WardstepPrivacy Policy
1. Who we are and who this covers
Wardstep is operated by Brandyn Schadel; Wardstep LLC is being formed and will take over the service. Wardstep provides software at wardstep.com and app.wardstep.com that helps tax offices build and maintain a Written Information Security Plan.
This policy covers firm users (the owner and co-admins who sign in), staff who take training through a link their firm sends them, and visitors to wardstep.com.
Wardstep acts as a data processor and service provider for the records, firm details and staff details our customers provide. Each firm is the controller of that information: it decides what to enter, and we process it only to provide the service to that firm.
2. What we collect
| Information | Whose | Source |
|---|---|---|
| Email address, password (stored only as a one-way hash by our sign-in provider), authenticator app registration | Firm users | You, at sign-up |
| Firm name, owner, Qualified Individual, office type, state, client-count range, breach contacts | The firm | Firm users |
| Checklist answers and notes, inventory, plan wording, reviews, incident notes | The firm | Firm users |
| Staff names, optional emails, access levels, last day, offboarding steps | Firm staff | Firm users |
| Training results and code-of-conduct acknowledgments | Firm staff | Staff, through their training link |
| Evidence files (screenshots and documents) | The firm | Firm users |
| Activity log: who changed which record and when, never the contents | Firm users | Created automatically |
| Technical data: IP address, browser type, request logs, bot-check signals | Everyone | Our hosting, database and CAPTCHA providers |
What we never collect: client tax data. There's no place in Wardstep to enter a client's name, Social Security number, return or bank details. We don't use advertising or analytics trackers, and we don't buy data about you.
Prohibition on taxpayer information: Wardstep is built to document security policies and controls, not to process taxpayer returns. Users may not upload, transmit or enter client tax returns, taxpayer identification numbers, bank account numbers or other nonpublic personal information protected by the Gramm-Leach-Bliley Act or Internal Revenue Code section 7216. Anything uploaded by mistake must be deleted as soon as it's discovered, and Wardstep may remove files that violate this restriction.
3. How we use it, and who helps us
We use information only to provide and secure Wardstep: building your plan, saving your records, delivering training, confirming email addresses, requiring multi-factor sign-in, blocking bots, sending account emails, and answering support requests. We don't sell or rent personal information or share it for advertising.
| Provider | What it does | Information it handles |
|---|---|---|
| Supabase | Database, sign-in and file storage in the United States (US East) | Everything stored in Wardstep |
| Cloudflare | Website and app hosting, DNS, Turnstile bot check | Requests, IP addresses, bot-check signals |
| Resend | Account emails from wardstep.com | Email address and message content |
| Google Workspace | Our support email | Messages you send us |
These providers process information on our behalf under their service agreements with us; we're finalizing data processing addenda with each. We may disclose information if required by law, to protect people or the service from harm, or as part of a sale or merger of the business, in which case this policy continues to apply.
4. Browser storage, retention and deletion
Wardstep uses no advertising or tracking cookies. The app stores your sign-in session, a copy of the app itself so it opens quickly (not your firm's data), and temporary markers while you finish an invite or password reset. Cloudflare's bot check may set short-lived values to tell people from bots.
- Firm records, staff, training results, evidence files and the activity log are kept until the firm is deleted.
- Training links expire after 30 days and team invites after 7 days; only a one-way hash of each is stored.
- Deleting a firm (Settings, Delete firm) permanently removes its records and evidence files from our systems immediately. Deleting a firm's last login also deletes the firm.
- Provider logs follow our providers' retention, typically days to weeks.
You can download your firm's data, transfer ownership, or delete your login at any time in Settings. You can also email hello@wardstep.com from the address on the account.
5. Your choices, security and contact
Firm users can view, correct and delete firm information in the app. Staff can ask their firm to correct or remove their information. Anyone can email hello@wardstep.com to ask what we hold about them, to correct it or to delete it; we'll verify the request and respond within 30 days.
Security: every account uses multi-factor sign-in, each firm's data is isolated in the database, files are private, and all traffic is encrypted. See our security page. If we confirm a security breach affecting firm data, we'll notify the firm's administrators without unreasonable delay and no later than 72 hours after confirming it, and notify others as the law requires.
Children: Wardstep is for businesses and isn't directed to anyone under 18.
Changes: we'll post updates here with a new date and email firm owners about significant changes before they take effect.
Contact: hello@wardstep.com