header-logo

Privacy Policy

Last Updated: October 15, 2026

When you use Dark Horse CPAs, An Accountancy Corporation (“we,” or “us”) services, you are entrusting us with your information. We understand the gravity of this responsibility and work hard to protect your information and put you in control of it.

This Privacy Policy is designed to aid your understanding of what information we collect, why we collect it, and how you can manage your information, whether through our Services or third-party services (collectively, the “Services”). We encourage you to read the entire Privacy Policy before using our Services. This Privacy Policy describes our practices; it is not a consent form. Where applicable law requires your consent for a particular use or disclosure of your information, we obtain that consent separately and specifically. Your use of the Services is also governed by our Terms of Service.

Categories of Information We Collect

Depending on your relationship with us, we may collect specific categories of information about you. Below is a description of categories of information that we may collect:

  • Client Relationship Information: This includes information that we may request from you or that you voluntarily provide us for our records about you as a client and the services we provide you. This may include your business contact information, background/history, services obtained from us, unique identification numbers, and other information our cloud servers may gather about you to serve you better, such as family members’ names.
  • Personal Identifiers and Demographic Information: This includes state and federally protected classes of individual information, contact information such as your name, phone number, and email, and other types of general information that may be used to identify you, such as your city, state, country, and time zone.
  • Client Financial Services Information: This includes information we may request from you or that you voluntarily provide us as part of financial services that we provide you, such as tax filings. This information may include compensation plans, information necessary for tax filings and other state or federal disclosures, corporate records, investments, and other related information.
  • Tax Return Information: This includes any information you furnish to us, or that we derive, in connection with the preparation of a tax return — including information on the return itself and in supporting schedules and workpapers. Tax return information is subject to additional federal restrictions described under “Tax Return Information” below.
  • Employment Information: This includes any information related to your previous and current employment, such as prior employer(s), compensation, title, and information found on Forms W2 and other related tax documents. Additionally, we may have information for direct deposits, information contained in your resume and cover letter, and any information related to your application or employment at Dark Horse CPAs.
  • Education Information: This includes information such as educational institutions attended, degrees obtained, scholarships awarded, graduation date, school email, and grade point average (GPA). Typically, we have this information because you applied for a position with us.
  • Internet or Network Activities: This includes information we gather when you interact with our websites or systems, such as internet protocol addresses, search history, session IDs, completion of web forms, as well as other site usage information gathered through cookies hosted on our website.
  • Internal Corporate Information: This refers to the information that we may obtain in the normal course of performing our internal business operations. This may include information about our Service Providers and 3rd Party vendors’ employees, business contacts including billing contacts, address and location, and services provided.
  • Location Data: This includes your city, state, country, and time zone.

Business Purposes for Information Use

We may use your categories of information for various business purposes, including:

  • Business Development, Marketing, and Virtual Event Management: This includes activities such as lead generation, marketing campaigns by mail or email or through our website, travel and expense reporting, hosting internal conferences and training for employees, and hosting or sponsoring events for our employees, clients, and the general public.
  • Provision of Services to Clients: This includes activities such as tax preparation and filings, client services and invoicing, outsourced business services, and user registration and access rights monitoring.
  • Compliance with Legal, Professional, and Regulatory Obligations: This includes activities such as corporate insurance management, payroll processing, reporting, and administration, data loss prevention and security monitoring, background screening, professional certifications and ethical compliance, personnel and incident investigations and litigation matters, regulatory and government compliance matters, and government requests and subpoena responses.
  • Client Relationship Management: This includes activities such as client on-/off-boarding and communication outreach, background screening, contract engagement, engagement letters, and other contractual obligations, and event management and registration.
  • Security of Dark Horse CPAs: This includes activities such as mobile device management, physical, technical, and administrative security reviews, network monitoring and online intrusion detection, and digital user registration and access monitoring.
  • Employee Compliance: This includes activities such as credit review and background screening, personnel compensation, travel, and expense reporting and reimbursement, employee insurance, benefits, and leaves of absence, and employee management, lifecycle, and records.
  • Management of Service Providers and Third-Party Vendors: This includes activities such as vendor assessments and security evaluations, vendor agreement negotiations, executions, and implementations, order processing, vendor payment reconciliation, and accounts receivable and payable processing.
  • Internal Business Operations: This includes activities such as strategic enhancements and new service development, systems implementation and support services, day-to-day business operations, and insurance, tax, and payroll preparation and filing.
  • Technology-Assisted Service Delivery: This includes the use of software and internally managed artificial intelligence tools to support research, drafting, document review, data analysis, and quality control in the course of performing services, subject to the restrictions described under “Our Use of Artificial Intelligence” below.

Please note, we use all categories only as permitted by law or as we may notify you. If your consent is required by law, we will obtain your consent prior to the use and/or collection of your information.

Our Sources of Information & How We Collect Information

We collect categories of information via multiple methods:

  • From You or Your Legal Representative or Authorized Agent: We collect your information through emails, over the phone, in-person, electronic files, paper documents, event registration forms, web forms, and employment applications.
  • From Our Clients: We collect your information through emails, over the phone, in-person, electronic files, paper documents, integrations, APIs, file transfer websites, database and data warehouse access, and event registration forms.
  • From Our Business Partners, Service Providers & Third-Party Vendors: We collect your information through email, over the phone, in-person, user account portals, electronic files, paper documents, event sponsorship forms and rosters, web forms, contracts including service agreements and statements of work, and integrations, APIs, file transfer sites.
  • From Our Website Cookies and Your Interaction with Our Website: We collect your information through tracking cookies, marketing cookies, analytic cookies, pixels, and tags.
  • From Publicly Available Sources: We collect your information through social media, websites (such as professional networking sites and online searches), magazines, newspapers, blogs, and other reporting media, online professional forums, white papers, and other peer review publications.
  • From Educational Institutions, Professional & Government Licensing Groups: We collect your information through email, over the phone, in-person, user account portals, paper documents, electronic files, and web forms.

We Combine Information

We combine information we collect from you on the website with information we receive from you in person, by email, or by other means. We also combine information you provide with information we obtain from third parties and service providers.

When We Share Information with Others

On an as-needed basis, we may share all categories of information above with third parties, service providers, and others. We share personal information with vendors who provide services to us. Refer to Categories of Information We Collect to see the types of information that may be relevant to you.

The provisions of this section are subject to the additional federal restrictions described under “Tax Return Information” below. Where those restrictions apply, they control regardless of what this section otherwise permits.

Our service providers are categorized in at least one of the following categories based on the services they provide us:

  • Business operational services (such as payroll processing, recruitment, AR/AP processing, or other like services)
  • Legal, compliance, and advisory services (such as attorneys, financial advisors, and external consultants)
  • Marketing, events, and communications (such as hosted events, newsletters, and email marketing)
  • Telecommunication and mobile services (such as telephone systems and inter-office messaging services)
  • Network, data centers, and infrastructure services (such as internet, intranet, email, software, and cloud servers)
  • Technology and artificial intelligence tools operating within our managed environment under agreements restricting the provider’s use of our data

We require our service providers to protect the information we share with them, to use it only for the purposes for which we engaged them, and not to use it for their own purposes.

We share information with government and regulatory authorities in the course of providing services to you, such as preparation of tax returns. We only share information when required to in order to comply with law or to protect our legal interests. We may share information we collect about you to respond to a court order or subpoena. We may share information in response to a government agency or investigatory body request. This may include sharing information with the U.S. or Canadian governments. We may share information if necessary to prevent physical harm or financial loss. We may share information we collect when we are investigating potential fraud or other illegal activity.

Affiliates

Dark Horse CPAs is affiliated with other entities, including Dark Horse Private Wealth. Where an engagement involves coordination between affiliated entities, we share only the information necessary for that engagement, and only with your authorization where authorization is required. Sharing of tax return information with an affiliate is governed by the rules described under “Tax Return Information” below and requires your separate written consent.

We share information with any successor to all or part of our business. If all or part of our business is sold, we will share information as a part of that transaction. If there is a merger or acquisition, we will also share your information. We will also share information as part of a financing or bankruptcy.

We share information as permitted by law and for other reasons we may describe to you.

We do not sell your personal information. We do not sell personal information as that term is defined under applicable state privacy laws, and we do not share personal information for cross-context behavioral advertising except as described under “Cookies, Analytics, and Advertising” below. Mobile opt-in data and consent will not be shared with third parties/affiliates for marketing/promotional purposes.

Tax Return Information

If we prepare tax returns for you, the information you provide for that purpose — and the information contained in your returns, schedules, and supporting workpapers — is “tax return information” governed by Internal Revenue Code §7216 and Treasury Regulation §301.7216, in addition to this Privacy Policy.

We use tax return information to prepare and file your returns and to provide the related services you have engaged us to perform. We do not use or disclose tax return information for any other purpose except as permitted by those rules or with your specific written consent.

Consent is obtained separately. Where the rules require your consent to use or disclose tax return information — including disclosure to an affiliated Dark Horse entity or to any other third party — we obtain that consent through a separate written document meeting the requirements of the applicable regulations. Your consent is not obtained through this Privacy Policy, through our Terms of Service, or through your use of our website. You are not required to consent as a condition of receiving tax preparation services from us.

Where the general provisions do not apply. The provisions of this Privacy Policy describing when we may share information with service providers, affiliates, or in connection with a merger, acquisition, financing, or bankruptcy are subject to these rules with respect to tax return information.

Our Use of Artificial Intelligence

We use artificial intelligence tools to support our work and to deliver our services more efficiently, including for research, drafting, summarizing documents and meetings, analyzing financial data, reviewing data for anomalies, preparing and reviewing client deliverables, and reducing manual effort on repetitive tasks. We do this deliberately and within controls. This section describes what we do and what we do not do.

We do not put client information into unapproved AI tools

Firm policy prohibits our personnel from entering client data, tax return information, financial records, or other confidential information into any artificial intelligence service the firm has not approved. That includes free tools, personal-account chatbots and assistants, and personal accounts with the same provider as a tool we have approved. This is a written policy that personnel must acknowledge before they are given access to the firm's artificial intelligence tools, and the restriction applies to all firm personnel, including those located outside the United States.

Approved AI tools are accessed through firm-managed accounts

When we use artificial intelligence in client work, we use tools we have evaluated and approved. We access them through accounts the firm manages and license them under the provider's business or enterprise terms, not consumer terms. These tools are hosted by their providers, not on our own systems. Under our agreements, providers do not use our data to train their models, and the agreements limit how they may use and retain it. Within these approved tools, our personnel may process client information, including financial records, tax return information, and documents you provide to us, while performing the services you have engaged us to perform. This processing is subject to the restrictions in this policy. Some approved tools connect to other business systems we use to serve you, such as our practice management and accounting software.

Meeting recordings and summaries

We may record or transcribe virtual meetings and use approved artificial intelligence tools to generate meeting notes, summaries, and action items. We will tell you at the start of a meeting if it is being recorded or transcribed, and you may ask us not to record or transcribe any meeting. Recordings, transcripts, and summaries are handled under the same controls as other client information and are retained according to our record retention policies.

Your information is not used to train AI models

We do not use client information to train or fine-tune artificial intelligence models. Our agreements with the providers of our approved AI tools state that they will not use our data to train their models. We may build internal tools that let our personnel search and reference our own records, including client files, so they can serve you. These tools are not used for any other purpose and are subject to the same controls as the rest of this policy.

Our professionals remain accountable for the work

Artificial intelligence tools assist our professionals; they do not replace professional judgment. We do not use automated processing to make decisions about you without human involvement. Deliverables, filings, and recommendations are reviewed and owned by a qualified member of our team. Our professional responsibility for that work is the same regardless of the tools used to produce it.

Tax return information receives additional protection

Internal Revenue Code Section 7216 and its regulations govern how we use and disclose tax return information, in addition to this policy. Some of our personnel are located outside the United States. Before your tax return information is disclosed to them, we obtain your written consent on a standalone form, as Section 7216 requires. Where the law requires separate written consent for any other use or disclosure of your tax return information, we obtain that consent before the disclosure occurs. See "Tax Return Information" above.

We review this as the technology changes

Business software vendors are continuously adding artificial intelligence features, and some of those features are turned on by default. We review these features as they appear, disable the ones that do not meet our requirements, and treat artificial intelligence tools as vendors subject to our third-party review process. We will update this section as our practices change.

Questions about our use of artificial intelligence may be sent to privacy@darkhorse.cpa .

You Have Certain Choices

We provide you with the following options about how we use information:

Everyone

You can opt out of receiving our marketing emails at any time by clicking the unsubscribe link located at the bottom of our emails. If you opt out of receiving marketing messages, you will still receive non-marketing messages. If you object to our use of your information for direct marketing purposes, please email us at privacy@darkhorse.cpa .

Regardless of where you live, you may ask us to provide you with a copy of the personal information we hold about you, to correct information that is inaccurate, or to delete information we are not required to retain. Requests may be sent to privacy@darkhorse.cpa . We will respond within forty-five (45) days, or will tell you within that period if we need additional time. Some information must be retained to meet our professional, tax, and legal recordkeeping obligations; where that applies, we will tell you.

California Residents

As of January 1, 2020, the California Consumer Privacy Act gives you (or your Proxy) the right to make certain requests of Dark Horse CPAs regarding information that we collect about you. We will not discriminate against you because you have exercised any of your rights under the California Consumer Privacy Act.

Your Rights under the California Consumer Privacy Act

  • Request which categories of information we collect (which may also be referenced above in Categories of Information We Collect)
  • Request which categories of service providers we disclose your personal information to, and the categories of information disclosed
  • Request the specific pieces of personal information we have collected about you
  • Request the business or commercial purpose for collecting your personal information, and the sources from which it was collected
  • Request that we delete personal information we have collected from you, subject to exceptions permitting retention
  • Request that we correct inaccurate personal information we maintain about you
  • Direct us not to sell or share your personal information
  • Limit our use and disclosure of sensitive personal information to permitted purposes
  • Exercise these rights without receiving discriminatory treatment
  • Designate an authorized agent to make a request on your behalf

Other U.S. State Privacy Rights

Residents of other states with comprehensive consumer privacy laws may have similar rights, which may include the rights to confirm whether we process personal information about them, to access, correct, delete, and obtain a portable copy of that information, and to opt out of targeted advertising, the sale of personal information, and certain profiling.

To exercise any of these rights, email privacy@darkhorse.cpa . If we decline your request, you may appeal that decision by replying to our response or writing to the same address with the subject line “Privacy Request Appeal.” We will respond to an appeal in writing within the period required by your state’s law and, if we deny the appeal, will provide information about how to contact your state attorney general.

We honor Global Privacy Control signals transmitted by your browser as an opt-out of the sale or sharing of personal information where required by law.

Job Applicants and Personnel

The employment and education information described above is collected in connection with recruiting and employment. Applicants and personnel who are California residents receive a separate notice describing the categories of information collected, the purposes for which it is used, and the rights available to them. Requests relating to applicant or personnel information may be directed to privacy@darkhorse.cpa .

Our Verification Process

Before we can begin to process your request, we must first verify your identity. We will use the following points of information for our verification process.

  • Full Name
  • E-mail Address
  • Phone Number
  • Mailing Address
  • Employer, service provider, third party vendor or organization’s name you are an agent of

Requests made for your categories of information require that we verify your identity using at least two data points listed above. Additionally, you will be required to provide a document signed under penalty of perjury affirming that you are indeed the consumer subject to the information request.

For requests to delete information, we require two or three of the points of information above, depending on the sensitivity of the information to be deleted.

Proxy Requests. Requests made by a California resident’s proxy will follow the same verification process as above. Additionally, a proxy is required to provide to us a notarized attestation that they are the California resident’s authorized legal representative.

How To Make A Request. You or your proxy may make a request by emailing us at privacy@darkhorse.cpa . A customer service representative will collect the necessary information from you and provide you with details about how you can provide us with any additional documentation that may be necessary.

Sales of Information of California Resident. We do not and will not sell California residents’ personal information.

Children’s Privacy

We do not knowingly collect, use, or disclose personal information from children under the age of 13 without prior parental consent, except as permitted by the Children’s Online Privacy Protection Act (“COPPA”). If you are a parent or guardian of a child under age 13 and believe we collected information in a manner not permitted by COPPA, please email us at privacy@darkhorse.cpa .

Cookies, Analytics, and Advertising

Our website uses cookies and similar technologies for site functionality, analytics, and marketing measurement. These technologies may include Google Tag Manager, Google Analytics, Google Ads, HubSpot tracking and the OpenAI (ChatGPT) ads pixel.

You can manage cookies through your browser settings and, where offered, through the cookie preference controls on our website. We honor Global Privacy Control signals where your browser transmits them.

Data Security

Independent examination

We have completed a SOC 2 examination of the controls we use to protect client information, performed by an independent third-party auditing firm against the Trust Services Criteria established by the American Institute of Certified Public Accountants. Our SOC 2 report is available to clients, prospective clients, and their advisors upon request where there is a legitimate business need.

Regulatory framework

As a provider of tax preparation services, we are treated as a financial institution under the Gramm-Leach-Bliley Act and are subject to the Federal Trade Commission’s Safeguards Rule. We maintain a written information security program addressing the administrative, technical, and physical safeguards required by that rule, and we have designated a qualified individual responsible for that program.

Safeguards

Our security program includes multi-factor authentication, encryption of client data in transit and at rest, role-based access controls with periodic access review, secure client portals for exchanging documents, network and endpoint protection, activity logging and monitoring, vendor and subprocessor review, background screening and recurring security training for personnel, documented incident response procedures, and secure retention and disposal practices.

Sending us documents

Please use our secure client portal rather than email for any document containing Social Security numbers, account numbers, or other sensitive information. Email is not a secure channel, and a document sent unencrypted remains in every system through which it passes.

No guarantee

We maintain strict security procedures to help protect against loss, misuse, unauthorized access, disclosure, alteration or destruction of the information you provide to us. No data transmission or storage, however, can be guaranteed to be 100% secure. As a result, we cannot guarantee the security of any information you disclose or transmit to us online and cannot be held responsible for the theft, destruction, or inadvertent disclosure of your information.

Your responsibilities

You are responsible for maintaining the confidentiality of your account password and for any access to or use of our services using your password, whether or not authorized by you. Please notify us immediately if you suspect any unauthorized use of your account or any other breach of security.

Security incidents

If we determine that a security incident has affected your personal information, we will notify you and any regulators as required by applicable law, and will describe what occurred, what information was involved, and the steps we are taking in response.

How Long We Keep Information

We retain personal information for as long as needed for the purposes described in this policy, and afterward for the periods required by our professional obligations, applicable tax and recordkeeping rules, and the resolution of any actual or potential disputes.

In general: engagement records and tax workpapers are retained for seven (7) years from the completion of the engagement; website and analytics data for up to fourteen (14) months after your last visit; job applicant records for at least four (4) years; and marketing contact information until you unsubscribe or ask us to delete it. When information no longer needs to be retained, we dispose of it securely.

Privacy Policy Updates

We may modify this Privacy Policy at any time by posting revisions here. When we make material changes, we will update the “Last Updated” date at the top of this policy and, where required by law or where the change materially affects how we use information you have already provided, we will notify you directly.

Revision history: October 15, 2026 — added sections on artificial intelligence, tax return information, retention, cookies, and multi-state privacy rights; expanded data security disclosures. September 2025 — prior version.

Contact Us

If you have any questions about this Privacy Policy, you may contact us at:

By Email: privacy@darkhorse.cpa Subject: “Privacy Policy Questions”

By Mail:

Dark Horse CPAs, An Accountancy Corporation

2033 San Elijo Ave #148, Cardiff by the Sea, CA 92007

Attention: Data Security Coordinator

We acknowledge privacy requests within ten (10) business days and respond substantively within forty-five (45) days, or will tell you within that period if we require additional time.