Legal
Privacy Policy
Effective and last updated: October 17, 2026
Ledger & Grid prepares tax returns, so we handle some of the most sensitive information people have: Social Security numbers, income, bank accounts and family details. This policy explains what we collect, why, who can see it, how we protect it and what you can do about it. It applies to our website, the client portal and our messages with you. It is also our consumer privacy notice under the Gramm-Leach-Bliley Act and our notice at collection under California law.
Who we are
Ledger and Grid LLC ("we", "us"), doing business as Ledger & Grid, is a California limited liability company. We prepare and file federal and state tax returns for individuals and businesses in all 50 states and the District of Columbia.
- Legal name: Ledger and Grid LLC
- Website: https://ledgerandgrid.com
- Mail: 631 Vineyards Ct, Galt, CA 95632
- Phone: +1 (209) 200-2098
- Email: [email protected]
Because we prepare tax returns, the federal Gramm-Leach-Bliley Act treats us as a financial institution. We follow the Federal Trade Commission's Privacy Rule and Safeguards Rule, Internal Revenue Code §7216, and the IRS rules that apply to tax return preparers.
Notice at collection
California law requires us to tell you, at or before we collect personal information, what we collect, why, whether we sell or share it, and how long we keep it. This section is that notice. The rest of this policy gives the detail.
- We collect identifiers, customer records, tax and income details, account sign-in data, and the other categories listed under California residents.
- We collect it to prepare and file your return, run your account, keep it secure, talk with you about your return, and meet legal recordkeeping rules. We do not collect it for advertising.
- We do not sell personal information and we do not share it for cross-context behavioral advertising.
- We use sensitive personal information (Social Security numbers, government ID, account logins and bank account numbers) only to provide the tax service, to keep the account secure, and as the law requires. We do not use it to infer characteristics about you.
- We keep returns and supporting documents for seven years after filing, then delete them, unless a longer period is required. Other retention periods are under How long we keep it.
If you do not want us to collect this information, do not create an account or upload documents. We cannot prepare a tax return without it.
Information we collect
Information you give us
- Account details: your name, email, mobile phone, mailing address, password and the way you prefer us to contact you. We store your password only in a protected form that can't be read back.
- Identity details: your Social Security number or ITIN, date of birth and, when we confirm your identity before you sign, your photo ID.
- People on your return: names, dates of birth and Social Security numbers of your spouse and dependents, when they belong on your return.
- Your answers: the tax year, your state and your answers about your work, income, home and family in that year.
- Your documents: files you upload, such as W-2s, 1099s, 1098s, last year's return, bank and brokerage statements, and business records.
- Bank details: the account and routing number you give us for a direct-deposit refund or a payment to a tax agency.
- Business details: for business returns, the business name, EIN, owners, and financial records.
- Messages: what you and our team send each other in the portal, by email, by text or by phone.
- Signatures: your electronic signature on your e-file authorization (IRS Form 8879 and state forms).
Information we collect automatically
- Sign-in and security data: sign-in times, IP address, browser and device type, and failed sign-in attempts.
- Portal activity: which documents were uploaded, viewed or changed, and by whom. We keep this record to protect your file.
Information from others
- Identity verification: our verification partner tells us whether your identity check passed. If the check compares a photo of you with your ID, the partner does that comparison. We receive the result, not a face template.
- Tax agencies: the IRS and state agencies tell us whether your e-filed return was accepted or rejected, and may send notices about it.
- People you authorize: for example, your spouse on a joint return or someone you name as your representative.
How we use it
- To prepare, review, sign and e-file your federal and state returns.
- To decide which documents your return needs and to answer your questions about it.
- To confirm your identity before you sign and to prevent identity theft and tax fraud.
- To show the status of your return and send you updates you asked for.
- To help you if you get a notice from a tax agency about a return we prepared.
- To keep the portal secure, investigate problems and keep records the law requires.
- After the launch offer ends, to bill you for services you agreed to.
We use sensitive information, such as your Social Security number, ID and bank details, only for these purposes. We don't use it to learn things about you that have nothing to do with your return.
Your tax return information
Section 7216 of the Internal Revenue Code and its regulations protect the information you give us to prepare your return. We use and share that information only to prepare and file your return, and as the law otherwise allows.
If we ever want to use or share your tax return information for any other purpose, we will ask you first, on a separate consent form that explains exactly what we want to do. You don't have to agree. Saying no doesn't change the service we give you.
No selling, no ads
We don't sell your personal information. We don't share it for cross-context behavioral advertising, and we don't show ads in the portal. We don't share your information with other companies for their own marketing.
Emails, texts and WhatsApp
We email you about your account and your return, such as confirmation codes, requests for documents and when your return is filed. These emails are part of the service.
Texts and WhatsApp messages are optional. Consent to texts is not a condition of the tax service. If you turn them on, we send them only about your account and your return, from Ledger and Grid LLC.
- How often: only when something about your return needs your attention, or for sign-in codes. We do not send marketing texts.
- Message and data rates may apply. Carriers are not liable for delayed or undelivered messages.
- Reply STOP to stop texts at any time, or HELP for help. You can also turn texts off in your account settings, email [email protected], or call +1 (209) 200-2098. Full program terms: Text message terms.
- We don't share your phone number with anyone for their marketing.
We will never ask you for your password, a sign-in code or a payment by text, email or phone call.
How we protect it
We keep a written information security program, as the FTC Safeguards Rule requires, and follow IRS guidance for tax professionals (Publication 4557). It includes:
- encryption of your information in transit and in storage;
- two-step sign-in for client accounts, and required two-step sign-in for our staff;
- an identity check before you sign your return;
- access limited to the people who need it, with every access logged;
- background checks, confidentiality agreements and security training for our team;
- a plan to respond to security incidents.
No system is perfectly secure. If a security breach affects your information, we will notify you and the authorities as the law requires. You can help by using a strong, unique password and turning on two-step sign-in.
How long we keep it
- Returns and supporting documents: seven years after the return is filed, then we delete them. Federal law requires preparers to keep a copy or record of each return for at least three years.
- Messages and activity records: as long as the return they belong to.
- Sign-in and security logs: up to two years.
- Accounts with no submitted return: deleted after two years without activity.
If you ask us to delete your account, we delete what we can right away and keep only what the law requires, for as long as it requires.
Your choices and rights
Wherever you live, you can ask us to:
- tell you what personal information we have about you and how we use it;
- give you a copy of your information and documents;
- correct information that's wrong;
- delete your information, unless the law requires us to keep it.
To make a request, write to us using the contact details below. We will confirm your identity before we act, usually by asking you to sign in or to confirm details we already have. You can let someone act for you if you give them written permission. We will answer within 45 days. If we need more time, we will tell you why.
We will not charge you more or treat you differently for using these rights.
California residents
The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives California residents the rights listed above, plus the right to opt out of the sale or sharing of personal information and to limit the use of sensitive personal information. We don't sell or share personal information, and we use sensitive personal information only for the purposes the law allows, so there is nothing you need to opt out of.
Some of the information we handle is also covered by the Gramm-Leach-Bliley Act. We still honor your requests for it under this policy.
In the past 12 months we collected the following categories of personal information:
| Category | Examples | Why we collect it | Who we disclose it to |
|---|---|---|---|
| Identifiers | Name, email, phone, address, Social Security number or ITIN, IP address | Preparing your return, your account, security | Our team, tax agencies, service providers |
| Customer records | Bank account and routing number, signature, photo ID | Refunds and payments, e-file authorization, identity check | Our team, tax agencies, service providers |
| Protected characteristics | Age, date of birth, marital status, dependents | Required on your return | Our team, tax agencies |
| Commercial information | Tax years and services you asked for, payment records | Providing and billing the service | Our team, service providers |
| Employment and income | Employers, wages, business income and expenses | Preparing your return | Our team, tax agencies |
| Network activity | Sign-in times, device and browser, portal activity | Security and fraud prevention | Our team, service providers |
| Sensitive personal information | Social Security number, ID, bank account numbers, account sign-in | Preparing and filing your return, security | Our team, tax agencies, service providers |
We don't collect precise location data or biometric information. We have not sold or shared personal information in the preceding 12 months. We do not offer financial incentives, loyalty programs or payments in exchange for personal information.
Under California's "Shine the Light" law (Civil Code §1798.83), you can ask whether we disclosed your information to others for their direct marketing. We don't. To make that request, email [email protected] with the subject line "Shine the Light".
You may designate an authorized agent to make a privacy request for you. We will need signed permission from you, and we may still need to verify your identity. We will not discriminate against you for exercising these rights.
Your privacy choices
We do not sell your personal information and we do not share it for cross-context behavioral advertising. There is no "Do Not Sell or Share My Personal Information" opt-out to turn on, because that activity does not happen.
We already limit sensitive personal information to the uses listed in this policy. If we ever used it for extra purposes, we would give you a way to limit that use.
If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request not to sell or share. That matches what we already do.
To ask for a copy, a correction or deletion, email [email protected] with the subject line "Privacy request", or write to us at the address below. We will verify your identity before we act.
Job applicants
If you apply on our careers page, we collect the information you send: name, email, phone, credential, experience, the kinds of returns you prepare, languages, a profile link if you give one, and your note. We use it only to review your application and, if we hire you, to set up your work account.
We do not sell applicant information. We share it only with the people on our team who review applications, and with service providers who host the site. If we do not hire you, we keep the application up to three years (the period California employment-record rules commonly require), then delete it. If we hire you, we keep it with your personnel records as the law requires.
California applicants have the same CCPA/CPRA rights described above, including the right to know, correct and delete, subject to legal recordkeeping. To make a request, email [email protected] with the subject line "Applicant privacy".
Residents of other states
Several states, including Colorado, Connecticut, Oregon, Texas and Virginia, give residents privacy rights similar to the ones above. We offer the same rights to everyone. If we turn down your request, you can appeal by replying to our answer. We will respond to your appeal within the time your state's law requires. If you are not satisfied, you can contact your state attorney general.
Children
Accounts are for people 18 and older. We don't knowingly collect information directly from children. When a child is your dependent, we collect the details your return needs from you, the parent or guardian.
Changes to this policy
If we change this policy, we will update the date at the top. If a change affects how we use or share your information, we will email you before it takes effect, and ask for your consent where the law requires it.
Contact us
- Email: [email protected]
- Phone: +1 (209) 200-2098
- Mail: Ledger and Grid LLC, Attn: Privacy, 631 Vineyards Ct, Galt, CA 95632
If you think someone used your information to file a tax return, also see the IRS identity theft page at irs.gov/identitytheft.