Privacy Policy

Effective Date: October 14, 2026

Last Updated: October 14, 2026

Tianping Xu, CPA (“we,” “us,” or “our”) is a licensed Certified Public Accountant practice located in Walnut, California 91789. We provide individual and business tax preparation (federal, state, and U.S. territories), extensions, entity formation and dissolution, bookkeeping, payroll, Form 1099 preparation, and IRS representation.

This Privacy Policy explains how we collect, use, disclose, and protect personal information through our websites, tpxucpa.com (the “Website”), our Client Portal, and in providing our professional services (the “Services”). Using the Website or the Services means you acknowledge this Privacy Policy.

(a) Information you provide through the Website. When you use our contact form, we collect your name, email address, telephone number, and the content of your message.

(b) Information you provide as a client. When you use the Services, including by uploading documents through our Client Portal, we may collect nonpublic personal and financial information. This may include:

• names, addresses, dates of birth, and contact information;

• Social Security Numbers (SSNs) and Individual Taxpayer Identification Numbers (ITINs);

• income, wage, and tax information (for example, Forms W-2 and 1099, and prior-year returns);

• bank account and other financial account information;

• information about spouses and dependents;

• business, payroll, and entity information; and

• correspondence with tax authorities.

(c) Information collected automatically. Our Website is hosted on GoDaddy Website Builder, which uses cookies and similar technologies. Through them, GoDaddy may automatically collect information such as your IP address, browser type, device information, pages viewed, referring URLs, and dates and times of visits. See Section 9.

Please do not submit SSNs, ITINs, bank account numbers, or tax documents through the Website contact form or by regular email. Use the Client Portal instead.

We use personal information to:

• respond to inquiries and communicate with you;

• prepare, file, and support tax returns, extensions, and related filings;

• provide entity formation and dissolution, bookkeeping, payroll, and Form 1099 services;

• represent you before the IRS and state or territorial tax authorities;

• maintain records as required by law and professional standards;

• operate, secure, and improve the Website; and

• comply with legal, regulatory, and professional obligations.

We use tax return information only as permitted by Internal Revenue Code (IRC) §7216 and its regulations (see Section 5).

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We disclose personal information only as follows:

• Tax authorities. We disclose information to the Internal Revenue Service and to state, local, and U.S. territorial tax agencies as needed to file returns and provide the Services you request.

• Service providers. We use service providers that support our practice, including Microsoft (Microsoft 365, OneDrive, and SharePoint, for email and secure file storage and transfer), GoDaddy (website hosting and analytics), and professional tax preparation software providers. These providers may access information only as necessary to perform services for us, subject to confidentiality and safeguarding obligations.

• As required by law. We disclose information when required by law, regulation, subpoena, court order, or other legal process, or as permitted by professional standards (for example, a peer review or a disciplinary proceeding before a state board of accountancy or the AICPA).

• With your consent. We disclose information when you direct or authorize us to do so, as required by applicable law.

As a provider of tax and financial services, we comply with the privacy provisions of the Gramm-Leach-Bliley Act (GLBA) and its implementing regulations, as applicable, and with the California Financial Information Privacy Act (Cal. Fin. Code §4050 et seq.). We do not disclose nonpublic personal information to nonaffiliated third parties except as permitted or required by those laws. We maintain client confidentiality in accordance with the AICPA Code of Professional Conduct, including the Confidential Client Information Rule (ET §1.700).

Federal law (IRC §§7216 and 6713, and Treasury Regulations §301.7216-1 et seq.) restricts how tax return preparers may use and disclose tax return information. We use and disclose your tax return information only to prepare and file your returns and as otherwise permitted by those rules. We will not use or disclose your tax return information for any other purpose, including disclosure to a third party, without first obtaining your separate, signed written consent in the form required by law. You are not required to give such consent to receive our tax preparation services. This Privacy Policy is not a consent to use or disclose tax return information.

We maintain administrative, technical, and physical safeguards designed to protect personal information, consistent with the FTC Safeguards Rule (16 CFR Part 314) and IRS Publication 4557, Safeguarding Taxpayer Data. These safeguards include:

• a Written Information Security Plan (WISP);

• encryption of data in transit and at rest through our Microsoft 365 environment;

• multi-factor authentication (MFA) on accounts that access client data;

• limiting access to personal information to authorized persons who need it to provide the Services; and

• a Client Portal (Microsoft OneDrive/SharePoint “Request files”) that lets clients upload documents without seeing other files stored in our system.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Help protect your information by using the Client Portal for sensitive documents and contacting us right away if you suspect unauthorized activity.

We keep personal information as long as necessary to provide the Services and to meet legal, regulatory, and professional requirements. We generally keep tax records and related client files for at least seven (7) years after the related filing. We may keep them longer when required by law or for pending matters. We keep contact form inquiries that do not result in an engagement for up to two (2) years. When information is no longer needed, we dispose of it securely.

Information processed by Microsoft, GoDaddy, and other providers is also subject to their own privacy policies and security practices. We choose providers we reasonably believe maintain appropriate safeguards.

Our Website, hosted on GoDaddy Website Builder, uses cookies and analytics tools to operate the site, remember preferences, and understand how visitors use it. These third parties may collect information about your online activities over time and across different websites. Most browsers let you refuse or delete cookies through browser settings. Some features of the Website may not work properly without cookies. Where available, you may also manage cookie preferences through the cookie banner on the Website.

Some browsers send “Do Not Track” (DNT) signals. Because there is no uniform standard for responding to these signals, the Website does not currently respond to DNT signals. Third parties, including GoDaddy, may collect information about your online activities over time and across websites as described in Section 9.

General choices. You may contact us to review, update, or correct the personal information you have given us, or to ask us not to send non-essential communications. We may need to keep certain information to meet legal and professional recordkeeping obligations.

California Online Privacy Protection Act (CalOPPA). In line with Cal. Bus. & Prof. Code §§22575–22579, this Privacy Policy describes the categories of personally identifiable information we collect, the categories of third parties with whom we may share it, how you may review and request changes to your information, how we notify you of changes to this policy, and how we respond to DNT signals.

California Consumer Privacy Act (CCPA), as amended by the CPRA. As a small practice, we believe we currently do not meet the CCPA’s applicability thresholds. In addition, personal information collected under the GLBA or the California Financial Information Privacy Act is generally exempt from the CCPA. If and to the extent the CCPA applies, California residents may have the right to:

• know what personal information we collect, use, and disclose, and to access it;

• request deletion of personal information, subject to legal exceptions;

• request correction of inaccurate personal information;

• opt out of the sale or sharing of personal information (we do not sell or share personal information);

• limit the use of sensitive personal information (we use it only to provide the Services); and

• not be discriminated against for exercising these rights.

To submit a request, contact us using the information in Section 16. We will verify your identity before responding. You may use an authorized agent as permitted by law.

California Financial Information Privacy Act. We do not share nonpublic personal information with nonaffiliated third parties for their own marketing purposes. We share it only as that law permits, such as to process transactions and services you request, with service providers, and as required by law.