Privacy policy
RH and Associates · Effective 29 September 2026
1. Who we are and what this covers
RH and Associates (“we”, “the firm”) is a tax and accounting practice. This policy explains what personal information we collect from you as a client or prospective client, why, who sees it, how we protect it, and the choices you have.
It covers:
- Our services: tax preparation, planning, and related accounting work.
- This client portal at portal.ramonaharms.cpa, where you upload documents and receive finished work.
- Our website, email, phone, and in-person communications.
As a tax return preparer we are a “financial institution” under the Gramm-Leach-Bliley Act. This policy is the privacy notice that law requires us to give you when you become a client and each year after. In short: we collect your information only to do the work you hire us for, we do not sell it or share it for marketing, and we protect it with the safeguards in section 5.
2. Information we collect
What you give us. Your name, address, email, and phone number; Social Security numbers and dates of birth for you and your dependents; income, bank, investment, property, and business records; prior returns; the tax documents you upload to the portal (W-2s, 1099s, 1098s, K-1s, statements, receipts); and anything you tell us in messages, calls, or meetings.
What the portal records automatically. When you use the portal we keep a log of consequential actions: sign-ins and sign-in attempts, second-factor enrolment and checks, each upload and its malware-scan result, each download, and each denied request. Each log entry records the date and time, your email address, the action, its outcome, the IP address the request came from, and your browser’s identifying string. This log exists to protect you: it lets us detect misuse and prove what happened to your documents.
If you enrol a passkey, the portal stores the public half of the key and a name for the device. If you choose text-message codes instead, it stores the phone number you enrol. It never stores a password, because it does not use one.
What we receive from others. Documents and notices from the IRS and state tax agencies, information from your prior preparer or your financial institutions when you authorise it, and, if you sign in with Google, your name and email address from Google.
3. How we use your information
We use your information to prepare and file your returns, advise you, respond to tax notices on your behalf, run the portal, send you sign-in links and second-factor codes, alert you about your documents, bill you, and meet our legal and professional obligations.
Tax return information is protected by federal law. Internal Revenue Code section 7216 and Treasury Regulation 301.7216 make it a crime for a preparer to use or disclose your tax return information for any purpose other than preparing your return, except as the law specifically permits or you specifically consent in writing. We will not use your return information to market other services to you, and we will never ask for a section 7216 consent that you do not need to give.
We do not use your information for advertising, we do not build profiles of you, and we do not use automated decision-making about you.
4. Who we share it with
We do not sell your information, and we do not share it with anyone for their own marketing. We disclose it only as follows.
Service providers that run our systems. These companies process information on our behalf, under contracts that limit them to that purpose. None of them may use your information for anything else.
| Provider | What it handles for us |
|---|---|
| Google Workspace | Stores your documents in our private Shared Drive |
| Microsoft 365 | Carries our email and stores working files for your return in OneDrive |
| Google Cloud | Runs our own malware scanner, which reads each upload in memory and keeps nothing |
| Vercel | Hosts the portal application |
| Neon | Hosts the portal database: your contact details, checklist, file names, and the activity log |
| Resend | Delivers sign-in links and portal notices to your email address |
| Twilio | Delivers text-message codes to your phone, if you choose that option |
| RH and Associates Proprietary Software | Prepares and electronically files your returns |
| RH and Associates Proprietary Software | Collects your signature on engagement letters and IRS authorization forms |
Government agencies. The IRS and state tax agencies, to file your returns and respond to notices, and only to the extent you have engaged us to do so.
When the law requires it. In response to a valid subpoena, court order, or other legal process, or to protect our rights or the safety of others. We will tell you when we are permitted to.
People you authorise. A lender, attorney, financial advisor, or family member, only after you tell us in writing, and only what you tell us to share.
A successor firm. If the practice is sold or transferred, your information may pass to the successor under the same duties described here, and you will be notified first.
We will never send your documents to a third-party file-scanning or analysis service that shares samples, and we never use consumer file-sharing links.
5. How we protect it
We maintain a written information security program, as the FTC Safeguards Rule requires, and review it every year. In plain terms:
- The portal replaces email attachments. Documents you upload go straight to our private, locked-down Google Shared Drive over an encrypted connection. Link sharing and outside access are switched off on that drive.
- Every upload is scanned for malware on a scanner we run ourselves before it reaches your folder. No outside company ever receives your documents for scanning.
- Two steps to sign in. A one-time email link or Google sign-in, then a passkey (your device’s face or fingerprint unlock) or a text-message code. Links expire in 15 minutes and work once.
- You can only see your own folder. Every request is checked against your account before any file is read or written.
- Everything is logged, and the log cannot be altered. The activity log described in section 2 is append-only at the database level and kept for 7 years.
- No long-lived keys. Our systems obtain short-lived credentials automatically; there is no password file for an attacker to steal.
- Our own devices are encrypted, locked, and can be wiped remotely. Paper is kept locked and shredded when no longer needed.
No system is perfectly secure. If we ever learn that your information was exposed, we will tell you promptly, tell you what we know and what we have done, notify the IRS so it can watch for fraudulent returns under your Social Security number, and help you take protective steps such as an IRS Identity Protection PIN.
6. Cookies and portal technical data
The portal uses two cookies, both strictly necessary for it to work. Neither tracks you across other sites.
| Cookie | Purpose | Lifetime |
|---|---|---|
| Session cookie | Keeps you signed in after you use your sign-in link or Google. Tied to a session record we can revoke at any time. | Until you sign out, the session expires, or we revoke it |
| Second-factor cookie | Records that you passed your passkey or text-code check for this session, so you are not asked again on every page. | Ends with the session |
Both are marked secure and HTTP-only, so they are sent only over encrypted connections and cannot be read by scripts in the page.
We use no analytics, advertising, or social-media trackers on the portal, and we load no third-party scripts into it. The only technical data we keep is the activity log in section 2, which records the IP address and browser string of each consequential action for security purposes.
If you sign in with Google, Google’s own privacy policy governs what Google records about that sign-in.
7. How long we keep it
We keep your returns, the documents behind them, and the portal activity log for 7 years after the return is filed, which covers the IRS and state periods for audits and amended returns. After that we destroy them.
Shorter periods apply to transient data: sign-in links and text codes expire within 15 minutes, and sessions end when you sign out or are revoked. Documents rejected by the malware scan are discarded immediately.
When our engagement ends, your portal account is closed and your records are kept for the remainder of the 7-year period, then destroyed. You may ask for copies of your documents at any time before then.
8. Your choices and rights
- Access and copies. Ask us at any time for a copy of the information we hold about you or of any document in your portal folder. We will provide it within 30 days.
- Correction. Tell us if anything we hold is wrong and we will correct it.
- Consent. We will not use or disclose your tax return information beyond preparing your return without your specific written consent under section 7216, and you may decline any such request without affecting our services.
- Second-factor choice. You may use a passkey or text-message codes, and change between them. If you lose your device, call us; we will verify you personally before resetting it, and the reset is logged.
- Closing your account. Ask us to close your portal account at any time. Access ends immediately. Your records are retained as section 7 describes.
- Deletion. We will delete information we are not required to keep. We cannot delete filed returns, their supporting documents, or the activity log before the retention period ends, because tax law and our professional standards require us to keep them.
- No opt-out is needed for the sharing in section 4, because we share only with service providers, government agencies, and people you authorise, and never for marketing.
- Former clients. These commitments continue to apply to you after our engagement ends.
If you live in a state that gives you additional privacy rights, you may exercise them by contacting us as described in section 9. We will not treat you differently for doing so.
9. Children, changes, and contact
Children. Our services and the portal are for adults. We collect information about children only from their parent or guardian, and only as needed to prepare a return.
Changes to this policy. When we change this policy we will post the new version here with a new effective date and, for material changes, notify you by email or through the portal. We also send this notice to every client annually as the law requires.
Contact. Questions, requests, or concerns about your privacy:RH and Associates, admin@ramonaharms.cpa, 408 461 5414, 1177 Branham Lane STE 117, San Jose, CA 95118.