Legal
Privacy policy
Last updated November 3, 2026
This policy is new. Our attorneys are reviewing it, and we will post any changes here with the date.
What we collect, why, who handles it for us, how long we keep it, and how to have it deleted. It covers praxdex.com, the waitlist, firm sign-up, and the PraxDex service.
The short version
- We do not sell personal information, and we do not use it for advertising.
- praxdex.com has no analytics, ad trackers or tracking cookies.
- A firm's client data belongs to that firm. We handle it only to run PraxDex for the firm, and we do not use it to train AI models.
- Each firm's workspace runs separately, with its own database.
- Email us at hello@praxdex.com to see, correct or delete what we hold about you.
Who is responsible for what
PraxDex LLC ("PraxDex", "we", "us") makes software for accounting and tax-planning firms. We play two roles:
- For our own visitors and customers (people who visit praxdex.com, join the waitlist, sign a firm up, or work at a firm that uses PraxDex), we decide what we collect and why. This policy explains it.
- For a firm's clients, the firm decides. We handle its client information only to run PraxDex for that firm and on its instructions. If you are a client of a firm, its own privacy notice applies; see If your firm uses PraxDex.
Visiting praxdex.com
Our website is hosted by Cloudflare. Like every website, it receives your IP address, browser type, the page you asked for and the time. We keep request logs in our Cloudflare account to run and secure the site, and Cloudflare keeps its own. The site loads its typefaces from Google Fonts, so your browser also contacts Google, which receives your IP address. The 3D picture on our home page loads a code library from cdnjs, a public library service run by Cloudflare.
We do not use analytics, advertising cookies, tracking pixels or session recording on praxdex.com.
Joining the waitlist
You join the waitlist by emailing us at hello@praxdex.com. We receive whatever you put in your email: usually your name, email address and firm, and anything else you choose to tell us. Please leave client details out.
We use it to write back to you, to tell you when a place opens for your firm, and to decide which firms join first and what to support first.
Signing your firm up
When you sign a firm up, we collect the firm's name, the web address it chose, the first admin's email address, the number of users planned and any offer code. Payment is made through Stripe's checkout page: Stripe collects your card details, and we never see or store the full card number. We keep the plan, the Stripe customer and subscription references, and the address of the firm's workspace.
Using PraxDex at a firm
Each firm gets its own workspace, hosted on Amazon Web Services in the United States. It runs separately from every other firm's, with its own database, its own file storage and its own encryption key.
About the firm's staff, we hold names, work email addresses, roles, and a record of sign-ins and important actions (an audit log). Staff sign in with a link we email them plus a code from an authenticator app.
About the firm's clients, the workspace holds what the firm and its clients put in: contact details, household and financial information, tax documents, plans, messages and meeting details. This is the firm's data. We do not sell it, use it for advertising, or use it to train AI models.
Connections a firm turns on. A firm can connect its own accounts with other services, such as its calendar, its video-meeting tool or the system it used before PraxDex. For some services, such as Zoom and Microsoft, the connection uses an app PraxDex registered with that service, and someone at the firm signs in and approves what it may access. Information then moves between PraxDex and the firm's account. PraxDex creates meeting links this way; it does not record or transcribe calls.
If your firm uses PraxDex
If you are a client of an accounting firm that uses PraxDex, your firm decides what information about you it keeps and how it uses it. Your firm's privacy notice applies, and questions or requests about your information should go to your firm first. We help your firm answer them.
- Your firm's client portal and app link to your firm's privacy policy if it has set one, and to this page if it has not.
- Signing in to the portal is handled by Clerk, our sign-in provider, which receives your email address. You sign in with a code sent to your email, then a second step: a code from an authenticator app.
- In the app, "Delete my account" ends your sign-in straight away and asks your firm to delete your records and confirm with you. Your firm may have to keep some records by law.
- Federal law protects tax return information. PraxDex does not use or share it beyond running the service for your firm, and your firm asks for your consent where the law requires it.
AI
Some PraxDex features use AI to draft text, answer staff questions and suggest next steps. PraxDex switches AI on for each firm's workspace when it is set up, and it works only once access to Amazon's AI service is set up for that workspace. Some AI features also stay off until the firm's admin turns them on, and a firm can ask us to switch AI off. When AI runs:
- It runs only through Amazon Bedrock, in AWS's United States regions. Amazon states that Bedrock does not store what is sent or returned, or use it to train models, and we do not turn on Bedrock's optional logging of it.
- Before text is sent, PraxDex is designed to remove identifiers such as names, email addresses, phone numbers, and Social Security, tax ID and card numbers. Figures such as dollar amounts stay, because the drafts need them.
- When a request is about a particular client, PraxDex sends it only if that client's consent is on file with the firm. Each use is logged, without its content.
- A person at the firm reviews what the AI drafts before it reaches a client.
- Our team's email, including hello@praxdex.com, runs on Google Workspace.
- From PraxDex itself (sign-in links, invitations, notices, and messages a firm sends its clients), email is sent through Amazon Simple Email Service (SES), from an address on praxdex.com. These are messages people need to use the service, not marketing. If an address bounces or someone marks a message as spam, Amazon stops further email to that address and tells us.
- Any marketing email a firm sends through PraxDex includes an unsubscribe link.
We do not send marketing email to people who have not asked for it.
Who handles it for us
We use these providers to run PraxDex. Each receives only what it needs for its job.
| Provider | What it does for us | What it receives |
|---|---|---|
| Amazon Web Services | Hosts every firm's workspace, files, backups and encryption keys in the US; sends PraxDex email (SES); runs AI when it is on for a firm (Bedrock) | Everything stored in PraxDex, encrypted in storage; the emails PraxDex sends; text sent to AI when it runs |
| Cloudflare | Hosts praxdex.com; manages our domain names | Visitor IP addresses and request details |
| Stripe | Takes subscription payments from firms | Card and billing details, firm name, admin email |
| Clerk | Signs a firm's clients in to its portal, once the firm turns client access on | Client email addresses and sign-in details |
| Google Workspace | Runs our team's email, including hello@praxdex.com | Emails you send us, including waitlist requests |
| Google Fonts | Serves the typefaces on our pages | Your IP address and browser details |
| Browser notification services | Deliver notifications to staff who turn them on in their browser (Apple, Google, Mozilla or Microsoft, depending on the browser) | A notification, without client details in it |
Before we add a provider that will receive information we hold, we will add it to this list and email the admins of subscribed firms at least 30 days ahead.
We do not sell personal information or share it for anyone's advertising. We disclose information if the law requires it, to protect people or the service, or as part of a sale or merger of PraxDex, in which case this policy continues to apply to it.
How long we keep it
- Waitlist emails: kept in our team inbox until your firm joins or you ask us to delete them.
- Other emails you send us: kept in our team inbox until we delete them.
- Website request logs: as long as Cloudflare keeps them.
- A firm's workspace: for as long as the firm subscribes. A firm's admins can delete a client's records at any time. Team chat messages are a firm record and stay when a client is deleted, until the firm's admin turns on a retention period; so do files the firm imported whole from its previous system. When a firm leaves, we give it a copy of its data if it asks, then delete its workspace within 60 days of its plan ending.
- Audit log: the record of sign-ins and important actions, including staff email addresses and the IP addresses and browser details of staff and clients who sign in, is kept for as long as the workspace exists. It never holds client names.
- Backups: each workspace makes a nightly encrypted backup, kept in the firm's own storage on AWS. Deleted records leave those backups within about four months, as long as nightly backups keep running. A deleted client's documents leave sooner: the off-site backup at the next nightly backup, and the remaining disk backups within 35 days.
- Sign-ins: staff sessions end after 8 hours; client app sign-ins end after 30 days, or 7 days unused.
- Security records: system and access logs are kept for up to 400 days, and records of changes to our AWS setup for 7 years. They are used only for security and fixing problems.
Security
- Each firm's workspace is separate, with its own database, storage and encryption key. Data is encrypted in storage and in transit, and the most sensitive fields are encrypted again by PraxDex itself.
- Staff sign in with an emailed link plus an authenticator app. A firm's clients sign in to its portal with an emailed code plus an authenticator app. Important actions are written to a log that cannot be quietly edited.
- Our cloud setup is written as code and tested, including tests that check one firm cannot reach another firm's data.
- Files uploaded to PraxDex are checked for viruses before anyone can open them.
No system is perfectly secure. If a breach affects information we hold, we will tell the affected firms within 72 hours of confirming it, keep them updated as we learn more, and tell affected people as the law requires.
Your choices
- See, correct or delete your information: email hello@praxdex.com, or reply to any email from us. We answer within 30 days, and may ask you to confirm the request comes from you. If you are a client of a firm, please ask your firm.
- Stop hearing from us: reply "stop" to any email from us.
Cookies
praxdex.com sets no cookies of its own. Cloudflare may set a cookie to block bots. Inside PraxDex we use only the cookies the service needs: a sign-in session cookie, a short-lived cookie on public booking pages, if a staff member turns on notifications, a cookie that remembers their browser, and, on a firm's client portal, Clerk's own sign-in cookies. We do not use advertising or analytics cookies.
Children
PraxDex is a service for businesses, not for children, and we do not knowingly collect information from anyone under 18. A firm's client records may include information about a client's children, such as dependants on a tax return. That is the firm's data and is handled as described above.
Changes
If we change this policy we will update the date at the top. If a change materially affects information we already hold, we will tell you by email before it takes effect.
Contact
PraxDex LLC, a Utah limited liability company, 11075 S State St #32B, Sandy, UT 84070. Email hello@praxdex.com.