Privacy Policy

1. Who we are

Helmsman is operated by Helmsman Corp, a Wyoming corporation ("Helmsman," "we," "us," or "our"). We are the party responsible for the personal information described in this policy. This policy explains what we collect, how we use and protect it, who processes it for us, and the choices and rights you have. It applies to the Helmsman website and service.

Helmsman provides educational tax strategy analysis. We are not a tax preparer and do not file returns. Because we help with tax planning, some of the information you give us is sensitive, and this policy describes how we handle it.

2. The information we collect

We collect the following categories of information, in each case to provide the service:

• Account information: your email address and the credentials used to sign in.
• Profile information: a display name, your home state, and your filing status.
• Tax situation you enter: details about your businesses (such as name, entity type, line of work, profit and owner salary, and employee counts), your income, retirement contributions, real estate you rent to your own business, and free-text notes about your goals.
• Free-text descriptions: if you describe your situation in your own words, the text you write.
• Uploaded prior-year returns: if you choose to upload a return (such as a 1040, 1120, 1120-S, or 1065), the file and the information in it.
• Billing information: your subscription and purchase records. Payments are processed by Stripe; we do not receive or store your full card number.
• Usage and security records: a log of key actions on your account, and request counters that we use to prevent abuse. Most counters are tied to your account identifier. The counters for signing in, signing up, and asking for a password reset use your IP address. The counters for signing in and for password reset also use a hashed copy of the email address you type. A hash is a scrambled version that comes out the same every time for the same address, and a few of these counters use only the hashed address and not your IP address. These counters expire on their own, at most two hours after your last attempt.

3. Sensitive information, including tax returns

The tax information you provide, and especially a prior-year return you upload, is sensitive. A return can contain Social Security numbers and employer identification numbers, information about dependents (which may include a minor), and detailed financial information. We treat this information as sensitive and handle it as described in this policy. Please provide only what is needed for your analysis, and do not upload documents that belong to someone who has not authorized you to share them.

4. How we use your information

We use your information to:

• create and secure your account and sign you in;
• build your Tax Map and the analyses you request;
• extract structured figures from a return you upload, so you do not have to re-enter them;
• process payments, manage subscriptions, and prevent abuse of the service;
• provide support, and communicate with you about the service; and
• operate, maintain, debug, and improve the service, and comply with law.

We do not sell your personal information, and we do not use it for advertising or cross-context behavioral advertising.

5. How your information is used with AI

Helmsman uses an artificial intelligence provider, Anthropic (the Claude API), to read your free-text description, to extract figures from an uploaded return, and to help generate the written parts of your Tax Map. This is the only AI provider that receives your tax information.

Before your information is sent to Anthropic, we run an automated redaction step on our servers that scans the free text for identifiers and replaces each one with a typed placeholder. It targets Social Security numbers, employer identification numbers, full account and card numbers, and street-level addresses. It does not remove your city or state, because where you live affects the analysis. This step runs on your free-text description, on the text extracted from an uploaded return, and on the free-text fields of the structured summary described below. The raw uploaded file itself is never sent to the AI model. Redaction is pattern-based and best-effort: it is designed to catch these identifiers before they are sent, but it is automated and cannot guarantee that every identifier is caught, so please enter only the information you actually need to share.

Names on an uploaded return are also replaced before the text is sent. Our servers look for the names the return itself marks out: a name printed beside a Social Security or employer identification number, a name printed after a name label on the form, a business name that ends in a legal form such as LLC, Inc or Trust, the names in a Schedule K-1's header blocks, and a "care of" line. Each name we find is replaced with a placeholder such as [PERSON_1] or [ENTITY_2] for the length of that one request, and your real names are put back into the result before anything is saved, joined to your other documents, or shown to you. When you upload several documents together, a name found on any one of them is replaced on all of them. The house number and street of an address written the usual way (a house number, a street with its suffix, then a city, state and ZIP) are removed as well, and the city and state stay; a street printed with no suffix, such as a grid address or a numbered route, may not be.

We measured this rather than assuming it. On a library of real filed returns and their attachments, around 98 in 100 printed mentions of a household's own names were replaced before the text was sent, and about one document in seven still had at least one mention go through. Coverage is lower on documents that are not tax forms, such as statements and letters, where a name often appears in ordinary prose with nothing beside it to mark it as a name. A name we cannot find on the page reaches our AI provider as written. In particular we do not promise to catch: a name that appears only in prose, with no label, identifier or legal form beside it; an abbreviation or code standing for a name; a name whose every word is ordinary tax-form vocabulary; or a name on a scanned page our text reader cannot read.

Names you type into your answers are handled separately. Before your situation is sent for strategy analysis, the names held in your records (your businesses, the partners on your K-1s, a business you rent property to) are replaced with placeholders, including where your notes repeat one of those names in a form we recognize. A name that appears only in what you write, and in none of your records, is not guaranteed to be replaced. A second person or business named inside one of your records (a "care of" contact, a trustee, a beneficiary) is replaced only where the record names it, not where your notes repeat it. Part of a name on its own, such as a bare surname or a nickname, and a name written in a shape we do not build, such as a variant spelling or a business's short name without its legal form, may not be replaced. A name held in a field other than a partner or tenant record is replaced in that field, not in the prose around it. When you ask us to read your free-text description in the first place, that text is sent with identifiers removed and names as written.

The uploaded file itself never goes to any AI provider. We extract its text on our own servers, and when a page is a scan we read it with optical character recognition that also runs on our servers, so no page image is sent to any AI provider. We also never mark your text for the AI provider's prompt caching; the only content we mark for the provider's prompt cache is our own fixed instructions.

To produce your candidate strategies and the written analysis, we send Anthropic a structured summary of your situation, and it contains two kinds of fields. The free text you type is run through the redaction step above before it is sent. That free text includes the name you give your situation, your scenario notes (including the "what changed this year" and "anything else" notes), each business's name, activity, and notes, any real-estate description and the name of the entity a property is rented to, and any planned asset-sale description. The figures that make up the analysis are sent as you entered them, because they are what the model reasons over and there is nothing to strip from a number. Those figures include the dollar amounts and counts (business profit, owner salary, distributions, retirement contributions, other income, rent, and planned-sale amounts), the tax year, your filing status, each business's tax classification and whether it is a specified service business, and your state of residence.

Every dollar figure calculated in your Tax Map comes from our own engine, never from the model. The amounts those calculations start from are the ones you provided, together with any modeling assumption the report states as an assumption, which the engine then prices. References to the Internal Revenue Code are verified against a stored copy of the statutory text. To build that internal legal-reference index, we use a separate provider, OpenAI, to process the text of the Internal Revenue Code itself. OpenAI does not receive your tax information.

6. How we protect your information

We use technical and organizational measures designed to protect your information, including:

• row-level security on every table that holds your data, so your records are reachable only under your own authenticated session;
• a private, per-user storage area for uploaded documents that is not publicly accessible;
• redaction of the identifiers described above before your text is sent to the AI provider;
• encryption of data in transit;
• rate limiting and authentication controls to resist abuse and unauthorized access; and
• administrative access to production systems limited to what is needed to operate the service.

No method of storage or transmission is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential.

7. Who processes your information for us

We use the following service providers to operate Helmsman. Each processes information only as needed to provide its service to us:

• Supabase: authentication, database, and private file storage.
• Anthropic: AI processing of your redacted description, your redacted return text, and your structured tax situation, to produce your analysis.
• Stripe: payment processing. Stripe receives the payment and identifying details needed to process a charge; it does not receive your tax analysis.
• Upstash: rate-limiting infrastructure, which processes request counters tied to your account identifier or, for signing in, signing up, and password reset requests, to your IP address (and, for signing in and password reset, a hashed form of your email address), and not your tax information.
• Vercel: application hosting and delivery. Like any host, it receives the IP address of each request and keeps its own routine logs.
• OpenAI: building our internal index of Internal Revenue Code text. It does not receive your tax information.

We may also disclose information if required by law or valid legal process, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets, in which case we will continue to protect your information under this policy or will notify you of any material change.

8. Where your information is processed

Helmsman is operated from the United States and is intended for United States taxpayers. Your information is processed in the United States by us and by our service providers. If you access the service from outside the United States, you understand that your information will be processed in the United States.

9. How long we keep it, and how deletion works

We keep your information for as long as your account is active, so that your scenarios and analyses remain available to you. We do not currently apply a fixed expiration period to your account data; instead, your data stays until you delete it.

When you upload a return, the raw file is deleted from our storage as soon as we have extracted the structured figures from it. We keep the redacted, structured extraction and a record that the raw file was removed. We do not retain raw uploaded returns.

You can delete an individual analysis or scenario at any time, which removes it from our database. You can also delete your entire account from your settings. Deleting your account permanently removes your profile, scenarios, analyses, uploaded-document records and extractions, billing and usage records, and your private storage folder, and it deletes your login. This cannot be undone.

After deletion, copies of removed data may persist for a limited period in routine, secured backups of our infrastructure that are outside our day-to-day control, until those backups age out on our infrastructure provider's schedule.

10. Your privacy rights and how to use them

You can exercise the following directly in the service:

• Access and portability: download a copy of your data as a file from your settings.
• Correction: edit the information in your scenarios, or contact us for help correcting other information.
• Deletion: delete an analysis or scenario, or delete your entire account and its data, from your settings.

You can also contact us at hello@helmsman.tax to exercise these rights or ask a question. We will respond as required by applicable law. We will not discriminate against you for exercising a privacy right.

11. State privacy rights

Depending on where you live, your state may give you additional rights over your personal information, which can include the right to know what we collect, to access or delete it, to correct it, to obtain a portable copy, and to opt out of certain uses. Because we do not sell personal information, do not use it for targeted advertising, and do not use it for profiling that produces legal or similarly significant effects, there is no such activity for you to opt out of.

To exercise a state privacy right, use the tools in your settings or contact us at hello@helmsman.tax. We will verify your request against your account and respond within the time your state law requires. If we deny a request, you may have the right to appeal by replying to our response.

12. Cookies and browser storage

Helmsman sets three cookies. Your browser sends all three only to Helmsman:

• Sign-in session: a Supabase cookie whose name starts with sb- and ends in -auth-token (a long session can be split across several cookies with a number added to the name). It keeps you signed in. It is set when you sign in or open a sign-in link from your email, and it is renewed as you use Helmsman. Signing out removes it, and so does deleting your account. It is strictly necessary.
• Link verifier: a Supabase cookie whose name starts with sb- and ends in -auth-token-code-verifier. It is used to check the link we email you when you sign up or reset your password, and it is set when we send you one of those emails. It is strictly necessary to finish those two steps from the emailed link.
• helmsman_locale: remembers your language (English, Spanish, Russian, or Simplified Chinese) so that the signed-in app and the sign-in pages open in it. Our public pages, such as the home page and this policy, use the language in the web address instead. It is not strictly necessary, and Helmsman works in English without it. It lasts one year. It is set when you choose a language, and also when you open a page whose address has /en, /es, /ru, or /zh as its first part, even if you did not use the language menu. Signing out or deleting your account does not remove it, but you can clear it in your browser settings.

Without the sign-in session cookie you cannot stay signed in, so the signed-in part of Helmsman will not work. Without the link verifier you may not be able to finish creating an account or resetting a password from the emailed link. Our public pages, including this policy, still load. Without helmsman_locale, nothing stops working.

Helmsman also keeps two items in your browser's own storage. They are not cookies:

• helmsman_preview_notice_es, helmsman_preview_notice_ru, or helmsman_preview_notice_zh-Hans (local storage): remembers that you closed the note that says a translation is a draft. It is saved only when you click the button that closes the note, and only in the signed-in app. It stays until you clear your browser data. It is not sent to us. It is not strictly necessary.
• helmsman.intake.clientDraftId (session storage): a random number, with no personal information in it, that identifies the draft you are filling in on that browser tab, so that reloading the page or retrying after a lost connection does not create a duplicate draft. We save the number with your draft. It is removed when you finish the questionnaire or close the tab.

We do not use advertising cookies, analytics cookies, or cross-site tracking, and we do not run third-party trackers on the service.

A few actions connect your browser to another company's servers. When you pay, Helmsman sends you to Stripe's hosted checkout or billing page. Stripe may set its own cookies on its pages, and Stripe's own policies cover them, not this one. When you upload a return, your browser sends the file directly to our private storage at Supabase, using an upload link our server creates for you. As with any website, Supabase receives your IP address with that request. When you click the link in a sign up or password reset email, the link may pass through Supabase's servers before it brings you back to Helmsman.

13. Do Not Track and Global Privacy Control

Some browsers can send a Do Not Track or Global Privacy Control signal to tell websites not to track you. Because Helmsman does not track you, sell your information or share it for advertising, there is nothing for these signals to turn off, and Helmsman works the same whether or not your browser sends one.

14. Children and dependents

Helmsman is for adults. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has created an account, contact us and we will remove it.

A tax return you upload as an adult account holder may contain information about a dependent, who may be a minor. That information is provided by you about your own return, not collected by us from the child. We apply the same protections to it as to the rest of your return, including redacting a dependent's Social Security number before any AI processing, and we delete it when you delete the related records or your account.

15. Data security incidents

If we become aware of a security incident that affects your personal information, we will investigate and will notify you and the appropriate authorities where required by law, within the time the law requires.

16. Changes to this policy

We may update this policy. If we make a material change, we will update the date above and give reasonable notice before it takes effect. Your continued use of Helmsman after the change takes effect means you accept the updated policy.

17. How to contact us

For privacy questions or to exercise a right, contact hello@helmsman.tax. You can also reach us at Helmsman Corp, Wyoming, US.