AI-Assisted Processing & Data Handling: Terms of Use

By accepting these terms, your firm agrees to the following governing Ledgerly's AI-assisted document processing and data retention features (prior-return analysis, bulk client onboarding, and compliance document extraction):

1. Your firm is responsible for client consent

Your firm represents and warrants that, before using any AI-assisted processing feature for a given client, your firm has obtained whatever consent is legally required under applicable law (including, where applicable, IRC §7216 and its regulations governing use and disclosure of tax return information) for that client's information to be processed by a third-party AI system as part of this service.

Ledgerly does not obtain that consent for you, and does not ask your clients for it. By default, your clients are informed of how their documents are processed without presenting a per-client opt-out checkbox on their upload portal. If your firm wishes to offer clients a self-service opt-out control on their portal page, you can enable it under Firm Settings → Read documents automatically → Let clients opt out of this themselves.

Either way, be aware that an opt-out is not an IRC §7216 consent. A consent under those regulations is affirmative, signed, and must meet the form and content requirements of Rev. Proc. 2013-14; a box left unticked is not one. Where consent is required for a given client, obtaining it remains your firm's responsibility and happens outside this product.

Where a client has opted out of AI-assisted reading, that choice is honoured regardless of your firm's default portal setting. Their documents are routed for manual staff review instead, and the control remains visible to that client so they can update their preference at any time.

2. What Ledgerly does with this data

Before any document is sent to an AI system, identifying information is removed on Ledgerly's own server. Specifically: the taxpayer's name (in the forms a return prints it), their home address, email and telephone number, the names of the spouse and any dependants read from the return, every Social Security and Employer Identification number, and account and loan numbers. Only the redacted text is sent.

What is not removed, because it is what is being read: the figures (wages, interest, dividends, deductions) and the names of the institutions that issued the documents, such as an employer, bank, broker, lender or partnership. Rental property addresses from Schedule E are also retained, because they are public record and identify which property a figure belongs to. A tax return's figures are tax return information; your firm should assume they are disclosed, and obtain consent on that basis.

Ledgerly does not control or guarantee the AI vendor's own data retention or training policies beyond what is publicly stated by that vendor.

3. How long we keep documents, and what deleting means

We keep documents for seven years after the return they support was due, and then we destroy them. Seven years is the general guideline in the AICPA's Document Retention FAQs for Tax Practitioners; New York requires it of preparers and California advises it. It is longer than the three years IRC §6107(b) obliges a preparer to keep a return, and it covers the seven-year window the IRS allows for a claim relating to worthless securities or a bad debt.

The clock runs from the return's due date, not the day the document was uploaded. A 2024 document supports the 2024 return whenever it reaches us. Nothing is ever destroyed within a year of arriving, whatever its tax year, and nothing is destroyed on the day it becomes due: a document sits past its retention date for a further 90 days first, so a policy set wrongly is visible before it costs anything.

Your firm sets the period, and can switch it off. Seven years is the default, not a rule. A firm that needs longer, shorter, or no automatic destruction at all can say so, and nothing of that firm's will expire.

What this does not do is decide what matters. Some records are useful far beyond seven years: the basis of a property, a depreciation schedule, a like-kind exchange, a loss carried forward. Ledgerly applies dates, not judgement. Deciding that a particular record should outlive the policy is your firm's to make, and today that means keeping your own copy.

When your firm deletes a client, it happens in two stages. The client is first marked for deletion and stays recoverable for 60 days, so a deletion made in error can be undone. That window is fixed when you delete and does not move afterwards. After it elapses the client is destroyed permanently: the records in our database, and the document files themselves, both the copies held in object storage and any held on the server. This is not reversible and we cannot recover it for you.

What survives a deletion, deliberately: entries in the activity log recording what was done and by whom. A record of what happened outlives what it happened to, because it is how your firm answers a question about its own conduct later. Those entries name actions and users; the deleted client's documents and tax data are gone.

If your firm closes its Ledgerly account, you can export your complete firm archive at any time from Firm Settings, and delete client records or request accelerated permanent destruction after exporting your records.

4. Your firm indemnifies Ledgerly for consent failures

Your firm agrees to indemnify and hold Ledgerly harmless from any claim arising from your firm's use of AI-assisted features without having first obtained the client consent required under applicable law.

5. Security incident notification, subprocessors, and FTC Safeguards Rule (16 CFR Part 314 / IRS Pub. 4557)

Under the FTC Safeguards Rule (16 CFR § 314.4(f) and § 314.4(j)) and IRS Publication 4557, Ledgerly commits by contract to implement and maintain administrative, technical, and physical safeguards protecting customer information. In the event of a confirmed security incident, breach, or unauthorized access to customer tax or financial records, Ledgerly will notify the affected CPA firm within 72 hours of discovery by email and in-app notice, detailing the scope of the incident, affected client records, and remediation steps so the firm can meet its own state, IRS, and FTC notification obligations. Security incidents and vulnerability reports may be reported directly to security@myledgerly.ai. Current infrastructure subprocessors are DigitalOcean LLC (US hosting and encrypted storage), Amazon Web Services Inc. (AWS SES transactional email), Twilio Inc. (consent-gated transactional SMS), Stripe Inc. (PCI-DSS billing), and Anthropic PBC (zero-retention redacted AI extraction when enabled). Upon contract termination, the firm may export all workpapers and client documents in standard ZIP/CSV/PDF formats, after which remaining data is permanently destroyed according to the firm's configured retention schedule.

6. Your rights to access, correct, or delete your data

We collect each category of data for a specific purpose: uploaded tax and accounting documents are collected for checklist tracking, figure extraction, and workpaper preparation; client names, contact details, entities, and encrypted SSNs/EINs are collected to identify taxpayers, match records, and send portal notifications; and sign-in and billing details are collected to authenticate users, enforce multi-factor security, and administer subscriptions. Every individual and firm has the right to access, the right to correct, and the right to delete their data. Firm owners and staff can export, edit, or delete client records and documents directly in the application (with permanent file and database destruction after the 60-day recovery window), and clients or staff can exercise their right to access, correct, or delete their personal data through their CPA firm or by contacting support@myledgerly.ai.

7. This can change

Ledgerly may update these terms from time to time. Continued use of AI-assisted features after an update requires accepting the updated terms.

I have read and accept these terms