Privacy policy

Draft for attorney review before launch.

File990Now LLC, 2337 Sandersville Rd, Lexington, KY 40511. Questions: support@file990now.com.

What we collect

To prepare and file a return: your organization’s legal name, EIN, address, website and tax-year financial totals, and the name, title and address of the principal officer who signs it. This is the information the IRS form itself requires; we do not ask for more.

For your account: your name, email address and a password we store only as a salted hash. If you turn on two-factor authentication, a secret for your authenticator app and hashed single-use recovery codes.

Automatically: the IP address of a sign-in attempt, used to rate-limit them, and a record of failed attempts.

Where it goes

Three companies process data on our behalf. This is all of them.

Our database provider

Stores everything above. Hosted in the United States (AWS US East, Ohio).

Our email provider

Receives the address we are writing to and the message itself — which for a receipt includes your organization’s name, the form, the tax year and the amount paid. It does not receive the contents of your return.

Stripe, for payment

Receives the amount and two internal reference numbers. No name, no EIN, no address, nothing from your return. Your card details go from your browser to Stripe directly and never reach our servers.

We send your return to the IRS when you tell us to. That is the point of the service. We do not sell personal information, and we do not share it for advertising.

How long we keep it

• failed authentication attempts: 1 day
• spent or expired treasurer invites: 30 days
• email delivery events: 2 years
• watchdog incidents: 1 year
• audit trail: 7 years
• returns and their event log: 7 years

Returns and the record of what happened to them are kept for seven years, which is the period you may need a prior return. If you have asked us never to email you again, we keep that request indefinitely — deleting it would start the email again, which is the one thing it exists to prevent.

Email we send you, and email you did not ask for

If you have an account, we send receipts, filing confirmations and rejections. Those are part of the service and have no unsubscribe link, because a receipt for money you have paid is not marketing.

You may hear from us without having signed up. The IRS publishes a list of every exempt organization, including which return is due and when. We use it to pre-fill returns and to write to organizations approaching a deadline. Where we do that, the address came from the organization’s own publicly listed contact page, we honour a site’s robots.txt and any notice asking not to be contacted, and we record where each address was found and why we believed we could use it.

Every such message carries our postal address and an unsubscribe link that works immediately and permanently. If you would rather not hear from us, one click is enough and you will not need to do it twice.

Your choices

Write to support@file990now.com to see what we hold about you, correct it, or ask us to delete it. Two honest limits: a return already transmitted to the IRS cannot be recalled by us, and we keep filed returns and the record of who accessed them for seven years, which we believe we are obliged to do. We will tell you plainly which parts of a request we can act on.

Security

What is in place, and what is not yet, is set out specifically on our security page rather than summarised into reassurance here.

Changes

If this policy changes in a way that affects what we do with your data, we will say so on this page and email account holders. We will not make a change quietly and date it.