Privacy Policy

1. Our Website

You can browse cypressag.com without giving us any personal information. We collect information in these cases:

• Contact form. When you send us a message, we receive your name, email address, phone number (if you add it), firm or company, the topic you chose, and your message. We use this to reply to you.
• Security check. The contact form uses Cloudflare Turnstile to block spam. It checks your browser and IP address.
• Booking a demo. The scheduler on our contact page is provided by Calendly. Calendly collects the details you enter there and shares the booking with us.
• Web fonts. Our pages load fonts from Google Fonts, so your browser sends your IP address to Google.
• Server logs. Our web host may record standard details about each visit, such as your IP address, browser type, and the page requested.

Our website does not use analytics or advertising trackers. Signup and local contact processing use an essential browser-session cookie to protect requests and link verification or checkout to the browser where you started. It is not used for advertising. Cloudflare, Calendly, and Stripe may use cookies or similar technologies when you use their services.

Membership Signup, Email Verification, and Billing

Information collected and why

• Membership and verification. We receive your name, membership email, firm or individual membership name and selection, selected seat count, U.S. invoice address (street, city, state, ZIP code, and country), and acceptance of the membership terms. Microsoft Entra External ID handles account registration, email verification, and sign-in. Where Themis sends verification codes directly, it records verification status, expiry, and attempts and stores protected code hashes. Email delivery services receive the recipient address and email content.
• Checkout and payments. Stripe collects card details directly through its hosted checkout. Themis supplies the approved invoice address for billing and tax calculation. We receive transaction and subscription references, invoice and tax information, payment status, amounts, currency, seats, and renewal information. We use these records to administer your membership, reconcile charges, respond to payment questions, and support billing operations. Our website does not collect or store full card numbers or card security codes.
• Billing and eligibility records. Where applicable, we use customer and subscription identifiers, payment and invoice records, terms acceptance, cancellation dates, refund requests, and rejoining inquiries to administer recurring billing, investigate disputes, and apply the twelve-month rejoining rule. Membership management also requires records of approved seat changes and account access relevant to refund eligibility.
• Session and security records. Essential session identifiers link verified email and checkout attempts to your browser and protect against forged or repeated requests. We record limited request, rate-limit, and delivery information to troubleshoot failures and prevent abuse. Clearing the session cookie may require you to verify your email or restart checkout.

Email verification does not charge your card or create a password. Account creation, email verification, invitations, and sign-in use the existing Themis and Microsoft identity services. Do not send payment card details, passwords, or tax documents through the contact form or email.

Providers and your choices

Microsoft Entra External ID provides customer registration, email verification, and sign-in. Microsoft Azure Communication Services delivers account invitations, Themis verification messages where used, and local-preview contact inquiries. Stripe processes payments and recurring subscriptions. The deployed website contact form uses Cloudflare and Resend; Calendly handles demo bookings. These providers receive the information needed to provide their respective services. See Stripe’s Privacy Policy for its handling of payment and related data.

You may browse without starting a membership. Verification and the required billing information are needed to complete signup. Contact Admin@CypressAG.com to ask about your membership data or request correction or deletion, subject to financial, contractual, and legal recordkeeping requirements. Cancellation does not automatically delete billing or eligibility history.

2. Themis

Themis is software used by tax firms. Each firm decides what client information to put into Themis, and we handle that information on the firm's behalf. If you are a client of a firm that uses Themis, the firm's own privacy notice also applies to you, and the firm is your first contact for questions about your records.

Information we handle

• Account information. Names, email addresses, firm details, roles, and sign-in records for firm staff and client portal users.
• Client and tax information. Names, contact details, Social Security numbers and other tax IDs, family and dependent details, income and other financial facts, uploaded tax documents, worksheets, notes, messages, and signature records. Tax documents can also contain health and household details.
• Information from connected services. Files a firm brings in from storage it connects, and email a firm sends or imports through Themis.
• Support and diagnostic information. Support requests and attachments, pages used, errors, performance details, and user, firm, and session identifiers.

How we use it

• To provide Themis, including reading documents, preparing worksheets, sending messages and document requests, and collecting signatures.
• To run AI-assisted features, such as document reading and the staff assistant. These features use AI services from Microsoft Azure.
• To manage accounts, give support, fix problems, and keep the service secure.
• To meet our legal obligations.

Themis uses cookies and browser storage to keep you signed in, save your work, and record diagnostics.

3. Themis Connect Browser Extension

Themis Connect is a browser extension for tax firm staff who use both Themis and ProConnect Tax, which is an Intuit product. It has one purpose: when a staff member starts a transfer in Themis, it moves approved documents and saved worksheet inputs into the intended ProConnect client in the same browser. If that client has no return for the tax year, it can create one. It does not file returns.

What the extension handles

What the extension does not do

• It does not ask for or read passwords, cookies, or sign-in tokens. You sign in to Themis and ProConnect yourself.
• It does not track your browsing or build a browsing history. It only works with Themis and ProConnect pages.
• It does not contain analytics or advertising code, and it does not run code downloaded from the internet.
• It does not keep its own copy of your information. Data is held in memory only while a transfer runs.
• It does not send information to its own server. It only passes information between Themis and ProConnect in your browser.

Browser permissions

• Tabs. To find the Themis and ProConnect tabs and open the right page during a transfer.
• Scripting. To run the extension's own code on those pages so it can use ProConnect's normal controls.
• Site access. Limited to themis.cypressag.com, themis-web-prod-scus.azurewebsites.net, and ito.intuit.com.

Limited Use

The use of information received through Themis Connect adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use this information only for the purpose described above. We do not sell it, and we do not use or transfer it for advertising, or to determine creditworthiness or for lending. We transfer it only to provide that purpose, to comply with the law, to protect against fraud or abuse, or as part of a merger or sale of our business with your prior consent. Our staff do not read it unless you agree, or unless it is needed for security or to comply with the law.

The same practices apply to Themis Connect in every supported browser. Removing the extension does not delete records already saved in Themis or ProConnect. Information in ProConnect is covered by Intuit's own terms and privacy policy.

4. Who We Share Information With

We share information only with the parties below, and only as needed for the listed purpose.

We may also disclose information when the law requires it, to protect people or our service, to professional advisers, or as part of a merger or sale of our business. These disclosures stay subject to the legal limits on taxpayer information.

5. No Sale of Information or Advertising

We do not sell personal information, and we do not use it for advertising.

6. Security

Information is sent over encrypted connections (HTTPS). Themis data is stored in Microsoft Azure and encrypted at rest, and access inside Themis is limited by firm and by role. No system is perfectly secure, so we cannot promise that information will never be accessed without permission.

7. How Long We Keep Information

• Membership verification and sessions. Codes and sessions have limited validity; expired codes cannot verify an email. Verification, rate-limit, and delivery records may be retained for security and support. Expiry of a code does not mean all associated records are immediately deleted.
• Billing and membership history. We retain records needed for accounting, disputes, refunds, and contractual or legal obligations. Cancellation and identity records are also needed to apply the twelve-month rejoining rule. Payment providers maintain their own records under their policies.
• Website messages. We keep them as long as we need to respond and to maintain our business records.
• Themis. We keep information while the firm's account is active and as the firm's agreement or the law requires. Firms are responsible for their own client recordkeeping. Copies can remain in backups until those backups expire.
• Themis Connect. The extension keeps no information after a transfer ends.

8. Your Choices and Rights

Depending on where you live, you may have the right to ask for access to your personal information, or to correct or delete it. To make a request, contact us using the details below. We will verify your request and respond as the law requires.

If your information is in Themis because a tax firm uses it for your return, please contact that firm. If you contact us instead, we will direct your request to the firm. Tax and legal recordkeeping rules can limit what can be deleted.

You can remove Themis Connect at any time from your browser's extensions page. Please do not send Social Security numbers, passwords, or tax documents to us by email.

9. Children

Our website and products are for businesses and adults, and we do not knowingly collect information directly from children. Tax records can include information about dependents, which is provided by the taxpayer or their tax firm.

10. Changes to This Policy

We will post any changes on this page and update the effective date. If a change materially affects how we use information, we will give notice before it takes effect.

11. Contact Us