Privacy Policy

Last updated: July 2026

What we access

TaxBox connects to your Gmail account to search for invoices, receipts, and billing documents, and to download their attachments. We never read, delete, or modify emails that don’t match your invoice/receipt criteria.

Sending to your accountant

Each month TaxBox packages your invoices and receipts and prepares an email to the accountant address you configure. By default this is created as a draft in your own Gmail for you to review and send. Only if you explicitly enable automatic sending in Settings does TaxBox send that packet email on your behalf — and only to the accountant address you set.

What we store

We store:

• Your name and email address from your Google account
• An encrypted OAuth refresh token to access your Gmail
• Email metadata (sender, subject, date) for emails classified as invoices or receipts
• Attachment files downloaded from those emails — held only while your packet is being built, then deleted immediately after delivery (zero-retention)
• Your saved queries and schedule preferences

We never download email bodies at all — not during classification, not after. To decide whether an email is an invoice, TaxBox fetches only the message headers (sender, subject, date) and the list of attachment filenames. The body of your emails is never requested from Gmail, never sent anywhere, and never stored.

How we use your data

Your data is used solely to operate TaxBox — finding your invoices and receipts and packaging them for your accountant. We do not sell, share, or use your data for advertising.

Third-party services

• Google Gmail API — to read your email
• OpenAI API — to classify emails. Only sender, subject, date and attachment filenames are sent. No email body, and no attachment contents, are ever sent.
• MongoDB — to store your account data
• PayPal — to process subscription payments

Data deletion

You can disconnect any Gmail account or delete all of your data at any time from Settings → Danger zone — this immediately revokes your Gmail token at Google and removes your stored files, metadata, and preferences. You can also email privacy@taxbox.io and we will delete everything within 7 days.

Security

OAuth refresh tokens are encrypted at rest. We use HTTPS for all data in transit. Attachment files are stored on a private server not accessible to the public.

Contact

Questions? Email privacy@taxbox.io.