions taken, device and browser type, and approximate location derived from your IP address.
• Connected systems data — operational signals (such as issues, metrics, and workflow status) that you authorize Overstax to read from your connected applications.
• Communications — messages you send us, including demo requests, support tickets, and email correspondence.

• To provide, operate, and maintain the Overstax platform and its features.
• To process subscriptions, billing, and renewals through our payment processor.
• To surface operational insights, generate reports, and power the analytics you rely on.
• To communicate with you about your account, security, product updates, and support.
• To monitor performance, diagnose errors, prevent abuse, and improve the service.
• To comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, and we do not use your connected operational data to train machine-learning models without your explicit permission.

We share information only with service providers who help us run the platform, and only to the extent needed to deliver the service. Our key subprocessors include:

• Stripe — payment processing and subscription management.
• Neon — managed PostgreSQL database hosting for application data.
• Vercel — application hosting and content delivery.
• Sentry — error monitoring and performance diagnostics.
• Email delivery providers — transactional and notification emails.

We may also disclose information when required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets — in which case we will notify you.

Overstax is built data-first. We overlay intelligence on your existing stack without taking custody of it. Connections request only the scopes they need, we read the signals required to power your insights, and you can revoke access at any time.

You remain the owner and controller of your connected data. You are responsible for ensuring you have the authority to connect a given system and for the accuracy of the data within it.

We retain your information for as long as your account is active or as needed to provide the service. After account closure, we delete or anonymize personal data within a reasonable period, except where a longer retention period is required for legal, tax, accounting, or security purposes.

We protect your data with encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access controls, least-privilege connections, and full auditability. No method of transmission or storage is perfectly secure, but we work continuously to protect your information. Learn more on our Security page.

Depending on where you live, you may have the right to access, correct, delete, export, or restrict the processing of your personal data, and to object to certain uses. To exercise these rights, contact us at support@overstax.com. We will respond within the timeframe required by applicable law.

If you are in the EEA or UK, our legal bases for processing include performance of a contract, our legitimate interests in operating and improving the service, compliance with legal obligations, and your consent where applicable.

We operate globally, and your information may be processed in countries other than your own. Where we transfer personal data across borders, we rely on appropriate safeguards such as Standard Contractual Clauses.

We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the platform is used. You can control cookies through your browser settings; disabling some cookies may affect functionality.

Overstax is a business product intended for organizations and is not directed to individuals under 18. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you by email or in-product.

If you have questions about this Privacy Policy or how we handle your data, contact us at support@overstax.com.