Privacy Policy

Effective October 28, 2026

This Privacy Policy describes how Lunar Papers, LLC, a Florida limited liability company ("Lunar Papers," "we," "us," or "our"), collects, uses, discloses, and protects information in connection with the website at lunarpapers.com and the services offered through it (together, the "Service"). The Service is offered to accounting and tax practices (each, a "Firm") and not to consumers. By creating an account or using the Service, the Firm and its users agree to this Privacy Policy.

1. Information We Collect

(a) Account information. The name of the Firm, the names and credentials of its preparers and reviewers, work email addresses, passwords (stored only as salted hashes), and, where a Firm signs in through Google or Microsoft, the name, email address, and account identifier those providers furnish.

(b) Firm settings. The Firm's signature block, workpaper conventions, tax software, and related preferences the Firm chooses to provide.

(c) Engagement documents. The prior-year returns, source documents, client books, prepared returns, screenshots, notes, and other materials the Firm uploads for an engagement ("Engagement Documents"). Engagement Documents routinely contain the personal and financial information of the Firm's clients, including taxpayer identification numbers.

(d) Work product. The workpaper workbooks, return checks, client request communications, and other outputs the Service generates for the Firm, and the questions and answers exchanged in an engagement's thread.

(e) Usage and audit records. Sign-ins, uploads, downloads, status changes, and similar events, together with timestamps, IP addresses, and browser information, maintained as an audit trail for each Firm.

(f) Free Support Checklist. A visitor who uses the free checklist at lunarpapers.com/checklist provides a name, firm, email address, and optionally the firm's tax software, which we keep as a business contact, together with a prior-year return. The return is processed in memory, transmitted to Anthropic, PBC only to produce the checklist, and not stored by us; the resulting checklist is held in memory for no more than thirty minutes so that it can be displayed, and then discarded. The visitor confirms that it is a tax professional authorized to share the return for the purpose of preparing the client's return.

(g) Cookies. A session cookie that keeps a user signed in, a short-lived cookie used to complete sign-in through Google or Microsoft, for a visitor who arrives through another firm's referral link, a cookie that remembers that link for thirty days, and, for a visitor who arrives from outside the Service (an advertisement, an email, a post, or another website), a cookie that remembers for thirty days the first link or site the visitor came from, so that we can tell which of our own outreach brings Firms to the Service. That cookie is set by us, is read only by us when an account is created, is never shared, and is not used to follow a visitor on other websites. We do not use advertising or cross-site tracking cookies on the Service, and no third-party advertising or analytics code runs on it.

2. How We Use Information

We use information solely to provide, secure, support, and improve the Service: to build and check workpapers for the Firm, to deliver work product, to answer the Firm's questions about an engagement, to authenticate users, to prevent abuse, to bill for the Service, to communicate with the Firm about its account (including occasional emails to a Firm's users about getting started with and using the Service, each of which carries a link that stops them), and to comply with law. We do not sell information, and we do not use Engagement Documents or work product to advertise to anyone. Tax return information is used only to perform the engagement for which the Firm uploaded it; it is not used to improve the Service, to compile statistics, to solicit the Firm's clients, or to train any model. Improvements to the Service are made from account, usage, and audit records only.

3. Automated Processing

The Service prepares workpapers using large language models operated by Anthropic, PBC, accessed through its commercial application programming interface. Under the terms governing that access, Anthropic does not use data submitted through the interface to train its models. Engagement Documents are transmitted to that interface only to the extent necessary to perform the engagement and are not retained by us in any other third-party system. We direct every request to run inference only in the United States (Anthropic's "inference_geo" setting), and Anthropic stores the data it receives in the United States. Under Anthropic's published terms, it deletes inputs and outputs within thirty days by default, may keep content its automated trust-and-safety systems flag for up to two years, and may process data for safety review, product support, or incident response in countries where it or its affiliates operate; we have not obtained a contractual commitment that such access occurs only in the United States.

4. Our Role Under Section 7216

We treat ourselves as a tax return preparer within the meaning of section 7216 of the Internal Revenue Code with respect to all tax return information we receive. A Firm discloses information to us for workpaper computation under Treasury Regulation section 301.7216-2(d)(1), and discloses a prepared or filed return for a Return Comparison only after obtaining its client's written consent, which the Firm confirms in the Service. We use and disclose tax return information only to perform the Service and as that regulation permits. We have given each service provider and each person with access to tax return information the written notice described in Treasury Regulation section 301.7216-2(d)(2), and each is bound by written obligations of confidentiality.

5. Who Can See Engagement Documents

Engagement Documents and work product are stored in a segregated area for each Firm. Within Lunar Papers, access is limited to the personnel who operate and secure the Service, and then only to the extent necessary to maintain the Service or to provide support the Firm requests. Work product is delivered to the Firm directly upon completion and is not reviewed by Lunar Papers before delivery. Engagement Documents are never shared between Firms. Public-facing displays maintained by Moonbot Worldwide show aggregate activity and Firm names only, and never a client's name or any Engagement Document.

6. Service Providers

We rely on a small number of service providers to operate the Service: DigitalOcean, LLC (hosting in the United States); Anthropic, PBC (automated processing, as described above); Resend (email, such as sign-in links and account emails); and Google LLC and Microsoft Corporation (sign-in, if the Firm chooses those methods). Each receives only the information necessary to perform its function and is bound by its own terms to protect it.

7. Retention and Deletion

Engagement Documents, together with the organized copies, working files, and processing logs the Service creates from them, are deleted automatically after an engagement is delivered, on the retention schedule the Firm sets in its settings (thirty days by default; the Firm may choose any period between seven and three hundred sixty-five days). For an engagement that does not complete, the same period runs from the time processing stopped. Work product and the audit trail are retained for the life of the Firm's account so that the Firm can retrieve its workbooks. A Firm may request deletion of its account and all associated data at any time by writing to the address below; we will complete the deletion within thirty days, subject to any retention required by law. Deleted information may remain for up to seven additional days in the encrypted backups and storage snapshots we keep for disaster recovery, after which it is overwritten in the ordinary course; it is not restored or used in the meantime except to recover from a failure of the Service.

8. Security

Information is encrypted in transit using TLS, and Engagement Documents and work product are stored on an encrypted volume. Passwords are stored only as salted hashes. Access to production systems is limited to authorized personnel using key-based authentication. Every access to and action on an engagement is recorded in the audit trail. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security; the Firm should promptly notify us of any suspected unauthorized access to its account. If we determine, or have reason to believe, that a breach of security has affected the Firm's information, we will notify the Firm as required by applicable law and in any event within ten days after that determination, as section 501.171(6) of the Florida Statutes requires of a third-party agent, and will provide the information the Firm reasonably needs to meet its own notification obligations.

9. The Firm's Clients

We have no direct relationship with the Firm's clients. Individuals whose information appears in Engagement Documents should direct any inquiry to the Firm that prepared or is preparing their return. We will assist the Firm in responding to such inquiries as the Firm directs.

10. The Find a CPA Directory

Anyone may search the public directory of tax professionals at lunarpapers.com/find-a-cpa without an account. A person who asks a listed Firm for an introduction gives us his or her name, email address, and, if he or she chooses, a telephone number, postal code, a description of the help sought, and a short message, and agrees that we will send that information to the one Firm he or she selected. We send it to that Firm and a copy to the person; we use it for no other purpose, do not sell it or share it with anyone else, and do not use it for marketing. We ask that no Social Security numbers, tax documents, or other sensitive information be included, and we reject messages that appear to contain a Social Security number. We also record the network address from which the request was sent, to prevent abuse. Introduction requests are retained for two years and then deleted. A person who finds no listed Firm in his or her state may ask to be told when one lists; for that we keep the email address, state, and, if given, postal code and service sought, send one email when a Firm in that state is listed, and then delete the address, or delete it after one year if no Firm lists. We use it for no other purpose. Once a Firm receives a request, the Firm's own privacy practices and professional obligations govern its use of the information. A Firm's listing, including its name, location, services, and contact details, is published by the Firm's choice and may be removed by the Firm at any time.

Taxpayer notification list. A person who asks at lunarpapers.com/for-taxpayers to be told when the taxpayer service opens gives us an email address and a state of residence. We use them only to send that one notice (and, before then, to count interest by state), never share them, and delete the entry after the notice is sent or on request to hello@lunarpapers.com.

11. Children

The Service is intended for use by professionals and is not directed to individuals under eighteen years of age.

12. Changes

We may revise this Privacy Policy from time to time. Material changes will be announced on the Service or by email to the Firm's account address before they take effect. The effective date above reflects the most recent revision.

13. Contact

Questions about this Privacy Policy or about our handling of information may be sent to hello@lunarpapers.com.