Published document
Privacy notice
Version v1.3.0 · Document bd54f940-b891-4378-81b4-5d0a7d0b31e7
ITIN Connect Privacy Notice
> This notice currently applies to users in the State of New York. ITIN Connect is expanding to additional states. A version of this notice covering each new state will be published before ITIN Connect begins accepting users from that state.
Who This Notice Is For
This Privacy Notice explains how Financial Connect CPA PLLC, doing business as ITIN Connect ("we," "us," or "our"), collects, uses, shares, and protects your personal information when you use the ITIN Connect platform. It also explains your rights as a user located in New York.
Please read this notice carefully. If you have questions, you can contact us using the information in Section 10.
1. About ITIN Connect
ITIN Connect is a technology marketplace. We provide a secure online platform that connects individuals who need an Individual Taxpayer Identification Number (ITIN) with independent, IRS-authorized Acceptance Agents and Certified Acceptance Agents. We are not a tax preparation firm, and we do not prepare or file tax returns on your behalf.
Controller (the organization responsible for your data): Financial Connect CPA PLLC d/b/a ITIN Connect 150 W 51st Street New York, NY United States
2. Information We Collect
We collect the following categories of personal information:
2.1 Identity and Application Data
Information you provide when creating an account or submitting an ITIN application, including your full legal name, date of birth, country of birth, mailing address, email address, and phone number.
2.2 Tax Information
Information required to support an ITIN application, including your reason for applying, U.S. tax return information (where applicable), and any tax-related details submitted through the platform.
2.3 Government-Issued Identity Documents and Immigration Documents
[[Sensitive data category]] Copies of identity documents you upload to verify your identity, such as a passport, national identity card, foreign driver's license, or immigration documents (for example, a visa or border crossing card). We also collect foreign tax identification numbers where applicable.
These are sensitive categories of personal information. We handle them with heightened care, as described in Section 7.
2.4 Payment Data
ITIN Connect does not collect payment information from taxpayers. Taxpayers pay nothing to use the ITIN Connect platform. Payment data — including cardholder name, billing address, and transaction records associated with the provider lead-access fee — is collected from Providers (credentialed tax professionals) only. Full payment card numbers are not stored by ITIN Connect. Payment processing for Provider fees is handled by Stripe (see Section 5.2).
2.5 Communications
Messages, notes, and other communications you send through the platform, including communications between you and your selected provider or with our support team.
2.6 Device and Log Data
Technical information collected automatically when you use the platform, including browser type, operating system, pages visited, timestamps, and internet protocol (IP) address. IP addresses are stored in hashed and encrypted form. We do not store your raw IP address.
2.7 Consent Records
Records of any consents you provide through the platform, including consents under Internal Revenue Code §7216 authorizing the disclosure or use of your tax return information.
3. How We Use Your Information
We use your personal information for the following purposes:
3.1 Providing the Platform
To create and manage your account, match you with an available provider, facilitate the submission and review of your ITIN application, and communicate with you about your application status.
3.2 Processing Payments
To process the flat lead-access fee charged to Providers (credentialed tax professionals) through our payment processor, Stripe. ITIN Connect does not charge any fee to taxpayers. Taxpayers are not subject to any payment processing through Stripe.
3.3 Identity Verification
To verify your identity in connection with your application and to comply with applicable legal requirements.
3.4 Communications and Notifications
To send you service-related messages, including application updates, account notifications, and responses to your inquiries.
3.5 Platform Security and Fraud Prevention
To monitor and protect the security of the platform, detect and prevent fraud or unauthorized activity, and maintain logs for security and audit purposes.
3.6 Legal and Regulatory Compliance
To comply with our obligations under applicable law, including the New York SHIELD Act, New York General Business Law §349, the FTC Safeguards Rule, and Internal Revenue Code §7216.
3.7 Platform Improvement
To analyze aggregated, de-identified usage data to understand how the platform performs and to improve user experience. We do not use your identifiable personal information for this purpose.
4. Legal Bases for Processing
We process your personal information on the following grounds:
Contract performance: Processing your application and providing the services you have requested.
Legal obligation: Complying with applicable federal and state laws, including tax regulations and financial data security requirements.
Legitimate interests: Maintaining platform security, preventing fraud, and improving our services, where these interests are not overridden by your privacy rights.
Consent: Where we ask for your consent — for example, for §7216 disclosures — we process your information on that basis. You may withdraw consent at any time, though withdrawal does not affect processing that has already occurred.
5. How We Share Your Information
We do not sell your personal information. We share your information only in the limited circumstances described below.
5.1 Your Selected Provider
When you select an IRS-authorized Acceptance Agent or Certified Acceptance Agent through the platform, we share the information necessary for that provider to review and support your ITIN application. Sharing of tax return information for this purpose is subject to your §7216 consent.
5.2 Technology and Infrastructure Partners
We use the following third-party technology providers to operate the platform. Each acts as a service provider (or, where applicable, a data processor) and is permitted to use your information only to provide services to us.
Google LLC (Google Cloud Platform) — Encrypted cloud storage, database operations, and platform runtime infrastructure. ITIN Connect uses Google Cloud Storage for document storage, Cloud SQL for database operations, and Cloud Run for platform runtime. All production infrastructure operates within the United States.
Reducto AI — Automated document processing to extract information from identity and application documents. Reducto AI operates under a data processing agreement with ITIN Connect and maintains a subprocessor list available at trust.reducto.ai. Note: AWS appears on Reducto's subprocessor list. AWS does not receive taxpayer data directly from ITIN Connect.
Stripe, Inc. — Payment processing. Stripe processes payment card data directly and is independently subject to PCI DSS compliance requirements. ITIN Connect does not store full card numbers.
Twilio Inc. — SMS and voice communication services used to send platform notifications and verification messages.
Postmark (ActiveCampaign, LLC) — Transactional email delivery for account notifications and application updates.
5.3 Support Personnel
Authorized ITIN Connect support staff may access your information when necessary to respond to your inquiries or to resolve technical issues. Access is limited to what is necessary and is governed by confidentiality obligations.
5.4 Legal Requirements and Protection of Rights
We may disclose your information if we believe in good faith that doing so is required to comply with a legal obligation (such as a court order or government request), to protect the rights, property, or safety of ITIN Connect, our users, or others, or to enforce our terms of service.
5.5 Business Transfers
If ITIN Connect or Financial Connect CPA PLLC is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.
6. How Long We Keep Your Information
We retain your information for as long as necessary to provide our services and comply with our legal obligations. The table below summarizes our standard retention periods.
Category Retention Period W-7 application data and supporting documents 3 years from submission §7216 consent records Duration of engagement plus 3 years Government-issued identity and immigration documents 30 days after the end of your engagement Payment records 7 years (to satisfy tax and financial recordkeeping requirements) Communications (messages and support records) 3 years Device and log data 3 years
After the applicable retention period, we securely delete or de-identify your information. Some information may be retained for longer periods where required by law or where necessary to resolve a dispute or enforce an agreement.
7. Sensitive Information
Certain categories of information we collect — including government-issued identity documents, immigration documents, and foreign tax identification numbers — are considered sensitive personal information. We apply the following additional protections to this data:
Access is restricted to personnel and service providers who require it to perform specific, authorized tasks. Identity documents are deleted 30 days after the end of your engagement (see Section 6). Automated document processing (performed by Reducto AI) is conducted under a data processing agreement that prohibits use of your information for any purpose other than providing the contracted service. We do not use sensitive information for advertising, profiling, or any secondary purpose.
8. How We Protect Your Information
We maintain a Written Information Security Program (WISP) in compliance with the FTC Safeguards Rule and the New York SHIELD Act. Our technical security measures include:
Encryption at rest: All data stored on the platform is encrypted using AES-256 encryption. Encryption in transit: All data transmitted between your device and our platform is protected using TLS 1.2 or higher. IP address protection: IP addresses are stored in hashed and encrypted form. Raw IP addresses are not retained. Access controls: Access to personal information is limited to authorized personnel on a need-to-know basis. Vendor oversight: We require all technology partners to maintain appropriate security standards through contractual obligations.
No system can guarantee absolute security. If you believe your account has been compromised, please contact us immediately using the information in Section 10.
9. Your Rights as a New York User
New York law provides you with rights regarding your personal information. This section explains those rights and how to exercise them.
9.1 Right to Be Notified of a Breach
Under the New York SHIELD Act, if a security breach occurs that exposes your private information, we are required to notify you in the most expedient time possible and without unreasonable delay.
9.2 Right to Access
You have the right to request confirmation of whether we hold personal information about you and to receive a copy of that information.
9.3 Right to Correction
You have the right to request that we correct inaccurate or incomplete personal information we hold about you.
9.4 Right to Deletion
You have the right to request that we delete personal information we hold about you.
Important limitation: We may be unable to delete certain information if we are required to retain it by law or regulation. For example, §7216 consent records and payment records are subject to mandatory retention periods described in Section 6. Where we cannot fully honor a deletion request, we will explain the reason.
9.5 How to Exercise Your Rights
To submit a request, please contact us using the information in Section 10. We will respond within a reasonable time and may need to verify your identity before processing your request. We will not discriminate against you for exercising your rights.
10. How to Contact Us
If you have questions about this Privacy Notice, wish to exercise your rights, or want to report a concern, please contact us:
ITIN Connect — Privacy Inquiries Financial Connect CPA PLLC d/b/a ITIN Connect 150 W 51st Street New York, NY United States
privacy@itin-connect.com
11. Governing Law
This Privacy Notice is governed by and interpreted in accordance with the following applicable laws and regulations:
New York SHIELD Act (Stop Hacks and Improve Electronic Data Security Act) — governing data security and breach notification requirements for New York residents. New York General Business Law §349 — prohibiting deceptive acts and practices in the conduct of business. FTC Safeguards Rule (16 C.F.R. Part 314) — establishing standards for safeguarding customer financial information. Internal Revenue Code §7216 — governing the use and disclosure of tax return information by tax return preparers and related service providers.
12. Changes to This Notice
We may update this Privacy Notice from time to time. When we make changes, we will update the version number and effective date at the top of this document and notify you through the platform or by email where required by law. We encourage you to review this notice periodically.
The current version of this notice and its history are identified in the document footer below.
Document ID: DOC-PRIV-20260815 | Version: v1.3.0 | Effective: August 15, 2026 | Financial Connect CPA PLLC d/b/a ITIN Connect | New York — Pilot Version