Last updated: 4 October 2026
CPAgents, Inc. ("CPAgents", "we", "us") provides accounting agents for CPA firms and small businesses at cpagents.ai, including our website, firm and operator portals, our platform Praxium, and tax and finance workpapers.
CPAgents is a Delaware corporation based in the United States. The service is operated at cpagents.ai and app.cpagents.ai.
This notice explains how we handle personal information through these services. CPAgents is responsible for deciding how information is used for its own account administration, business communications, security and optional analytics. For these activities, CPAgents is the data controller.
Customers choose the purpose and authorize the information used in their accounting and tax workflows. We process that information on their instructions as a service provider or data processor. The customer's privacy notice explains its own use of that information.
We receive information directly from you, from your organization and from the ledgers and other services it connects to CPAgents. We also collect technical information when you use our services.
| Information | Examples |
|---|---|
| Account and business contact information | Name, work email, organization, role and account identifiers. |
| Workflow information | Instructions, ledger transactions and accounts, tax mappings, trial balances, workpapers, generated reports and draft returns. These may include names, contact details and information about suppliers, clients, employees, owners or shareholders. Identifiers such as Social Security numbers and Employer Identification numbers, when present, are masked in the product and in logs. |
| Usage and technical information | Device and browser information, IP addresses, sign-in and execution events, error diagnostics and, when enabled, product analytics. |
| Communications | Demo requests, support messages and privacy requests. |
Workflow definitions, history, inputs, outputs, mappings and files may be stored to provide the service, allow you to return to previous work, keep an audit trail of numbers that reach a return, financial statement or report, and support troubleshooting. Processing is not limited to a temporary session.
Where the GDPR applies to processing for which CPAgents is the controller, the following purposes and legal bases apply:
| Purpose | Legal basis |
|---|---|
| Set up and manage accounts, provide the service and respond to service requests | Performance of a contract where you are a party to it; otherwise our legitimate interest in providing services to your organization and supporting its authorized users. |
| Respond to demo requests and business inquiries | Steps at your request before entering a contract, where applicable; otherwise our legitimate interest in responding to business inquiries and explaining our services. |
| Protect accounts, detect misuse and investigate technical problems | Our legitimate interest in keeping the service secure, reliable and available. |
| Understand product usage through optional analytics | Your consent. |
| Meet applicable legal obligations, including required business records and privacy-request handling | Compliance with the applicable legal obligation. |
| Establish, exercise or defend legal claims | Our legitimate interest in protecting our rights and resolving disputes. |
When relying on legitimate interests, we consider the purpose, the information needed and the effect on people's rights. You may object as described below.
For customer-controlled workflow information, we follow the customer's instructions. The customer determines the applicable legal basis for that processing.
We do not sell personal information.
Information is available to authorized users within your organization and to destinations selected in its workflows, including a connected ledger when the customer authorizes a write-back. We use service providers for hosting and storage, AI processing, connected applications, payments, communications and diagnostics or analytics.
These include cloud hosting and storage for the application, OpenAI for AI processing, Intuit for QuickBooks Online connections, Stripe for billing, and Resend for email delivery. A workflow may also use connected accounting, file or communication services selected by the customer. Providers receive information needed for the relevant service under the applicable terms and data-processing arrangements.
We may disclose information where required by law or where necessary to establish, exercise or defend legal claims. We may also disclose information in connection with a corporate transaction such as a merger or acquisition, in which case this notice continues to apply to previously collected data.
CPAgents is based in the United States and uses international service providers. Information may be processed outside the EU/EEA, including in the United States. Protection under local law may differ from that in your country.
Where GDPR international-transfer rules apply, the transfer must be covered by an applicable adequacy decision or appropriate safeguards, such as the European Commission's Standard Contractual Clauses. Applicable provider data-processing agreements include these clauses for covered transfers; for example, OpenAI's agreement provides for SCCs or an applicable adequacy decision for relevant onward transfers.
We assess the applicable transfer arrangement and any additional protections needed under our transfer-review procedure. Contact us for information about a transfer affecting your information or a copy of the relevant safeguards, with confidential information removed where necessary.
We keep personal information for as long as needed for its purpose. In deciding the period, we consider the active account or customer relationship, customer instructions, the need to retrieve or troubleshoot workflow results, applicable recordkeeping and audit requirements and any legal claim.
When information is no longer needed, it is deleted or anonymized under the applicable retention process. Backup copies follow their separate retention cycles. Disconnecting a ledger or other integration prevents future authorized access through that connection; it does not by itself delete information already included in previous workflows, workpapers or reports. Customers may request deletion of their data upon termination of service, subject to records we are required to keep.
We use access restrictions and encryption to protect information in our services. Data is encrypted in transit and at rest. Access to customer data is restricted by role, firm data is isolated per tenant, and administrative access requires multi-factor authentication. Every agent action and human decision in the service is logged. The specific storage and retention arrangements depend on the service and type of information.
Where applicable, you may request access to your personal information, correction of inaccurate information, deletion, restriction of processing or a portable copy of information. You may object to processing based on legitimate interests, including any direct marketing.
Where processing relies on consent, you may withdraw it at any time. Withdrawal does not affect processing lawfully carried out before withdrawal. Declining optional analytics does not prevent use of the core service.
You can make a request using the contact details below. We may need to verify your identity. If the request concerns information controlled by a customer, we will coordinate with that customer or direct you to it. Rights are subject to applicable legal conditions and exceptions.
You may complain to a data-protection supervisory authority, including the authority where you habitually live or work or where you believe an infringement occurred. You do not have to contact CPAgents first.
Account and contact details are needed to establish or manage access and respond to requests. The information and permissions needed for a workflow depend on the task you choose, including the ledger connection you authorize. Without the necessary information or access, we may be unable to provide the relevant account, response or workflow.
Optional analytics is not a condition of using the service. We will identify any specific information that you are legally required to provide when such a requirement applies.
CPAgents uses AI and automation, including our platform Praxium, to interpret instructions, categorize transactions, prepare tax mappings, workpapers and draft returns, and run workflows selected by users. Outputs support finance and accounting work. People make decisions using that analysis.
CPAgents does not itself make decisions about individuals based solely on automated processing, including profiling, that produce legal or similarly significant effects. Automating a workflow step does not mean CPAgents makes those decisions about a person. Drafts produced by the service, including categorizations, reconciliations and tax workpapers, are prepared for review by a qualified professional.
CPAgents provides business accounting services and does not offer services directly to children. Our services are not directed to anyone under 18. We do not knowingly collect information from children.
Our site and portals use the cookies necessary for them to function, including session and security cookies. We may use basic product analytics when enabled. We do not use advertising cookies.
Email: privacy@cpagents.ai.
Post is not required for privacy requests. Write to CPAgents, Inc. at privacy@cpagents.ai. Demo and general inquiries may also be sent to demo@cpagents.ai.
We update this notice when our practices or applicable requirements change and show the revised date. We will provide additional notice of material changes where required.
Version history: 4 October 2026 — expanded the notice to cover the current platform and GDPR disclosures. Previous notice: August 2026.