Privacy Policy

This Privacy Policy explains how BorderFile collects, uses, discloses, and protects personal data. It applies to borderfile.io, the BorderFile dashboard, our APIs, and any related communications. For the purposes of the EU and UK GDPR, BorderFile is the data controller. For CCPA purposes, BorderFile is the "business". If you have questions after reading this policy, email support@borderfile.io.

1. What we collect

a. Account data

• Name, email address, locale, timezone, password hash (argon2id), two-factor seed.
• Account role (owner, admin, member) and organisation memberships.
• Session metadata (sha256 digest of the session token, created-at, last-seen-at).

b. Business and tax data

• Legal name and formation details of each US company you add.
• Employer Identification Number (EIN) and foreign tax identification numbers for each owner. These are encrypted at rest with AES-256-GCM using a versioned key; the dashboard and public APIs return only the last four digits; the full value is retrievable only via a dedicated, audited, rate-limited "reveal" endpoint.
• CP 575 or 147C letters you upload, which we match against your intake.
• Bank statements (PDF / CSV) you upload, the transactions parsed from them, and the related-party tags you confirm.
• Prepared filings, review history, e-signatures, fax confirmation pages.

c. Billing data

We use Stripe for payments. Stripe manages your card details directly; we store only the Stripe customer ID, subscription state, invoice metadata, and the receipt-visible attributes (plan, amount, currency, country). We never see full card numbers.

d. Service metadata and logs

• IP addresses and device/browser identifiers for authentication and abuse prevention.
• Request logs that redact PII at the logger before writing (passwords, EINs, tax IDs, cookies, authorization headers).
• Audit entries for every mutation, sensitive-field reveal, document download, impersonation, and billing change — the audit trail cannot be amended.

e. Marketing-site usage

We use a privacy-friendly analytics tool with no cross-site tracking. We record aggregated page-view data for borderfile.io; we do not use advertising cookies and do not sell traffic data. The current analytics provider is listed in the sub-processor section (section 3).

2. Why we process it

• Performance of the contract. We need account, business, and tax data to prepare, review, and submit your filings and to coordinate adjacent compliance work.
• Legal obligations. We retain filing-related records for seven years after submission (aligned with the general US tax statute of limitations with a safety buffer) and comply with lawful requests from US and state taxing authorities.
• Legitimate interest. Securing the platform (rate limits, abuse detection, intrusion monitoring); improving the Services using aggregated and anonymised metrics; defending ourselves in a dispute.
• Consent. Product-update emails, participation in surveys, case studies. You can opt out at any time.

3. Who sees it

• Our team. BorderFile staff involved in your filing (preparer, reviewer, EA/CPA). Named roles are visible on your proof pack.
• Infrastructure sub-processors. We rely on a short list of specialist providers: a cloud host, a managed Postgres provider, a managed Redis provider, an S3-compatible object store, an email delivery service, Stripe for billing, Cloudflare for the public website and Pages Functions, and a privacy-friendly analytics provider. The specific vendor names and the data categories they process are published on our sub-processor list, which we update ahead of any material change and link from this page once we're in production. Each sub-processor is bound by a data processing agreement that mirrors or exceeds this policy.
• With your explicit consent. Third-party integrations you connect (for example, a bank data provider in a future phase).
• Legal and regulatory bodies. We disclose data when required by law (court order, subpoena, lawful tax-authority request). We will notify you unless legally prohibited.

We do not sell personal data.

4. International transfers

Data is processed in the United States. For customers in the European Economic Area, the United Kingdom, or Switzerland, we rely on the Standard Contractual Clauses adopted by the European Commission (and the UK International Data Transfer Addendum where applicable) as the legal transfer mechanism. A copy of the SCCs we use with each sub-processor can be requested at privacy@borderfile.io.

5. Retention

• Submitted filings and their proof packs: seven years from submission. Legal holds extend retention until the hold is lifted.
• Unsubmitted drafts: twenty-four months after the last activity, then archived; raw statement PDFs are purged earlier where possible.
• Marketing analytics: up to twenty-four months in aggregated form.
• Account data: while your account is active, plus up to twelve months after closure for finance reconciliation.

Hard deletion is performed by a documented retention job; it is irreversible. Audit log rows survive deletion of their referenced record so we can answer "who did what, when" questions after the fact.

6. Your rights

Depending on where you live, you may have the following rights:

• Access — a copy of the data we hold about you.
• Rectification — correct inaccurate data.
• Erasure — delete your data (subject to retention obligations in section 5).
• Portability — receive your data in a structured, commonly used, machine-readable form.
• Objection and restriction — ask us to stop or limit certain processing.
• Withdraw consent — for anything we do on consent (for example, marketing emails).
• Lodge a complaint — with your local data-protection authority. In the EU and UK you can also contact your supervisory authority directly.

To exercise any right, email privacy@borderfile.io from the address on your account. We respond within the statutory window — thirty days under the GDPR; up to forty-five days under the CCPA, with a one-time thirty-day extension where allowed.

7. Security

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Tax identification numbers, EINs, foreign tax IDs encrypted with AES-256-GCM and a versioned key, with HMAC blind indexes for lookup by last-4.
• Argon2id password hashing (OWASP-recommended parameters); session tokens stored as sha256 digests; CSRF double-submit; rate limits on all authenticated endpoints.
• Documents served through short-lived presigned URLs (PUT 5 minutes, GET 60 seconds); type allow-list; 25 MB cap; virus scan.
• Role-based access with tenant scoping on every repository call; separation of duties for review.
• Security incident contact: security@borderfile.io.

8. Children

The Services are not directed to anyone under 18. We do not knowingly collect data from children. If you believe we have inadvertently collected such data, email us and we will delete it.

9. Cookies and session management

We use a strictly necessary session cookie for authentication (HttpOnly, Secure in production, SameSite=Lax, path=/). Our marketing site uses an aggregate privacy-friendly analytics cookie whose provider is listed on our current sub-processor list. We do not use advertising cookies, third-party cookies, or cross-site trackers.

10. California privacy rights (CCPA / CPRA)

If you reside in California, you have the right to request disclosure of the categories of personal information we have collected about you in the preceding twelve months, the categories of sources, our business purpose, and the categories of third parties with whom we share it. You can also request deletion of personal information and portability of your data. We do not "sell" personal information or share it for cross-contextual behavioural advertising.

11. Changes

Material changes to this policy are posted here with an updated "Last updated" date and emailed to active customers at least thirty days before they take effect.

12. Contact

General data questions: privacy@borderfile.io. Security concerns: security@borderfile.io.