Privacy Policy

KKATC is owned and operated by KKATC LLC, a New York limited liability company, located at 418 Broadway #12350, Albany, NY 12207. We operate kkatc.com and these services: KKATC Cards (record-keeping and tax-organizing software for card sellers, including the Docket and an opt-in points board) and its affiliate program; planning sessions with Konstantin Koretskiy, which can include tax return preparation, and the KKATC client portal that supports them; KKATC Watchdog; the free tiers of KKATC Tax, KKATC Copy and KKATC Content (their paid plans are no longer sold); the KKATC Real Estate question tool; and waitlists for products not yet offered.

KKATC Tax Foundation and KKATC Audit have been discontinued. This policy continues to govern any data collected while those tools operated; questions can be directed to legal@kkatc.com.

We collect the following categories of information:

• Email addresses voluntarily submitted through waitlist, subscription, or contact forms
• Questions and prompts submitted to our AI tools
• IP addresses, for rate limiting and abuse prevention, and recorded with giveaway entries, e-signatures in the client portal and affiliate W-9 submissions
• The state you select or name in a KKATC Tax free-tier question, kept with that question's audit record
• Usage data, including pages visited and referral sources, via Vercel Analytics; since 9 October 2026 the query string and fragment of each page address (and the code in a sticker link) are removed before the visit is sent
• Payment information processed by Stripe (we do not store card numbers; we store the card fingerprint Stripe reports and, for a wallet payment, the wallet's last four digits, to recognise a card used again and to handle disputes, for 3 years)
• Audit log data: questions submitted to KKATC Tax (and, historically, to discontinued KKATC tools) and truncated answer previews, retained for internal quality assurance and accuracy monitoring (see Section 6)
• KKATC Cards user data: card inventory, sales log, expense records, grading submission batches, trips and vehicles, consignor and partner names and contact details you enter, Docket messages and drafts, points and check-ins, your points-board display name if you join it, passkeys, and sign-in session records (with the browser and device type), entered by or kept for authenticated users, stored in Upstash Redis under the cards:{email}:* namespace and retained until the user requests deletion; a lapsed subscription does not delete it
• Affiliate program: your name, email, audience notes, and the Form W-9 you give us (legal name, address, tax classification, and Social Security number or EIN), with your payout handle; tax IDs and payout handles are encrypted at rest, and we log the IP address a W-9 was sent from (newest 500 entries). If a customer signed up through your link, we keep their email address with your referral record.
• Planning sessions and the client portal: your intake answers, the tax documents you upload (stored in Vercel Blob), plans and analyses prepared for you, the documents you sign, and, for each signature, your typed name, IP address and browser details.
• Other forms: KKATC Watchdog submissions (the AI tool, your question, the AI answer you report, your business type, a screenshot link, and your email if you give it); correction reports (the name and credential you enter); waitlist sign-ups (for the creator-tax waitlist, also your platforms and income range); and entries made in the pack-rip giveaway while it ran (email and IP address).
• Referral links: when you arrive through an affiliate's link, a click id is stored in your browser (until you clear it) and on our servers for 30 days, so the referral can be credited if you sign up.

Except as described for KKATC Cards below (Section 4B), for the affiliate program's Form W-9, and for the tax documents you upload to the client portal, our AI question-and-answer tools do not collect sensitive personal information such as Social Security numbers, financial account details, EIN or tax identification numbers, organization EINs, or government-issued ID numbers, and you should not submit such information in any AI prompt. KKATC Cards is record-keeping and tax-organizing software for card sellers: it does collect an entity EIN and, optionally, owner Social Security numbers, which are encrypted at rest as described in Section 4B.

We use collected information to:

• Provide and operate our Services
• Enforce usage limits and prevent abuse
• Monitor answer quality and accuracy through internal audit logging for KKATC Tax
• Send transactional emails related to your use of our Services
• Respond to inquiries submitted to contact@kkatc.com, support@kkatc.com, or legal@kkatc.com
• Analyze aggregate usage patterns to improve our Services
• Send the KKATC Cards monthly summary email (you can turn it off), credit affiliates for referrals and pay commissions, and run the opt-in points board
• Comply with legal obligations

We do not sell your personal information to third parties. We do not use your information for targeted advertising. KKATC products are ad-free.

The KKATC Tax question tools (including KKATC Real Estate) screen each question before it reaches our AI systems. The screen looks for common formats of Social Security numbers, EINs, credit card numbers, bank account and routing numbers, dates of birth, driver's license numbers, phone numbers, email addresses and large account balances. A question is rejected when it contains a Social Security number, an EIN, a credit card number or a labelled account or routing number, or several of the other items together. One of the other items on its own (for example a date of birth or a driver's license number) does not cause a rejection: it is replaced with a placeholder before the question is sent to our AI systems or kept in an audit record. The screen does not look for passport numbers and can miss formats it does not recognize, so do not include personal identifiers in any question. Any flagged content metadata is auto-deleted within 24 hours via Redis TTL. For quality review, an accepted question is kept in an audit record (its first 300 characters after that replacement, with the first 500 characters of the answer). For KKATC Tax and its related question tools the record expires after 7 days; for KKATC Real Estate and the discontinued KKATC Audit tool, the most recent 1,000 records are kept with no automatic expiry.

This screen governs the KKATC Tax question tools. KKATC Copy, KKATC Content and the client portal's research assistant do not screen what you type. Do not submit personal financial data in any AI prompt; if a question is flagged, you receive an immediate rejection with instructions to rephrase without personal details. It does NOT describe KKATC Cards, record-keeping and tax-organizing software for card sellers that deliberately collects and encrypts certain tax-identification information: see Section 4B for the data practices that apply to KKATC Cards, including how the Docket masks a message before it is read.

Questions and prompts you submit to our AI tools (KKATC Tax, KKATC Copy, KKATC Content; Docket messages in KKATC Cards after redaction, with your earlier Docket corrections; and the client portal's research assistant, which sends your intake profile, including filing status, income sources, dependents, notices, adjusted gross income, tax rates and the planning items and deductions identified for you, with your question) are processed by Anthropic's Claude API. By using our AI tools, you acknowledge that your inputs are transmitted to Anthropic for processing in accordance with Anthropic's privacy policy (anthropic.com/privacy).

Do not submit personally identifiable information, Social Security numbers, employer identification numbers, financial account numbers, tax identification numbers, organization names or EINs, donor information, beneficiary information, or other sensitive personal, organizational, or financial data in your prompts. Our AI question tools are designed for general educational use and do not require sensitive personal or organizational data to function; the client portal's research assistant is the exception, because it answers from your own intake profile. KKATC is not responsible for any sensitive information you voluntarily include in a prompt. (This section concerns free-text AI prompts. Information you enter into the structured fields of the KKATC Cards application, including an entity EIN and optional owner SSNs, is handled under Section 4B, not this section.)

When you book a planning session, you enter your name and email address on Calendly's booking page (calendly.com), which handles scheduling; any deposit is taken by Stripe (stripe.com). KKATC does not store booking data beyond what is necessary for service delivery, and does not record the planning-session call. If you become a client, the KKATC client portal stores your intake answers, the documents you upload, plans and analyses prepared for you, and the documents you sign, until you ask us to delete them (write to founder@kkatc.com); see Section 2 for signature records. The portal's research assistant sends your question and your intake profile to Anthropic (Section 4).

KKATC Cards is record-keeping and tax-organizing software for card sellers. Unlike our AI question-and-answer tools, it deliberately collects and stores certain financial and tax-identification information to build Schedule C, Schedule E, and Schedule K-1 workpapers. The practices in this Section 4B are specific to KKATC Cards and control over any general statement elsewhere in this policy.

What we collect

• Name and email address for your account
• Financial records: card purchases, sales, cost basis, and business expenses you enter
• Entity information: business name and Employer Identification Number (EIN), encrypted with AES-256-GCM at rest
• Owner and partner information for multi-owner entities: name, ownership percentage, state of residence, and — only if you choose to provide it — Social Security number, encrypted with AES-256-GCM at rest
• eBay OAuth access and refresh tokens, if you connect an eBay account, stored in our encrypted database and scoped to your account only. These tokens are retained until you disconnect your eBay account or delete your KKATC Cards account. You can disconnect at any time from the eBay tab. If eBay tells us that you closed your eBay account, we delete these tokens, the eBay username we keep for your connection and our eBay sync records, and mark your eBay connection as disconnected. The sales you recorded are kept, because they are your own tax records. We keep a short record that this was done, naming the eBay account only by a one-way code, for 7 days.
• Payment information processed by Stripe; KKATC never sees or stores your payment card numbers
• Docket messages: when you use the Docket, the message you type is redacted (email addresses, phone numbers, SSNs, card numbers and street addresses are masked; names are not masked), sent to Anthropic for reading, and kept with the draft it produced, what the Docket read from it, and what you confirmed or rejected (cards:{email}:assistant_drafts). A draft is the record of what you were asked and what you chose, so drafts are not deleted on a schedule: a draft you do not act on is marked out of date after 30 days and is not deleted. Your assistant_drafts are erased with your KKATC Cards data when you delete your account.
• Docket corrections: when you correct a draft, the Docket remembers the correction (your newest 500, kept until you delete your account) and sends similar past corrections to Anthropic with new messages; replies are cached for 30 days.
• Connected services: if you connect eBay, we read your eBay orders and listings and can create listings you ask for; card details (and card images, when that feature is switched on) are sent to Ximilar for recognition and pricing; and an AI assistant you authorize through KKATC's MCP connection can read your KKATC Cards records.
• Points board: if you join it, the display name you choose is shown to other KKATC Cards users; names are checked against reserved words, profanity and contact details, and other users can report a name for review.

How we protect it

• EIN and SSN values are encrypted with AES-256-GCM before they are written to storage; the plaintext is never persisted
• Plaintext PII is never written to application logs or error messages
• eBay tokens are stored per user and are never shared across accounts
• All data is transmitted over HTTPS

Your rights

• You may delete your account and its KKATC Cards data at any time, in Settings or at kkatc.com/cards/delete-account; that page lists what is kept after a deletion, and why
• For privacy requests, contact privacy@kkatc.com

What we do not do

• We never sell your financial data to third parties
• We never use your tax records for advertising

KKATC does not use artificial intelligence (AI) tools on your tax information. Your return is prepared by your preparer using tax software, and every return is reviewed and signed by your preparer. If this ever changes, we will tell you first and ask for your written consent where the law requires it.

We use the following third-party services to operate our platform:

• Anthropic: AI processing for tool outputs, Docket messages and the client portal's research assistant (anthropic.com/privacy)
• Vercel: hosting, deployment, analytics, and file storage (Vercel Blob: daily KKATC Cards backups, client portal uploads and signed documents) (vercel.com/legal/privacy-policy)
• Stripe — payment processing for subscriptions (stripe.com/privacy)
• Upstash Redis: the database for account records (KKATC Cards, the client portal, the affiliate program, waitlists and forms), rate limiting, ban enforcement, subscription management, and audit logs (upstash.com/privacy)
• Resend — transactional email delivery (resend.com/privacy)
• ImprovMX — email forwarding (improvmx.com/privacy)
• Fonts: served from KKATC's own site, so no outside font service receives your IP address or browser details
• Calendly: planning-session scheduling, and KKATC Tax Desk call scheduling (when a Tax Desk call has to move, we send Calendly your name and email to book the next open time) (calendly.com/privacy)
• eBay: only if you connect your eBay account (Section 4B)
• Ximilar: card recognition and pricing in KKATC Cards
• Product Hunt and PostYourStartup: badge images shown on the /featured page, loaded by your browser, so those sites receive your IP address and browser details

Each third-party service operates under its own privacy policy. We encourage you to review those policies. We are not responsible for the privacy practices of third-party services.

We retain data as follows:

• Email addresses submitted through waitlist or contact forms — retained until you request deletion
• Questions and answer previews logged through our internal audit system (KKATC Tax, plus historical logs from discontinued KKATC tools) — retained for 7 days on a rolling basis in Upstash Redis; KKATC Real Estate question logs (the real-estate:log Redis key) and historical audit-explainer logs (the audit:log Redis key) keep the most recent 1,000 entries each, with no automatic expiry; cumulative usage totals are tracked under counter:au:total (retained indefinitely, non-identifying aggregate count only)
• KKATC Cards user data (every cards:{email}:* record, including inventory, sales, expenses, submissions, trips, Docket drafts and corrections, points and passkeys): retained until you delete your account; a lapsed plan does not delete it
• Kept after you delete your KKATC Cards account (the same list the deletion page, the deletion screen and the deletion's confirmation email show):
  • Your activity log: the record of what changed in your book, with the earlier values of your records and the entry for this deletion (the newest 5,000 entries, under a key that contains your email address): kept; no end date is set. It is the evidence record of your tax figures, and the record that the deletion happened.
  • Daily backups taken before the deletion, which hold a copy of your records: kept; no end date is set, because old backups are not yet deleted on a schedule. For disaster recovery.
  • Payment dispute records: kept 18 months from the dispute, then deleted. To answer a card dispute; keyed by the payment processor's customer id, with no email address.
  • Fraud-prevention records: a payment card's fingerprint seen on more than one account: kept 3 years from each entry, then deleted. To prevent abuse of one-time offers.
  • Billing review entries about your account (refunds, disputes, renewals that failed, and payments that could not be matched): kept 3 years from each entry, then deleted. So billing events can be checked by hand; at the deletion your email address in them is replaced by the payment processor's customer id.
  • If you signed up through a referral link: the affiliate program's record of your email address: kept; no end date is set. It is how a referral and its commission are recorded.
  • A sign-out marker for your email address (when every session was ended; no other content): two days, then it expires. So that no session from before the deletion can be used.
  • Payment records at Stripe: kept by Stripe under its own retention policy. Stripe processed your payments; deleting your KKATC account does not delete Stripe's records.
• Client portal records, affiliate records, waitlist sign-ups, Watchdog submissions, correction reports and giveaway entries: kept with no automatic expiry; there is no self-serve deletion for these, so write to support@kkatc.com (or founder@kkatc.com for the portal) to have them deleted
• KKATC Cards sign-in sessions (other sign-ins: KKATC Tax 30 days; client portal and affiliate dashboard 24 hours): a sign-in session expires after 30 days without use, is stored only as a one-way hash of its token, and ends at once when you sign out, sign out everywhere, remove a passkey, or delete your account
• Your financial data is backed up daily to secure storage and the backups are used only for disaster recovery. Backups currently have no automatic expiry, so a backup taken before you delete your account still holds that data.
• IP-based rate limit data: retained for up to 25 hours on a rolling basis, depending on the limit
• IP-based ban records — retained indefinitely for abuse prevention
• Analytics data — retained as determined by Vercel's data retention policies
• Payment records — retained by Stripe in accordance with their data retention policies

Depending on your jurisdiction, you may have the right to:

• Request access to personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your information
• Opt out of marketing communications

To exercise these rights, contact legal@kkatc.com. We will respond within 30 days.

California residents may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to delete personal information, and the right to opt out of the sale of personal information. KKATC does not sell personal information. To exercise CCPA rights, contact legal@kkatc.com.

KKATC is a New York business and complies with the New York SHIELD Act. In the event of a data breach affecting the private information of New York residents, KKATC will provide notice to affected individuals and, where required, to the New York Attorney General, in accordance with the SHIELD Act's notification requirements.

Our site uses minimal tracking. Vercel Analytics collects anonymized usage data without personally identifiable information. We do not use advertising cookies or third-party tracking pixels, and we do not serve advertisements. Pages do load fonts and badge images from other sites (Section 5), which receive your IP address. Signing in sets one HttpOnly cookie for the product you sign in to (KKATC Cards: 30 days from last use; KKATC Tax: 30 days; client portal and affiliate dashboard: 24 hours). Your browser also keeps a few settings in local storage: that you are signed in to KKATC Cards, your display preferences, that you accepted the site's terms notice, a referral click id, and, on some free tax tools, the email you entered.

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, contact legal@kkatc.com immediately and we will take prompt steps to delete such information.

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last Updated" date at the top of this page. Continued use of our Services after changes constitutes acceptance of the revised policy.

For privacy-related inquiries or to exercise your rights:

KKATC LLC
418 Broadway #12350
Albany, NY 12207
legal@kkatc.com