GoRefer.io - the growth layer for tax firms

GoRefer Trust Center

Data Processing Addendum

Updated October 9, 2026

Version 1.0. Effective October 9, 2026.

This Data Processing Addendum ("Addendum") is between GoRefer.io LLC, Dallas, Texas ("GoRefer," "we" or "us") and the tax firm or other business that uses GoRefer (the "Firm" or "you"). It is part of the GoRefer Terms of Service. It sets out how GoRefer handles the personal information that the Firm and its team put into GoRefer about the Firm's clients and contacts. GoRefer is offered to businesses in the United States, and this Addendum is written for U.S. law.

How it is accepted. A firm accepts this Addendum when one of its administrators accepts it at sign-up, or when GoRefer asks again after a change. Each acceptance is recorded with the firm, the person, the version, the time and the IP address. If you need a countersigned copy, email legal@gorefer.io.

1. Definitions

  • Client Data means personal information about the Firm's clients, their spouses and dependents, prospects, referrers, preparers, staff and other contacts that the Firm or its users put into GoRefer, or that GoRefer collects for the Firm (for example through the Firm's intake forms, landing pages, texts and calls). It includes tax return information.
  • Tax return information has the meaning given in section 7216 of the Internal Revenue Code and Treas. Reg. §301.7216-1.
  • Service means the GoRefer software service, including its AI features, texting, calling, voicemail, landing pages and the GoRefer Autofill (Beta) browser extension.
  • Sub-processor means a service provider GoRefer uses that may receive Client Data.
  • Security Incident means unauthorized access to, or acquisition, disclosure, alteration or loss of, Client Data in GoRefer's systems or a Sub-processor's systems.
  • Privacy Laws means the U.S. federal and state laws that apply to Client Data, including the Gramm-Leach-Bliley Act and the FTC Safeguards Rule (16 CFR Part 314), section 7216 and its regulations, the California Consumer Privacy Act ("CCPA") and other state privacy, security and breach-notice laws.

2. Roles

  • The Firm is the business (the "controller") for Client Data. It decides why and how Client Data is used.
  • GoRefer is the Firm's service provider (the "processor"), and its contractor where a Privacy Law uses that term. For section 7216, GoRefer provides auxiliary services to the Firm in connection with preparing tax returns.
  • The Firm's instructions are these Terms, this Addendum, and the Firm's settings and use of the Service. GoRefer will tell the Firm if it believes an instruction breaks a Privacy Law.
  • The Firm is responsible for having the right to give Client Data to GoRefer, and for the notices and consents the law requires, as the Terms describe.

3. Scope of Processing

GoRefer processes Client Data only to provide the Service to the Firm. That includes storing client records and documents; intake forms and e-signature; reading uploaded documents and running Gio and other AI features; text and picture messages; calls and voicemail, and call recordings, transcripts and summaries if the Firm records calls; the Firm's landing pages and the tags it adds to them; referral, reward and commission features; and the GoRefer Autofill (Beta) extension. Annex A gives the details. Processing lasts while the Firm uses the Service and then until deletion under section 13.

4. Business Purpose Only

GoRefer will:

  • Process Client Data only for the business purposes in this Addendum: providing the Service to the Firm, and the other purposes a Privacy Law allows a service provider, such as keeping the Service secure, fixing errors and complying with the law.
  • Not sell or share Client Data, as the CCPA defines those words.
  • Not keep, use or disclose Client Data for any other purpose, including any commercial purpose, or outside the direct business relationship between GoRefer and the Firm.
  • Not combine Client Data with personal information it receives from anyone else, or collects from its own dealings with a person, except as the Privacy Laws allow.
  • Not use Client Data for its own marketing, and not use it to train AI models.
  • Comply with the Privacy Laws that apply to it as a service provider, and give Client Data the level of privacy protection those laws require.

GoRefer may use information about how the Service is used that contains no Client Data values and does not identify any client (for example, which form fields preparers corrected, without what they entered) to maintain and improve the Service.

5. Tax Return Information

  • GoRefer uses and discloses tax return information only to provide the Service to the Firm, as Treas. Reg. §301.7216-2(d) allows. It discloses tax return information to Sub-processors only for that purpose.
  • GoRefer honors the consents the Firm records in GoRefer, including clients' answers to the Firm's section 7216 consent requests and to the client AI notice in the Firm's intake. A client who chooses to continue without AI has their documents kept for their preparer, not read by AI.
  • GoRefer never uses tax return information for its own marketing.
  • The Firm is responsible for getting any consent section 7216 requires for the Firm's own uses and disclosures, such as referral and reward programs.

6. Safeguards

GoRefer maintains a written information security program, with administrative, technical and physical safeguards suited to its size and to the sensitivity of Client Data, as the FTC Safeguards Rule expects of a service provider (16 CFR 314.4(f)). GoRefer also maintains an incident response plan. Annex B summarizes the main measures, and our Security page describes them further. GoRefer may change its measures over time, but not in a way that lowers the overall protection of Client Data.

7. If GoRefer Cannot Meet Its Obligations

GoRefer will tell the Firm promptly if it decides it can no longer meet its obligations under this Addendum or the Privacy Laws.

8. Stopping Unauthorized Use

If GoRefer tells the Firm, or the Firm reasonably believes, that Client Data is being used in a way this Addendum does not allow, the Firm may take reasonable and appropriate steps to stop and fix it. These include asking GoRefer to stop the processing, turning off the affected feature, or ending the Terms. GoRefer will cooperate.

9. Confidentiality

GoRefer gives access to Client Data only to its personnel who need it to provide or support the Service. Each of them is bound to keep it confidential.

10. Sub-processors

  • The Firm authorizes GoRefer to use the Sub-processors listed on our sub-processor list (Annex C).
  • We will email account administrators before a new service provider receives your firm's data. The Firm may object on reasonable data-protection grounds by emailing legal@gorefer.io. We will work with the Firm in good faith to resolve the objection. If we cannot, the Firm may stop using the affected feature or cancel its subscription.
  • GoRefer requires each Sub-processor, by written agreement, to protect Client Data, keep it confidential and use it only to provide its services, with obligations that meet the Privacy Laws that apply to it.
  • GoRefer remains responsible to the Firm for its Sub-processors' performance of those obligations.
  • Integrations the Firm chooses to connect (such as Zapier, Intuit QuickBooks, Google Workspace and Zoho Mail) receive data only when the Firm or its users connect them, and on the Firm's instruction. The Firm's own agreement with each provider governs what it does with that data.

11. Assistance

  • Requests from people. GoRefer will help the Firm respond to requests from its clients and contacts to know, access, correct or delete their information, or to opt out of or limit its use, mainly through the Service's own tools. If GoRefer receives a request about Client Data directly, it will pass the request to the Firm and will not answer it on the Firm's behalf unless the Firm asks.
  • Assessments. GoRefer will give the Firm the information it reasonably needs to complete risk assessments, data protection assessments and similar reviews that a Privacy Law requires of the Firm.
  • Breach notices. GoRefer will help the Firm meet its own notice duties after a Security Incident, as section 12 describes.

12. Security Incidents

GoRefer will notify the Firm without unreasonable delay, and no later than 72 hours after we confirm an incident involving your firm's client information. The notice goes by email to the Firm's account administrators. As far as it is known at the time, it will say what happened and when, which kinds of Client Data and about how many people are involved, what GoRefer has done and will do about it, and whom to contact. GoRefer will update the Firm as it learns more, so the Firm can give the notices it must give, including to its clients, state authorities and the FTC under 16 CFR 314.4(j). GoRefer will not notify the Firm's clients about an incident involving Client Data without the Firm's agreement, unless the law requires it.

13. Deletion and Return

  • While the Firm's account is open, the Firm can export its data from the Service.
  • When a firm cancels, we show the date its data will be deleted. After the retention period ends, we delete the firm's workspace: its users, client records, messages, call recordings, voicemails and Gio cases, the documents stored for it in our current document storage, and its account with our phone provider, whose numbers are released. Records on legal hold are kept until the hold is released. Billing and payment records are kept for at least 7 years for tax and accounting purposes, proof that a person agreed to receive messages or asked to stop is kept in a reduced form for up to 5 years, and our security audit trail is kept.
  • Deleted data can remain in our backups for up to 30 days, until those backups expire.
  • Each deletion is recorded. Ask legal@gorefer.io to confirm when your firm's data was deleted and what was kept.
  • On request, GoRefer will give the Firm a written certificate that its data was deleted.

14. Audits

  • Once a year, on request, GoRefer will answer the Firm's reasonable security and privacy questionnaire and provide documents that show how it meets this Addendum.
  • If that is not enough to show GoRefer's compliance, the Firm may, at its own expense and with at least 30 days' written notice, have an independent assessor review GoRefer's compliance with this Addendum. The assessor must agree to keep what it learns confidential. A review may happen once a year, during business hours, in a way that does not disrupt the Service or expose other customers' data.

15. Where Data Is Stored

Uploaded files, email delivery and our backups are handled by Amazon Web Services in the United States. The application and its database run on Google Cloud. Some Sub-processors may process data in other locations under their own terms; the sub-processor list names each one.

16. Certification

GoRefer certifies that it understands the restrictions in sections 4 and 5 and will comply with them.

17. Order of Precedence

If this Addendum and the Terms of Service conflict on how Client Data is handled, this Addendum controls. In all other respects, the Terms apply.

18. Term and Changes

This Addendum lasts as long as GoRefer processes Client Data for the Firm. We may update it. We will email account administrators before a material change takes effect, and an administrator will be asked to accept the new version for the Firm.

Annex A. Processing Details

Nature and purpose

Hosting, storing, organizing, displaying, sending and deleting Client Data, and reading documents and running AI features, so the Firm can manage its clients, intake, messages, calls, referrals, rewards and commissions in the Service. If the Firm adds a key from its own Stripe account, sending the preparer payouts the Firm approves from that account, on the Firm's instruction, and following their status. GoRefer never holds or moves the Firm's funds.

Duration

While the Firm uses the Service, and then until deletion under section 13.

People the data is about

  • The Firm's clients, their spouses and their dependents, including minors
  • Prospects and leads, including people who fill in forms on the Firm's landing pages
  • Referrers and people who receive rewards
  • The Firm's preparers, staff and partners
  • People who call, text or leave voicemail for the Firm
  • Learners and course buyers who buy or take the Firm's courses on the academy

Kinds of data

  • Names, addresses, email addresses, phone numbers and dates of birth
  • Social Security numbers and ITINs; EINs and IRS identity protection PINs
  • Driver's license and other government ID numbers
  • Bank account and routing numbers
  • Dependents' information, including information about minors
  • Tax documents and tax return information, and e-signature records
  • Text and picture messages
  • Voicemails and their transcripts, and, if the Firm records calls, call recordings, transcripts and summaries
  • Conversations with Gio and other AI features
  • Section 7216 consent records and answers to the client AI notice
  • Referral, reward and commission records
  • Payout records: amounts, status and Stripe's reference for each payout. Preparers enter their bank details on Stripe's form; GoRefer doesn't receive them
  • Records of what the GoRefer Autofill (Beta) extension filled
  • Academy learner records: names, email addresses, purchases, course progress, quiz results and certificates

Sensitive personal information

Client Data includes sensitive personal information as state laws define it: Social Security, driver's license and other government ID numbers, and financial account numbers. Tax documents can also contain health-related details, such as medical expenses or health coverage forms, and information about children.

Annex B. Security Measures

  • A written information security program and an incident response plan
  • Encryption in transit for connections to the Service
  • Additional encryption for sensitive intake fields: Social Security numbers, ITINs, EINs, IRS identity protection PINs, bank account and routing numbers, and driver's license and other ID numbers
  • Each firm's data kept separate from every other firm's
  • Role-based access controls, so a firm decides what each member of its team can see and do
  • Two-step sign-in verification for administrator accounts, which the Firm can also require of its preparers
  • Audit logging of sign-ins and important account actions
  • Masking of Social Security numbers, ITINs, EINs and bank account and routing numbers before text is sent to an AI model
  • Nightly encrypted backups, stored with a provider separate from the database server and kept for 30 days
  • Error monitoring
  • Payment cards handled by Stripe; GoRefer does not store card details
  • A Stripe key a Firm adds for preparer payouts is kept encrypted, shown again only in part, and usable only by the Firm's administrators to send payouts they approve
  • Deletion of a cancelled firm's workspace, as section 13 describes

Annex C. Sub-processors

The current Sub-processors are listed on our sub-processor list, in two groups: service providers GoRefer uses to run the Service, and integrations the Firm chooses to connect (used only if connected). The list is part of this Addendum.

Annex D. State Riders

Massachusetts (201 CMR 17.00)

For personal information of Massachusetts residents, GoRefer will implement and maintain appropriate security measures, consistent with 201 CMR 17.00 and its written information security program, as 201 CMR 17.03(2)(f) requires the Firm to require of its service providers.

New York (SHIELD Act)

For private information of New York residents, GoRefer will maintain reasonable administrative, technical and physical safeguards, as N.Y. General Business Law §899-bb requires, and will notify the Firm of a breach as section 12 provides, so the Firm can meet its duties under §899-aa.

Other states

Where another state's law requires specific terms in a contract with a service provider or processor, this Addendum is meant to include them, and GoRefer will follow them.

Contact

GoRefer.io LLC, Dallas, Texas
Email: legal@gorefer.io