Privacy policy

Draft for attorney review before launch.

Last updated October 26, 2026.

File990Now LLC, 2337 Sandersville Rd, Lexington, KY 40511. Questions: support@file990now.com.

What we collect

To prepare and file a return: your organization’s legal name, EIN, address, website and tax-year financial totals, and the name, title and address of the principal officer who signs it. This is the information the IRS form itself requires; we do not ask for more.

For your account: your name, email address and a password we store only as a salted hash. If you turn on two-factor authentication, a secret for your authenticator app and hashed single-use recovery codes.

Automatically: the IP address of a sign-in attempt, used to rate-limit them, and a record of failed attempts.

When you file a return: the IP address you sign it from and when, an identifier for the browser it was started on and the one it was signed on, and how long you spent working on it. The IRS requires e-file providers to send these with every return so it can spot returns filed by someone using a stolen identity; they go to the IRS with the return and nowhere else. The browser identifier is worked out in your browser by code the IRS gives e-file providers for the purpose: it looks at characteristics of the device and browser (such as its graphics hardware, installed fonts, screen, language and time zone) and reduces them to a one-way hash. Only the hash reaches us. It includes nothing you have typed, and it cannot be turned back into the characteristics it came from.

What becomes public, and what does not

This is the part worth reading before you type anything, and it is not about us: it is how Form 990 works.

Most of your return is public. The IRS publishes accepted Form 990, 990-EZ and 990-N filings, and they are searchable by anyone through the IRS Tax Exempt Organization Search. Your organization’s name, address, EIN, officers and financial totals are all in that category. We do not make them public — the IRS does, because Congress decided an exempt organization’s return is a public record.

Schedule B is not. The Schedule of Contributors names donors and what they gave, and it is specifically excluded from public disclosure. We treat it that way: it goes to the IRS with your return and nowhere else. We will not sell it, share it, or hand it to anyone but the IRS, and no part of our marketing has ever used it.

We file with the IRS only. We do not file with state charity offices, so nothing you enter here is sent to a state regulator — if your state requires a separate registration, that is still yours to do.

Where it goes

Three companies process data on our behalf. This is all of them.

Our database provider

Stores everything above. Hosted in the United States (AWS US East, Ohio).

Our email provider

Receives the address we are writing to and the message itself — which for a receipt includes your organization's name, the form, the tax year and the amount paid. It does not receive the contents of your return.

Stripe, for payment

Receives the amount and two internal reference numbers. No name, no EIN, no address, nothing from your return. Your card details go from your browser to Stripe directly and never reach our servers.

We send your return to the IRS when you tell us to. That is the point of the service. We do not sell personal information, and we do not share it for advertising.

How long we keep it

• failed authentication attempts: 1 day
• spent or expired treasurer invites: 30 days
• spent or expired email confirmation links: 30 days
• email delivery events: 2 years
• email messages: 2 years
• email webhook receipts: 90 days
• watchdog incidents: 1 year
• audit trail: 7 years
• returns and their event log: 7 years
• IP addresses and device identifiers recorded when a return is signed: 2 years

Returns and the record of what happened to them are kept for seven years, which is the period you may need a prior return. If you have asked us never to email you again, we keep that request indefinitely — deleting it would start the email again, which is the one thing it exists to prevent.

Email we send you, and email you did not ask for

If you have an account, we send receipts, filing confirmations and rejections. Those are part of the service and have no unsubscribe link, because a receipt for money you have paid is not marketing.

You may hear from us without having signed up. The IRS publishes a list of every exempt organization, including which return is due and when. We use it to pre-fill returns and to write to organizations approaching a deadline. Where we do that, the address came from the organization’s own publicly listed contact page, we honour a site’s robots.txt and any notice asking not to be contacted, and we record where each address was found and why we believed we could use it.

Every such message carries our postal address and an unsubscribe link that works immediately and permanently. If you would rather not hear from us, one click is enough and you will not need to do it twice.

How we keep you signed in

One cookie, set when you log in. It holds a signed record of who you are and when the session expires — not your password, and nothing about your return. It is marked httpOnly, so scripts running in your browser cannot read it, and secure, so it is only ever sent over an encrypted connection.

We set no advertising cookies and run no third-party analytics or tracking scripts. The IRS’s browser-identifier code described above runs only in your account, on the pages where you start, prepare, sign or transmit a return, and what it works out goes to the IRS with the return and nowhere else. There is no cookie banner because there is nothing to consent to.

Your choices

Write to support@file990now.com to see what we hold about you, correct it, or ask us to delete it. Two honest limits: a return already transmitted to the IRS cannot be recalled by us, and we keep filed returns and the record of who accessed them for seven years, which we believe we are obliged to do. We will tell you plainly which parts of a request we can act on.

If you are in California

California law gives residents the right to know what personal information a business holds, to have it deleted, to correct it, and to opt out of its sale or sharing. The first three are covered by the section above and reach us at the same address.

The fourth does not arise: we do not sell personal information and we do not share it for cross-context behavioural advertising. There is no “Do Not Sell or Share My Personal Information” link on this site for that reason, not as an oversight. If that ever changes, the link appears here before the practice starts, not after.

Security

What is in place, and what is not yet, is set out specifically on our security page rather than summarised into reassurance here.

Changes

If this policy changes in a way that affects what we do with your data, we will say so on this page and email account holders. We will not make a change quietly and date it.