Tax60 Subprocessors
Version 2.0 · Effective October 1, 2026 · Last updated October 1, 2026
Effective October 1, 2026. This list is part of the Tax60 Privacy Policy (https://tax60.app/legal/privacy). It names every service provider that receives personal information on behalf of PLUSH LLC, doing business as Tax60, what each receives, and where it operates. Each provider acts only on our instructions, under a written contract that forbids it to use the information for anything else, and stores what it holds encrypted at rest. We update this page at least 30 days before adding a provider, except for an emergency replacement needed to keep the Service running, which we post as soon as practicable.
| Provider | Function | What it receives | Location |
|---|---|---|---|
| Apple Inc. | Sign in with Apple; App Store billing; Apple Push Notification service; TestFlight; iCloud Drive (on your own Apple account, under Apple's terms) | Apple user identifier, relay or real email, purchase transactions, push tokens and content-free push payloads; exports you choose to save in your own iCloud Drive stay there, and we cannot access them | United States |
| Supabase, Inc. | Database, object storage, authentication, server functions | Your record — location fixes, day records, work sessions, trips, confirmations and notes, documents, medical-exception tags and certifications, and the change log — with its commitments; account email, name, phone number and Apple identifier; device records, subscription state, invitations and access logs, support access and its log, legal-hold flags, server request logs; for professionals who use the CPA portal, their account details, authenticator enrolment and sign-in records; our staff access and email logs, support notes, and business contacts (Privacy Policy Section 4) | AWS us-east-2 (Ohio), United States |
| Amazon Web Services, Inc. | Underlying cloud infrastructure for the database and storage provider | Same as above, as the infrastructure host | us-east-2 (Ohio), United States |
| Vercel Inc. | Hosting for tax60.app, the Tax60 web app, the CPA portal (cpa.tax60.app) and our staff console (admin.tax60.app); server-side functions for web checkout and push delivery | Request logs (IP address, pages, timestamps); for a signed-in session, the parts of your record that the pages it opens show, processed to render those pages and not stored: your own web app sessions, the professionals you invite, and our staff while you have support access open; the account information our staff console shows | United States |
| Resend, Inc. | Transactional email (confirmation and password-reset codes, receipts, invitations to professionals, the notice that a professional can now view your record, security and legal notices); the one-to-one emails our staff send from the staff console, to you and to business contacts; the tax60.app launch list (Privacy Policy Section 4.4) | Recipient email or Apple relay address and the message content of those emails; for the launch list, the email address of anyone who confirms a launch-list request, stored as a contact until the release email is sent, plus delivery metadata | United States |
| Stripe, Inc. | Payment processing for purchases made on tax60.app | Name, email, payment card details (held by Stripe, never by Tax60), billing address, transaction records | United States |
| Functional Software, Inc. (Sentry) | Crash and error reporting | Stack traces, device model, iOS version, app version, memory and performance metrics; no user identifier, no coordinates | United States |
| TelemetryDeck GmbH | Aggregate product analytics | Event names (for example "day confirmed"), app version, iOS version, device model, and a random per-install identifier not linked to your account; no coordinates, jurisdictions, counts, hours or notes | Germany (aggregate, non-identifying event data only) |
Questions: privacy@tax60.app.