Last updated: 2026-10-24

TaxClaw Cloud — Privacy Policy

TaxClaw is a service of Outbranch Network LLC.

This is a draft placeholder. It has not been reviewed by the owner or by counsel and is not final. It may change before paid launch. Text marked [Pending review] is an open item that has not been decided or verified.

• Effective date: [Pending review]
• Operator ("we", "us", "our"): Outbranch Network LLC, a New York limited liability company [Pending review]
• Postal address: [Pending review]
• Contact: lando@outbranch.net
• Service: TaxClaw Cloud, the hosted remote MCP server at https://mcp.taxclaw.net/mcp, together with the payment, support and related functions that go with it (the "Service")

The short version

We're not processing anyone's taxes. We're helping get the documents in order. TaxClaw Cloud turns tax documents (W-2s, 1099s, K-1s and similar forms) into structured data for you, your accountant or your tax software. It performs extraction on documents you supply and returns the results only to you. It does not prepare, review or file returns, give tax, legal or financial advice, place amounts on return lines, or compute tax liability. Outbranch Network LLC is not a CPA firm, a law firm or a tax preparer.

TaxClaw Cloud is built for AI agents. There are no accounts, no email addresses, no sign-in, no OAuth and no passwords. Your agent identifies itself only by the cryptocurrency wallet address it claims free pages with or pays from. Because the documents we handle are among the most sensitive a person has, this policy is built around one design rule: we process your documents in memory and keep no copy of them.

• Documents reach us from your agent inline in the request or by an https URL your agent gives us. They are processed in memory and dropped when the call returns; they are never written to disk, to our database or to logs.
• Extracted values are returned in the response. The one exception to "never stored": when an extraction runs too long to answer in one call, its result is held in our database so your agent can fetch it with get_job, for at most 1 hour after it completes (section 2.2).
• What we do keep is wallet, ledger and billing metadata: the wallet address, a record of its free-page claim, per-call usage records, the SHA-256 fingerprint of each document, payment and settlement records, and our own AI-provider cost records.
• AI providers do the reading: OpenAI and Anthropic. They receive rendered page images only, never the PDF's text layer. Section 4 is the per-provider data map, and every extraction response carries a data_handling field telling you which provider saw which pages.
• TypeSafe is also listed in section 4. It is not switched on yet and receives nothing today. Once it is switched on, it may receive a few masked lines of a page's text layer when our two readers disagree on a field. It never receives page images.
• Payment is by x402 only: USDC on the Base network, from your agent's wallet. We never see a card number or a bank account, and we hold no keys to your wallet.
• Each successful extraction returns a signed receipt. A signed receipt proves origin and integrity, never accuracy. Receipt hashes are batched and anchored on the Base blockchain once a day; only a batch root goes on chain (section 2.6).
• We do not sell, pool or reuse your data, we do not use it for advertising, and we do not train AI models on it. We treat your documents as tax return information under IRC §7216: used only to provide the Service and disclosed only to the providers named in this policy.

1. What this policy covers

This policy covers the Service: the remote MCP server at mcp.taxclaw.net, its extraction backend, payments for the Service, and support correspondence about it.

It does not cover:

• The local, open-source TaxClaw core. It runs on your own machine and has its own Privacy Policy. In its local mode nothing leaves your machine.
• Your AI agent or MCP client. You use the Service through software you choose. That software holds your documents before they reach us, holds the results after we return them, and holds the wallet it pays from. Its provider's privacy terms govern it, not this policy. See section 9.
• People you share results with, such as your accountant or your tax software. Their terms govern what they do with the data.
• The Base blockchain. Payments settle, and signed-receipt batch roots are anchored, on a public network that nobody, including us, controls. See sections 2.5 and 2.6.
• The taxclaw.net website. Section 12 carries a separate, shorter notice for it.

2. Information we receive, and how long we keep it

2.1 Documents you submit (transit data)

How documents arrive. Your agent sends each document to the Service in one of two ways:

1. inline in the request as base64 (practical for files up to about 3 MB); or
2. by file_url, a public https address your agent gives us, which we fetch (public addresses only, at most 20 MB, with a 20-second time limit).

Supported files are PDF, PNG, JPEG, TIFF and WebP, up to 20 MB and 50 pages per call.

What they contain. Everything printed on the page: names, Social Security numbers and other taxpayer identification numbers, employer identification numbers, account numbers, addresses and dollar amounts. Treat every document you send as containing all of these.

What we do with them. The free quote tool counts pages and computes a SHA-256 fingerprint of the file; it needs no wallet and no payment, and it does not send the document to any AI provider. The extract_document tool forwards the document, over an authenticated connection, to our extraction backend, which opens it in memory, renders each page to an image, and sends page images to the AI providers in section 4 to read the fields. The PDF's text layer is read only inside our backend, to recognize the form type without a model call and, if you ask, to locate identifiers to mask (section 4.5). It is never sent to OpenAI or Anthropic. Once the TypeSafe judge is switched on (section 4.1), a few lines of it may be sent to TypeSafe for a field the two reads disagree on. Pages that look blank are not sent to any model. The backend assembles the results and their provenance and returns them to your agent.

How long we keep them. Document bytes are held only in memory while the call runs and are dropped when it returns. They are never written to disk, to our database or to logs.

2.2 Extraction results

What they are. For each document: the document type, tax year, payer and recipient, the extracted fields with a confidence value and needs_review flag for each, warnings, the data_handling field (section 4.4), a processed_by field naming the models and providers that read the pages, a standard object (the TaxClaw core version, its schema version and the form schema used), a billing receipt, and on request a Form 8949 CSV or TXF file. Each successful extraction also returns a signed TaxClaw receipt, which contains no extracted values (section 2.6). The build_tax_packet tool is not connected yet and processes nothing.

How long we keep them. Results are returned in the response and are not stored. When an extraction takes longer than the inline wait, the Service returns a job_id and keeps running; its final result is written to our database so your agent can fetch it with get_job. A job result can be read for at most 1 hour after the job completes (an unfinished job is abandoned after 1 hour), and only by the wallet that started it. Expired job rows are deleted the next time any job is created or read, and by a daily cleanup sweep. Extracted values are never written to logs. After we return them, the results exist only where your agent and you put them.

2.3 Wallet and free-page claim records

There are no accounts. The only identifier we hold for you is a wallet address.

• Wallet address. The public address of the wallet your agent pays from, or claims free pages with. A wallet address is pseudonymous: it does not name you, but it is public on the blockchain and can be linked to you by anyone who knows it is yours.
• Free-page claim. To claim free pages, your agent requests a claim message (an EIP-4361 "Sign-In with Ethereum" message with a single-use nonce and an expiry) and signs it with the wallet's key. The signature proves control of the wallet. Signing it is not a blockchain transaction: it costs nothing, moves no funds, and gives us no access to the wallet. For the nonce we keep the wallet address, the chain, and when the nonce was issued, when it expires and when it was used. For the claim we keep the wallet address, the chain, the kind of signature (an ordinary wallet or a smart-contract wallet), a SHA-256 hash of the exact signed message, and the time of the claim. We do not keep the signature itself.
• Free-tier counters. Per-call reservations of free pages (wallet address, idempotency key, pages, status and timestamps), used to enforce the 10-page per-wallet allowance and the service-wide daily free-page limit.

2.4 Usage records (the ledger)

For each extraction request we keep: the wallet address, the request's idempotency key, the SHA-256 fingerprint of the document, the file type, the page count, the free pages applied, the pages charged, the amount, whether the call was free or paid, the request status, the settlement reference for a paid call, and timestamps.

The fingerprint cannot be turned back into the document. It lets us recognize the same file if it is submitted again (so a retry or a re-extraction of an already-paid document is not charged twice) and lets an extraction call be matched to its quote.

We also keep:

• Extraction run records. For each extraction attempt: the wallet address, the document fingerprint, start and finish times and the outcome. These are used to enforce spending and abuse limits, and are deleted 30 days after the run finishes unless a payment for it is still being resolved.
• Provider cost records. One row per AI-provider call: provider, model, page index, purpose (primary, cross-check or escalation), token counts, cost and an error code if the call failed. These contain no document content.
• Settlement records. For each paid call: the payment authorization your agent signed and the payment requirements it accepted (including the authorization's nonce and validity window), the paying wallet address, the network, the amount, the settlement status, the evidence for each status change (the facilitator's answer or on-chain proof), the on-chain transaction hash once known, and timestamps. These records exist so that no authorization is ever settled twice and so that a charge can be proven or disproven on-chain.
• Refund records. When we grant a refund, the refund status and the on-chain hash of the return transfer.

2.5 Payments and tax records

x402 payments (USDC on Base). The Service is paid only by x402, per call, from your agent's wallet in USDC on the Base network. Your agent signs a payment authorization for the exact quoted amount; we verify it with an x402 facilitator before doing any work, perform the extraction, and settle the authorization only after extraction succeeds. A failed extraction is never settled.

• What the facilitator receives. The facilitator is Coinbase's x402 facilitator (Coinbase Developer Platform) [Pending review]. To verify and settle the payment, it receives the signed payment authorization (the paying wallet address, our receiving address, the amount, the validity window and the nonce) and the payment requirements your agent accepted, which also carry the document's SHA-256 fingerprint, the call's idempotency key and the page counts. It never receives document content or extracted values. A link to its privacy terms is [Pending review].
• What our Base RPC provider receives. We read the Base network, and send our anchoring transactions (section 2.6), through a Base RPC node provider: Coinbase Developer Platform (CDP) Node [Pending review]. To prove or disprove a charge or a refund on-chain, it receives the paying wallet address, the authorization nonce and transaction hashes; to check a free-page claim signed by a smart-contract wallet, it receives the wallet address, the claim signature and a hash of the claim message. It never receives document content or extracted values.
• What is public. The paying wallet address, the receiving address, the amount and the transaction are permanently public on the Base blockchain by the nature of the network; nothing we do can remove them.
• What we never see. We never receive a card number, a bank account or a wallet private key. The Service holds no keys to your wallet; payments are authorizations signed by your agent and settled by the facilitator. Refunds, when we grant one, are a new on-chain transfer from our receiving wallet back to the paying wallet, recorded once the transfer is proven on-chain.
• There is no card checkout and no prepaid credit. Stripe card checkout and prepaid credits are not part of the Service.

Tax-compliance records. How sales and similar taxes apply to payments from wallet-only payers is unresolved [Pending review]. The Service does not currently ask for, derive or record your location (including from your IP address), and no sales-tax engine receives any data today. Whether location or business/personal-use information will be collected for tax purposes, which tax engine (if any) is used, and how long payment and tax-compliance records are kept are [Pending review]. Any such records will contain nothing about your documents.

2.6 Signed receipt records

Signed and anchored. Each successful extraction returns a signed receipt, and our signer set is published at https://mcp.taxclaw.net/.well-known/taxclaw-receipts.json. Batches of receipt digests are anchored on the Base blockchain once a day (scheduled 06:00 UTC); only a batch root goes on chain.

What the signed receipt is. Each successful extraction, free or paid, returns a signed TaxClaw receipt: an EIP-712 signature by a TaxClaw signing key over a short, fixed set of fields: (a) the SHA-256 of the input document (the same fingerprint quote returns); (b) the SHA-256 of the extracted output; (c) the TaxClaw standard name, core version and schema version, with a link to the published benchmark; (d) the document type, tax year, page count and the number of fields flagged for review; (e) the AI providers and models that read the pages; (f) the payment reference: for a paid call the network, the transaction hash, the amount and the paying wallet address, and for a free call the wallet the free pages were granted to; (g) the time of issue; (h) a hash of the request identifier, never the identifier itself; and (i) our signer address. The schema is closed and checked at issuance, so extracted values, names, identifiers and free text cannot enter a signed receipt.

What goes on the blockchain. We collect receipt digests (hashes) into batches, compute a Merkle root over each batch, and publish that root on the Base network through the Ethereum Attestation Service (EAS): one transaction per batch, on a schedule (currently once a day, scheduled 06:00 UTC), nothing per document. A batch root is a hash of hashes; it cannot be reversed into any receipt, document, value or wallet. The exact on-chain record fields are [Pending review]. Receipts signed before anchoring was switched on are included in later batches, oldest first. On-chain records are permanent and public. Nothing we do, and nothing you request, can remove them.

What we keep. For each signed receipt: the receipt digest, the identifier of the key that signed it, and the timestamp; once it is batched, also the batch it belongs to and its position in that batch (the Merkle proof). We keep no document values. Anyone holding a receipt can check it with the free verify_receipt tool against our signer set at https://mcp.taxclaw.net/.well-known/taxclaw-receipts.json. How long receipt records are kept is [Pending review].

What it proves. Origin and integrity only, never accuracy: that an output came from TaxClaw Cloud under a stated standard version, and that it has not been altered since. It is not a statement that the output is accurate, complete or fit for filing. The Terms of Service say so and prohibit presenting a receipt as a certification of tax data.

2.7 Hosting, security and operational logs

Our hosting provider (Vercel) records basic request metadata for security and reliability: IP address, user agent, timestamp, route, status code and timing. Request metadata may place an IP address and a wallet address in the same log line. Our extraction backend writes one fixed-shape log line per request (route, status code, page count, number of model calls, elapsed time and an error code) and nothing else. Our MCP server logs only named operational events (for example, a configuration refusal) without request bodies. We never log request bodies, document content, extracted values or signed payment authorizations, and errors from AI providers are reduced to a short code because they could quote document values. How long hosting logs are retained is [Pending review].

2.8 Support correspondence

We do not collect an email address from you, and we have no way to contact you unless you contact us. If you email lando@outbranch.net, we keep the correspondence for a period that is [Pending review]. Please do not send tax documents, Social Security numbers or account numbers by email; support cannot see your documents because we do not have them.

3. How we use information

We use the information above to:

• Provide the Service: receive your documents, extract them, return results.
• Meter and charge: quote and count pages, apply the free tier, verify and settle x402 payments, prove or disprove a charge on-chain, and process refunds we grant.
• Prevent abuse and fraud: enforce idempotency so no call is charged twice, enforce the per-wallet and service-wide free-page limits and spending limits, verify wallet control before granting free pages, and refuse service to wallets that abuse the Service.
• Keep the Service secure and reliable: operational and security logs (metadata only).
• Track our own costs: provider-cost records let us see what each request cost us and plan capacity. They contain no document content.
• Issue signed receipts and anchor them on Base (section 2.6).
• Meet accounting, tax and legal obligations.

What we do not do:

• We do not sell your information, and we do not share it for advertising. We do not run advertising.
• We do not train AI models on your documents, your extracted values or your results, and we do not let anyone else do so through us (see section 4 for each provider's own terms).
• We use your documents and the data extracted from them only to provide the Service to you. We do not sell, share, pool, aggregate or reuse them, even in anonymized form, and we do not use them for analytics or marketing. We treat them as tax return information under IRC §7216 (section 4.6).
• We do not store document content, and we do not log it.
• We do not collect email addresses, names or any contact details, and we do not send marketing.

4. AI providers: the data map

4.1 How a document is routed

Reading the fields on a page is done by third-party AI models, called directly through each provider's own API (api.openai.com and api.anthropic.com), never through a model router. Every page that is not blank is rendered to an image and:

1. read by a primary model (OpenAI gpt-6-luna);
2. read again by a cross-check model from a second provider (Anthropic claude-haiku-5-5);
3. when the two reads disagree, first put to TypeSafe's Jev judge (jev-1.13.0), which picks which of the two values the page's text layer shows. This step is not switched on yet; while it is off, TypeSafe receives nothing. A page goes on to escalation unless Jev settles every disputed field with high confidence. A field Jev settles is always flagged needs_review. Pages with no text layer, or where a disputed field is an identifier (a Social Security number, ITIN, EIN, account number or state ID), are never sent to Jev;
4. sent to an escalation model (OpenAI gpt-6-sol) when the two reads still disagree or a read fails.

Brokerage lot detail (1099-B rows for a Form 8949) is read by the primary model only. If the cross-check provider is not configured, the cross-check is skipped, that provider receives nothing, and every field is flagged for review. An escalation is never charged to you twice; it is recorded only in our provider-cost records. Models may change (section 4.3); the processed_by and data_handling fields in each response name the models that actually read your pages.

Whether every provider endpoint processes your pages only in the United States is [Pending review].

4.2 Providers

4.3 Changes to providers

We will add a provider to the table in section 4.2, and update the "Last updated" date, before that provider receives any customer document.

4.4 Per-response disclosure: data_handling and processed_by

Every extraction response includes a data_handling field that states which provider received which pages, that it received page images, that no text-layer content was sent, the outcome of any identifier masking, and our retention statement, plus a processed_by field naming the backend, models and providers. Only calls that actually sent a page are listed. You do not have to trust this policy alone: your agent can check each response.

4.5 Optional identifier masking: redact_identifiers

Your agent may set redact_identifiers on a request. On pages that have a text layer, the Service then masks every word matching a Social Security number, ITIN or EIN pattern in the page itself, before the page is rendered and sent to any provider, and prints the IRS truncated form in its place (for example "XXX-XX-1234"), keeping only the last four digits. Account numbers are not masked. Image-only pages (scans and photos) have no text layer to locate identifiers in, so they cannot be masked; they are counted and reported in data_handling. Whether identifiers should be masked by default is [Pending review].

4.6 Tax return information (IRC §7216)

We treat your documents and the data extracted from them as tax return information, and we hold ourselves to the use and disclosure limits that IRC §7216 and Treas. Reg. §301.7216 place on tax return preparers, whether or not those rules are ultimately held to apply to us. We use and disclose that information only to provide the Service and to meet legal obligations. The only recipients of document content are the AI providers in section 4.2 and the infrastructure providers in section 5. Their written agreements, the notices of IRC §§6713 and 7216, and confirmation that all processing of document content takes place in the United States are [Pending review]. We do not use tax return information for marketing, analytics or model training, and we do not produce or sell statistics from it. We make no use or disclosure that would require a taxpayer consent; how such a consent would be obtained, if it is ever needed, is [Pending review].

5. Service providers (subprocessors)

We will update this table before adding a provider that handles your information.

6. Retention summary

7. Security

• All traffic to the Service is encrypted in transit (HTTPS). The MCP server's requests to the extraction backend are signed with a shared secret.
• The database tables that hold wallet, ledger and settlement metadata are reachable only by our service role; row-level security is enabled on every table and the anonymous and authenticated roles have no access.
• The Service holds no keys to your wallet and no card data. A compromise of the Service cannot spend from your wallet: a payment authorization is signed by your agent for one exact amount, has a short validity window, and can be settled at most once.
• TaxClaw's signing keys, and the wallet that pays for anchoring transactions, are ours; how they are held is [Pending review]. A compromised signing key could let someone forge receipts; it could not expose documents, extracted values or your wallet.
• Document content is never written to our database or logs, and extracted values are written to our database only as job results kept for at most 1 hour, so a log compromise would not expose them.
• A written information security program designed to meet the FTC Safeguards Rule (16 CFR Part 314) and the IRS's guidance for tax professionals (Publication 4557) is [Pending review].
• No system is perfectly secure. If a security incident results in unauthorized access to your information, we will notify the relevant authorities as applicable law requires and give notice to affected users by the means available to us. Because we hold no contact information, individual notice may not be possible; we will post notice at https://mcp.taxclaw.net/privacy. Other notice mechanisms and state breach-notification duties are [Pending review].

8. Your choices and controls

8.1 Before you send

Send only the documents you need extracted. The less you send, the less there is to protect. You may redact identifiers yourself before sending, or set redact_identifiers (section 4.5). For maximum privacy, the open-source TaxClaw core runs entirely on your own machine in its local mode and transmits nothing.

8.2 Your wallet

Your wallet is yours; we never control it. Because a wallet address is public and can be linked to you, you may prefer to have your agent use a wallet kept only for agent payments. Anyone who controls the wallet's key can claim its free pages and pay from it; keep the key secure.

8.3 There is no account to close

We hold no account, no email and no profile for you. To stop using the Service, stop using it. The wallet, ledger, settlement and tax records in sections 2.3–2.5 are kept for the periods in section 6, and then deleted.

8.4 Documents and results

We hold no copy of your documents, and no job result after 1 hour. Your copies, and the copies held by your agent, your accountant or your tax software, are under your control. Receipt digests are hashes and cannot be reversed into your documents or values. A batch root that has been published on-chain cannot be deleted by us or by anyone else (section 2.6).

8.5 Access, correction and other requests

For a copy of the records we hold for a wallet, or any other privacy request, email lando@outbranch.net. Because the only identifier we hold is a wallet address, we will ask you to prove control of that wallet before releasing anything; the verification method is [Pending review]. See also section 11.

9. Your agent, your MCP client, and other parties

You use the Service through an AI agent or MCP client that you choose and configure. That software:

• holds your documents before it sends them to us, and holds the results after we return them;
• holds, or has access to, the wallet it pays from and claims free pages with;
• decides what to send, including whether to set redact_identifiers;
• is governed by its own provider's privacy terms and usage policies, which may restrict what it may send to a connected service;
• is outside our control. We cannot see, delete or change anything it stores.

Under our Terms of Service, your agent acts on your behalf, and anyone who submits documents on behalf of a taxpayer must be authorized to do so.

10. Children's privacy

The Service is not directed at children under 13 and is intended for use by adults managing tax documents. We do not knowingly collect information from anyone under 13. If you believe a child is using the Service, email lando@outbranch.net.

11. Regional privacy rights

Rights under California (CCPA/CPRA) and other US state privacy laws, and under GDPR or UK GDPR if the Service is offered outside the United States, are [Pending review]. Whether the Service is offered outside the United States at all is also [Pending review] (Terms of Service section 3.4).

12. The taxclaw.net website

This section is the privacy notice for the taxclaw.net website, which is separate from the Service. [Pending review]

The site is a simple marketing page. We do not run third-party trackers by default. We collect no data intentionally. Like most websites, our hosting provider may record basic request logs (for example IP address and user agent) for security and reliability. Any contact form or affiliate link on the site is governed by the third-party service it uses, and is disclosed where it appears. The open-source TaxClaw core is local-first: in local mode, nothing leaves your machine; see its Privacy Policy. TaxClaw Cloud is covered by sections 1–11 of this policy.

13. Changes to this policy

If we make material changes to this policy (for example, adding an AI provider to section 4 or changing a retention period) we will update the "Last updated" date and post the updated policy at https://mcp.taxclaw.net/privacy. We hold no contact details and cannot notify you individually; how agents will be able to detect a change is [Pending review]. Your agent should check for changes before each use.

14. Contact

Outbranch Network LLC

• Email: lando@outbranch.net
• Postal: [Pending review]
• Open-source core: https://github.com/DougButdorf/TaxClaw

We will respond to privacy inquiries within a reasonable time.