Sharpe CPA / Privacy
What we collect through this website and the client portal, why, who we share it with, how long we keep it, and the rights you have under California law.
Effective date: August 22, 2026 · Last updated: August 22, 2026
This website and the client portal at sharpecpa.com/portal are
operated by James D. Sharpe, Certified Public Accountant
("Sharpe CPA," "we," "us," or "our"), licensed by the California Board of
Accountancy, CPA License #38745.
We provide tax preparation and planning, accounting and financial statement work, governmental finance advisory work, and accounting software offered on subscription and as downloads. We do not currently perform attest engagements.
Information reaches us in three ways, and it is worth separating them, because different law applies to each.
This policy covers all three. Engagement information is subject to additional restrictions under federal tax law and the rules of the accounting profession, described in section 11, which limit what we may do with it beyond anything this policy permits.
This policy does not cover information you give to a third party directly, or the practices of any website we link to.
The table below lists the categories of personal information we have collected in the preceding twelve months, using the category names defined in the California Consumer Privacy Act, with where each comes from, why we collect it, and how long we keep it.
| Category | What this means for us | Where it comes from | Why we collect it | How long we keep it |
|---|---|---|---|---|
| Identifiers | Name, business name, postal and email address, telephone and mobile number, portal username, IP address | You, directly; your web browser | To identify you, correspond with you, operate your account and send the alerts you have asked for | For the life of the relationship and then with the engagement records below |
| Customer records (Cal. Civ. Code § 1798.80) | Billing address, the fact and amount of a payment, subscription status | You; our payment processor | To bill you, collect payment and keep our own books | Seven years, as our accounting records |
| Commercial information | Which applications you subscribe to, what you have downloaded, the services engaged | You; our own records | To provide what you have subscribed to and support it | Seven years |
| Internet activity | Pages requested, date and time, browser and operating system, referring page; and, inside the portal, a log of every sign-in, upload, download, share and failed attempt | Your browser; our servers | To keep the site working and to detect and investigate misuse of an account | Web server logs, typically 12 months. Portal activity log, for the life of the account — it is a security record |
| Professional or employment information | Occupation, employer, licence or firm details for CPAs who open an account | You, directly | To know who we are dealing with and what an application should show them | For the life of the account |
| Sensitive personal information | Social Security and other taxpayer identification numbers, financial account numbers, and the contents of documents you upload — appearing in tax and accounting records you send us | You, in the course of an engagement | Solely to perform the engagement and to meet our own legal obligations | Through the federal and California assessment periods that apply to the return — generally at least seven years — and longer where a record supports a position on a later return |
| Inferences | None. We do not build profiles or score anyone | — | — | — |
We do not collect biometric information, precise geolocation, or the contents of your mail, email or text messages other than what you send to us.
A tax return can be examined for as long as the statute of limitations on assessment runs. That is ordinarily three years federally, six where there has been a substantial omission of gross income, four for California, and unlimited where no return was filed or the return was fraudulent. Separately, California law requires audit documentation to be kept for a minimum of seven years. Our general rule is seven years, and files older than that are destroyed.
Two things are held longer, and one is destroyed sooner:
We review this schedule at least once a year and securely destroy records that have passed it. Retention here is a decision we revisit, not a habit: anything we cannot give a reason to keep is destroyed.
We do not use engagement information to market anything to you, and we do not use it for any purpose other than the engagement itself except as section 11 describes.
We share personal information only with the following, and only so far as each needs it:
Every client we do tax work for is also covered by a non-disclosure agreement between us.
The only other place a client's information appears publicly is a testimonial, and only where that client has agreed to it in writing. A testimonial identifies someone as a client of this practice, which is itself a disclosure, so we treat it as one: we ask for a written consent that names the use, we show the client the exact wording before it is published, and we remove a testimonial at any time on request, without being asked why. Nobody is paid or given a discount for one, and nothing in a testimonial is written by us on a client's behalf.
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined in California law. We have not done so in the preceding twelve months. There is nothing here to opt out of, which is why you will not find a "Do Not Sell or Share My Personal Information" link on this site.
Tax and accounting work cannot be done without sensitive information. We collect it only to perform the engagement, to bill for it, and to meet our own legal obligations — all of which are purposes for which California law does not permit a limitation request. We do not use or disclose it to infer anything about you.
The public pages of this site set no advertising or analytics cookies. The portal sets one strictly necessary session cookie, which identifies your signed-in session and nothing else; it is marked HttpOnly and SameSite, is sent only over an encrypted connection, and is discarded when you sign out or the session times out.
We honour a Global Privacy Control signal. Since we do not sell or share personal information, the signal has nothing to act on, but it is respected all the same.
If you are a California resident you have the right to:
One limit worth stating plainly. A request to delete cannot reach records we are required to keep. Tax return information, workpapers and audit documentation are subject to retention requirements under federal and California law and under our professional standards, and we will keep those for the periods stated in section 3 even after a deletion request. We will tell you exactly what we kept and why.
Call (530) 592-5046 or email tax@sharpecpa.com with "Privacy request" in the subject line. Both reach the same person.
We will verify who you are before we act, in proportion to what is being asked — more carefully for a copy of tax records than for a correction to a mailing address. If you have a portal account, signing in is part of that verification. We will confirm receipt within ten business days and respond within forty-five calendar days, extending once by another forty-five where the request is complex, in which case we will tell you before the first period runs out.
An authorised agent may act for you with written permission signed by you, and we may still ask you to confirm it directly.
Three separate obligations sit on top of ordinary privacy law here, and we would rather set them out than leave them implied.
We do not use or disclose your tax return information for any purpose other than preparing and filing your returns, except with your written consent or where a specific regulation permits it. That is the rule under IRC § 7216 and Treasury Regulation § 301.7216, and it carries criminal penalties. Where a consent is required, we will ask you for one that names the recipient and the specific purpose, in the form the regulation requires, and you are free to decline — declining does not affect the work we do for you.
As a CPA we are bound by the AICPA Code of Professional Conduct § 1.700.001 and the corresponding California rules, which prohibit disclosing confidential client information without your specific consent, subject to narrow exceptions for a validly issued subpoena or summons, a peer review, and an inquiry by a professional or regulatory body. Those obligations survive the end of an engagement, and they survive this policy: where this policy and the professional rules differ, the stricter of the two governs.
Some of what we hold is also subject to the federal Gramm-Leach-Bliley Act. We maintain a written information security program consistent with the FTC Safeguards Rule (16 C.F.R. Part 314) and IRS Publication 4557, covering the whole practice regardless of how any particular record is classified. Where the Act applies to a record, California law treats it differently from ordinary website data — but that does not reduce what we have committed to here. We will honour a verifiable request about any information we hold, subject only to the retention limits in section 9, and it does not affect your rights in the event of a breach under Cal. Civ. Code § 1798.150.
This is a small practice, and its security comes from keeping the number of places your information can be rather than from a large apparatus.
The portal was written here rather than bought, so we can be specific about it:
Where text alerts are switched on, please note that text messages travel unencrypted through the messaging provider and the mobile carriers. We set the level of detail in those messages deliberately for that reason, and they never carry document contents.
No method of transmission or storage is perfectly secure, and we do not claim otherwise.
Subscriptions are billed through a third-party payment processor. Card numbers are entered on the processor's own hosted page and never reach our server — we never see them, store them, or have any ability to retrieve them. What comes back to us is the fact of a payment, its amount and date, and the last four digits and card brand for your reference. The processor handles that information as an independent business under its own privacy policy.
Our services are directed to businesses, to accounting professionals, and to adults. We do not knowingly collect personal information from anyone under sixteen years of age, and we do not sell or share the personal information of minors, because we do not sell or share anyone's. If you believe a child has provided us information, contact us and we will delete it.
A dependent's information appearing in a parent's tax return is engagement information belonging to that engagement, and is handled under section 11.
This site links to other websites, including taxing authority pages, the California Board of Accountancy, and our own separate service at taxtraks.net. We do not control those sites and are not responsible for their privacy practices. Their policies govern once you leave ours.
We review this policy at least once every twelve months and update it whenever our practices change. When we do, the revised version is posted at this address and the "Last updated" date at the top changes. If the changes are material — meaning they meaningfully affect how we collect, use or disclose personal information — we will say so prominently on this page for at least thirty days and notify anyone with an active portal account. We will not use information we have already collected for a materially different purpose without telling you first and obtaining your consent.
For any question about this policy, or to exercise a privacy right:
James D. Sharpe, CPA
California CPA License #38745
Telephone: (530) 592-5046
Email: tax@sharpecpa.com
This policy is provided in an accessible, printable format. If you need it in an alternative format, call the number above and we will provide one.