Privacy Policy

1. Information we collect

Information you give us. Your name, email address, and phone number; your answers in the free savings calculator (income sources, household income range, and the situations you select); billing information (processed by Stripe; Doughy does not store full card numbers); and, when you buy a Service, the information needed to deliver it, which may include your tax returns, Social Security number and taxpayer identification numbers, business and personal financial records, payroll and ownership details, and the information you share in intake and consult sessions.

Information from your accounting software. If you connect QuickBooks or Xero, we access the books and records in that account under the permissions you grant. Your books stay in your own account; we do not move them.

Information collected automatically. IP address, browser and device type, pages visited, referring site, and access times, collected through server logs, cookies, and similar technologies (see Section 6).

Information from service providers. Payment confirmation from Stripe, email delivery and open or click data from our email provider, and scheduling data from our scheduling tool.

2. How we use information

• To deliver the Services you buy, including reviews, consults, implementation, bookkeeping, and tax filing.
• To produce your calculator results, email you a copy, and confirm your email address by a magic link.
• To bill you, send receipts and scheduling links, and manage your account.
• To communicate with you about the Services, including reminders and account notices, and, if you have not unsubscribed, to send information about Doughy products that may interest you.
• To operate, secure, and improve the Site and the Services, including measuring which pages and features are used.
• To comply with law, respond to lawful requests, prevent fraud, and enforce our Terms.

3. Tax return information (IRC Section 7216)

Federal law (Internal Revenue Code Section 7216 and its regulations) restricts how a tax return preparer may use or disclose your tax return information. We use and disclose your tax return information only to prepare, review, and file your returns and to provide the Services you request, to our licensed advisors and the service providers who support that work, or as you separately consent in writing, or as the law permits or requires. Where your consent is needed for another use or disclosure, we will ask for it in a separate signed consent that meets IRS requirements.

4. Financial privacy notice (GLBA)

As a provider of tax preparation and related financial services, Doughy is a financial institution under the Gramm-Leach-Bliley Act and the FTC Safeguards Rule. We do not sell your nonpublic personal information and we do not share it with nonaffiliated third parties for their own marketing. We share it only as described in Section 5. We maintain a written information security program with administrative, technical, and physical safeguards designed to protect the security and confidentiality of your information, and we require our service providers to safeguard it too.

5. How we share information

We never sell or share your data for others' marketing. We do not sell, rent, or trade your personal information, and we do not share it with third parties so they can market to you.

Service providers. We share information with companies that help us deliver the Services and that are bound by contract to use it only for that purpose and to protect it: payment processing (Stripe), website hosting and data storage, email and scheduling tools, electronic signature tools, and the tax and accounting software used to prepare returns and keep books.

Licensed advisors. Your information is shared with the licensed tax advisors who perform your Services. Our advisors are located in the United States. For routine tasks such as data entry and reconciliation, we may use vetted support staff, including staff located outside the United States, whose access is limited to what a task requires and who must follow our security requirements. A US-based licensed advisor is responsible for everything delivered to you.

Affiliates. We may share information with our parent, subsidiaries, and affiliates under common control, who must handle it consistently with this Policy.

Business transfers. If Doughy is involved in a merger, acquisition, financing, reorganization, or sale of all or part of its business or assets, your information may be transferred to the acquiring or successor entity, which may continue to use it under this Policy or a successor policy. Tax return information will be transferred only as permitted by IRC Section 7216 and its regulations.

Legal. We may disclose information to comply with law, court order, or lawful request; to protect the rights, property, or safety of Doughy, our clients, or others; or to enforce our Terms.

6. Cookies and analytics

We use cookies and similar technologies to operate the Site, remember your choices, and understand how the Site is used. We may use analytics and advertising tools (for example, Google Analytics, Meta, or LinkedIn pixels) that set their own cookies and may collect information about your visit to measure and improve our marketing. You can control cookies through your browser settings, and you can opt out of interest-based advertising through the tools those providers offer. Declining cookies may limit some Site features. The analytics and advertising tools currently in use on the Site are Google Analytics 4 and the Meta Pixel.

7. Security

Your information is encrypted in transit (256-bit) and at rest. Access is limited to personnel and advisors who need it to deliver your Services. The vendors we currently rely on for hosting, storage, and processing carry SOC 2 Type II certification. We use our best efforts to select vendors that hold that certification, and we vet every vendor we rely on; we may add or replace vendors over time, and this Policy does not commit us to any particular vendor or certification. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we learn of a breach affecting your information, we will notify you and any regulators as required by law.

8. Retention

We keep your information for as long as needed to deliver the Services and for three years after our relationship ends, unless a longer period is required by law, needed to resolve a dispute, or needed to enforce our agreements. Calculator answers not connected to a purchase are kept for the same period unless you ask us to delete them sooner. After the retention period, we delete or de-identify the information.

9. Your choices and rights

• Email: unsubscribe from marketing emails using the link in any email. You will still receive transactional emails about Services you buy.
• Accounting software: disconnect QuickBooks or Xero at any time from your account settings or from within that software.
• Access, correction, and deletion: email hello@getdoughy.com to request a copy of your information, correct it, or delete it. We may keep information we must retain by law (including tax records) or need to complete a transaction, prevent fraud, or resolve disputes.
• State privacy rights: depending on where you live (for example, California, Texas, Colorado, Virginia, or other states with consumer privacy laws), you may have additional rights, including to know what we collect, to opt out of sale or targeted advertising, and not to be discriminated against for exercising your rights. We do not sell personal information. To exercise a right, email hello@getdoughy.com. We will verify your identity before acting.

10. Children

The Site and the Services are for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn we have, we will delete it.

11. Links to other sites

The Site may link to sites we do not control. Their privacy practices are their own. Read their policies before sharing information.

12. Changes to this Policy

We may update this Policy. We will post the updated version with a new effective date and, for material changes, notify account holders by email. Continued use after the effective date means you accept the updated Policy.