Privacy policy

BackYears is an independent referral service. We are not a CPA firm, tax preparer, or law firm, and we are not affiliated with the IRS or any government agency. Tax services are provided by independent licensed professionals.

Who we are

BackYears is run by Quixta Ventures LLP, a limited liability partnership registered in India. This policy explains what we collect when you use backyears.com, answer our questions, get our emails or use the partner portal, and what we do with it. Questions? Email support@backyears.com.

What we collect

When you answer our questions:

• Your answers: how many years you haven't filed, the first unfiled year (optional), kinds of income, an income range, whether you have an IRS letter and its code (optional), how organised your records are, how soon you want help, and your state.
• Contact details: your first name, email address, and phone number if you give one.
• Notes: anything you type in the notes box.
• Consent records: whether you ticked the sharing box and the phone box, the exact wording you saw, its version, and when.
• Where you came from: campaign tags and ad click ids in the link you first arrived from (for example utm_source, gclid, fbclid or ttclid), if there were any. We store these with your answers so we know which channels help people.
• Spam protection: a one-way, salted hash of your IP address (we never store the IP itself), and a Cloudflare Turnstile check that you're a person.

While you answer, your browser keeps a draft of your answers on your own device for up to 7 days, so a refresh doesn't lose them. It isn't sent to us until you press submit. Consent boxes are never saved in the draft.

Later: your answer to our one check-in email (did the partner reach you?), and any request to delete your data.

If you're a tax pro: what you send through the partner interest form (your name, firm, email, credential, states and message), which comes to us by email and isn't stored in our database. If you become a partner, we also keep your firm details, credential number and the date we checked it, your agreement date, the email you sign in with, your plan, cap, introductions and invoices.

What we never collect: your Social Security number, tax returns or other tax documents, bank or card details, or your exact income. Our forms block anything that looks like an SSN or account number.

How we use it

• To show and email you your next steps.
• If you ticked the sharing box, to pick a partner who covers your state and tax years and has room that month, and to make the introduction.
• To send the few service emails linked to your request: confirmation, introduction, one check-in, and deletion links.
• To prevent spam and abuse, and to keep the site secure.
• To run the partner portal and bill partners for introductions they accept.
• To understand, in total, which pages and channels help people (only with your cookie consent, see below).
• To meet legal obligations and deal with disputes.

Who receives it

One partner, only if you tick the sharing box. Before they accept, they see a summary of your answers and your first name. After they accept, they see your email address and notes, and your phone number only if you also ticked the phone box. If a partner doesn't respond in time, we may offer the introduction to another listed partner instead. Partners are independent businesses. Once they have your details, they handle them under their own privacy policy and their professional rules. See our partners for the full explanation and the exact wording of the sharing box.

Service providers that run BackYears for us, under contract, only to provide their service:

Vercel

What they do: Hosting the website

Where: United States

Supabase

What they do: Database and partner sign-in

Where: United States

Resend

What they do: Sending our emails

Where: United States

Cloudflare (Turnstile)

What they do: Checking forms are sent by a person

Where: Global network

Upstash

What they do: Rate limits (hashed keys only)

Where: United States

PostHog

What they do: Product analytics, only if you allow cookies

Where: United States

Google Ads, Meta, TikTok

What they do: Ad measurement, only if you allow cookies

Where: United States and global

Stripe

What they do: Partner invoices and payments (people we introduce never pay us)

Where: United States and global

For legal reasons: if the law requires it, to protect people's safety, or to defend our rights.

If BackYears changes hands: as part of a merger, sale or reorganisation, under this policy.

Selling and sharing

We never sell your information for money, and we never send your answers (income, years, letters) or contact details to analytics or ad companies.

If you click "Allow" in our cookie banner, Google, Meta and TikTok receive a signal that someone finished our questions, with a random id, and can set their own cookies in your browser. Some state privacy laws call that "selling" or "sharing" personal information for targeted advertising. You can say no in the banner, change your mind at any time with "Cookie settings", and we treat a Global Privacy Control signal from your browser as a "no" automatically. See the cookie policy.

From our own server, we count two events in PostHog with a random record id and no answers or contact details: "finished the questions" (only if you allowed cookies and your browser doesn't send Global Privacy Control) and "a partner accepted an introduction".

How long we keep it

Your answers, contact details, notes and consent records

18 months after you submit, then deleted or anonymised. Sooner if you ask.

After you ask us to delete

We remove your name, email, phone, notes, letter code, first unfiled year, campaign tags and IP hash straight away. We keep the anonymous parts (state, years range, income range) and the history of what happened to the introduction, for billing and our records.

The draft in your browser

Up to 7 days on your device, or until you submit.

Rate-limit counters

24 hours.

Partner interest form emails

Up to 24 months, unless you become a partner.

Partner records and invoices

As long as you're a partner, then for as long as accounting and tax law requires (usually 8 years).

Database backups

Roll off within 30 days.

Your rights and choices

Whatever US state you live in, you can ask us to:

• tell you what we hold about you and give you a copy, in a common, machine-readable format if you ask;
• correct it;
• delete it;
• stop any "sale" or "sharing" for targeted advertising (see above);
• stop processing anything sensitive. We don't collect what most state laws call sensitive data, such as SSNs or account numbers.

To ask, use the delete my data page, or email support@backyears.com from the address you used. We'll check it's really you by emailing that address, and we'll reply within 45 days. If we need longer, we'll tell you why, and we can take up to 45 more days. You can use an authorised agent; we'll ask for proof that you gave them permission. If we say no, we'll tell you why, and you can appeal by replying to our answer. We'll respond to an appeal within 45 days. If we still say no, you can contact your state attorney general. We won't treat you differently for using any of these rights.

We don't use your information to make decisions with legal or similarly significant effects about you. Our score only decides whether and to whom an introduction is offered.

We don't knowingly sell or share the personal information of anyone under 16.

In the terms of the California Consumer Privacy Act, in the last 12 months we collected identifiers (first name, email, phone if given, a hashed IP address), internet activity (pages visited, campaign tags) and the answers you gave about your tax situation. We disclosed them to the service providers listed above for business purposes, to one partner only when you ticked the sharing box, and, if you clicked Allow, visit information to the ad networks named above.

Your privacy choices

• Cookies: Cookie settings lets you change your choice at any time.
• Global Privacy Control: if your browser sends it, analytics and ad cookies stay off automatically.
• Delete your data: use the delete my data page. If a partner already received your details, we tell them you asked.
• Phone: only a partner you're introduced to can call or text you, and only if you ticked the phone box. We never call or text you ourselves. Tell the partner or us to stop at any time.
• Email: today we only send service emails about your own request. If we ever send marketing email, we'll ask first, and every one will have an unsubscribe link and our postal address.

Security

We limit who can see your information. Partners see your contact details only after they accept, and only through a restricted view. We store a salted hash instead of your IP address, and our database rules stop partners seeing anyone else's introductions. We keep a written information security checklist covering who can access data, how access is reviewed and how we respond to incidents, and we apply it whether or not a particular law requires it. No system is perfectly secure. If a breach affects your information, we'll tell you as the law requires.

Where your data is

BackYears is run by Quixta Ventures LLP from India. Our service providers store your data in the United States, and our team accesses it from India. BackYears is meant for people in the United States.

Children

BackYears is not meant for anyone under 18, and we don't knowingly collect information from children. If you think a child has used it, email us and we'll delete it.

Changes

We'll update this policy when what we do changes. The date at the top shows the last change. If a change materially affects how we use information we already hold, we'll ask for your consent where the law requires it.

Contact

• Email: support@backyears.com
• Post: Quixta Ventures LLP, Bengaluru, Karnataka, India