Privacy Policy

The Onboarding Tool is a tax document intake portal for accounting firms (“Operators”). An Operator signs in, connects their own Google Drive account, and adds clients. Each client gets a unique upload link; documents they submit are validated by AI and then written directly into the Operator’s Google Drive.

From Operators: name and email address (via Google sign-in through Clerk), firm name, and an OAuth refresh token for their connected Google Drive account (encrypted at rest, AES-256-GCM).

From clients (of an Operator): name, email address, and optionally phone number, entered by the Operator or the client, used to generate the client’s upload link and send notifications.

Document contents: files a client uploads pass through our server only transiently — to be classified by an AI model and then written to the Operator’s Google Drive — and are deleted from our servers immediately after. We do not retain document contents. Document *metadata* (filename, type, upload status) is inferred by reading the Operator’s own Drive folder, not stored separately by us beyond what’s needed to render the checklist.

We also collect your email address if you request early access on our marketing site, and anonymous usage data when you browse this site (with your consent).

When an Operator connects Google Drive, we request the drive.file scope only. This scope is deliberately narrow: it grants access only to files and folders our app itself creates (or that the Operator explicitly picks via the Google Picker) — never the Operator’s pre-existing Drive files or folders, and never anything outside what the app created.

We use this access solely to create a folder structure per client and file validated tax documents into it, and to read back what the app previously wrote (to compute checklist/submission status). We do not scan, index, or otherwise access any other content in an Operator’s Google account.

The OAuth refresh token is encrypted at rest and used only to make these Drive API calls on the Operator’s behalf. An Operator can revoke access at any time from their Google Account permissions page or by disconnecting Drive in the app, which deletes the stored token.

The Onboarding Tool’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We share data with the following subprocessors, each solely to provide the Service: Anthropic (AI classification of uploaded documents), Google (Drive storage, OAuth sign-in), Clerk (Operator authentication), Resend (transactional email — welcome links, reminders, notifications), Neon (Postgres database hosting), Vercel (application hosting), and Lucky Orange (session replay and heatmaps, loaded on our marketing pages only and only after you accept analytics cookies — never on document upload pages or inside the app). We do not sell personal information or share it with third parties for marketing purposes.

We use cookies for session authentication (Operator sign-in, client link verification). With your consent, we also collect cookieless, anonymous product analytics across the site, and use session replay (Lucky Orange) on our marketing pages only — never on document upload pages or inside the app. You can decline analytics at any time.

Operator and client account records persist until the Operator deletes the client or closes their account. Uploaded document contents are never retained on our servers beyond the moment of validation; the documents themselves live in the Operator’s own Google Drive, which they control.

Operators can disconnect Google Drive or delete a client (and their data) directly in the app. Anyone can request removal of their information by emailing contact@theonboardingtool.com. If you are a client of an accounting firm, your documents live in that firm’s Google Drive — contact your accountant directly regarding them.

We may update this policy from time to time. The effective date above will reflect the latest revision.

Questions? Email us at contact@theonboardingtool.com and we’ll get back to you.