DRAFT for attorney review. Replace every [bracketed] item and delete this box before launch.
Who we are
The Abatement Ledger is operated by [OPERATOR LEGAL NAME], [ENTITY TYPE AND JURISDICTION], [REGISTERED ADDRESS] ("we", "us"). We are responsible for the personal information described here. Contact us at . [If the operator is a Singapore organization, add: Our Data Protection Officer can be reached at the same address.]
The short version
- We don't ask for your name, email, phone number or any account.
- You describe a tax penalty case. After a moderator removes identifying details, the case is published.
- Your description may include health, family or financial circumstances. We collect and publish those only with your explicit consent.
- We use cases to publish statistics. We may license aggregated statistics to others. We never license the text of your story.
- You get a deletion code when you submit. Use it at any time to delete your case.
- We don't use advertising cookies or tracking pixels, and sponsors receive no information about you.
What we collect
Case information you submit. Your answers about the penalty (type, year, amount range, how late), your reasons and circumstances, what documents you sent, how the IRS and any appeal or court responded, and your written story. We ask you not to include names, identification numbers, addresses, notice numbers or exact amounts, and our moderators remove any that appear.
Sensitive information. Your answers may reveal information about health (for example, that you or a family member were seriously ill), a death in the family, or your financial situation. Some laws treat this as sensitive personal information or consumer health data. We collect it only after you tick the explicit consent box on the form.
Consent record. Which version of these terms you agreed to, when, and whether you opted in to row-level licensing (see below).
Abuse prevention. When you submit, we compute a one-way, salted hash of your IP address combined with the date and keep it for 48 hours to limit repeat submissions. We never store your IP address itself. Cloudflare Turnstile checks that a person, not a bot, is submitting. It processes browser and device signals under Cloudflare's Turnstile privacy terms.
Site analytics. We use cookieless, aggregate page-view statistics from Cloudflare Web Analytics. They don't identify individual visitors.
Emails you send us. If you email us, we keep your message and address to answer you, then delete them within 12 months unless we need them for a legal reason.
How we use it
- To review and publish your case without identifying details.
- To calculate statistics, the "Similar cases" summaries and statistical models about which factors relate to outcomes.
- To produce aggregated reports and datasets that we may license to researchers, publishers and firms (see "Licensing" below).
- To prevent spam and abuse, and to keep the site secure.
- To comply with the law and respond to lawful requests.
Automated screening. Before a moderator reviews your story, an AI service ([Anthropic, PBC], through its API) may read it to flag identifying details, spam or accusations against identifiable people. The result is shown only to our moderators. A person, not the automated screen, decides whether your case is published. [Confirm the provider's current commercial terms on data use and retention and describe them here.]
Who can see it
- The public sees published cases, without the consent record or any internal notes.
- Our moderators see pending cases. They sign in with individual accounts protected by multi-factor authentication.
- Service providers process data on our behalf under contract: Supabase (database and hosting, [REGION]), Cloudflare (website hosting, bot checks, analytics), [Anthropic] (automated screening), and [EMAIL PROVIDER] (our inbox).
- Sponsors and advertisers receive nothing. They can't see submissions and have no influence on publication or statistics.
- Authorities, if we are legally required to disclose information. We hold very little that identifies anyone.
Licensing
We may license two kinds of data derived from submissions:
- Aggregated statistics, such as relief rates by penalty type and reason. Any group with fewer than 10 cases is suppressed so no individual case can be singled out. This covers every published case.
- De-identified case-level datasets containing only checkbox and drop-down answers. They never include your story, and never include answers about illness, death, who was affected, or documents such as medical records or death certificates. Your case is included only if you ticked the optional licensing box. Recipients must agree in writing not to attempt to re-identify anyone and not to pass the data on except as permitted.
Some state laws may treat licensing personal information for value as a "sale". We don't license any case-level information unless you opted in. You can opt out at any time by deleting your case, or by emailing us with your deletion code and asking us to remove you from licensed datasets. Data already delivered to a licensee before your request can't be recalled, but it won't be included in later deliveries.
We don't "share" personal information for cross-context behavioral advertising, and we don't use targeted-advertising cookies.
How long we keep it
- Pending cases: until reviewed.
- Rejected cases: deleted 30 days after rejection.
- Published cases: until you delete them or we retire the Ledger. We review whether continued retention is needed every [24] months.
- Hashed IP records: 48 hours.
- Statistical snapshots: 90 days (they contain no individual cases).
- Backups kept by our database provider roll off within [7–30] days of deletion.
Your choices and rights
Delete your case at any time on the Remove my case page using your deletion code. Deletion is immediate. Because we don't collect your name or email, the code is the reliable way to prove a case is yours. If you've lost it, email us with enough detail to find the case (penalty, tax year, roughly when you submitted and a phrase from your story). We'll delete it if we can reasonably match it to you.
Withdraw consent. You can withdraw your consent to our processing of sensitive information by deleting your case. Withdrawal doesn't affect processing that happened before it.
Depending on where you live, you may also have the right to know what we hold about you, to get a copy, to correct it, to object to or restrict certain processing, and to opt out of the sale of personal information. This includes residents of California, Colorado, Connecticut, Virginia, Texas, Oregon and other U.S. states with privacy laws; the European Economic Area and the United Kingdom; and Singapore. Email to make a request. We'll respond within the time the applicable law requires, usually 30 to 45 days. We won't treat you differently for exercising your rights.
Appeals. If we decline your request, you can appeal by replying to our decision with "Appeal" in the subject line. We'll respond within 60 days. If you're still unhappy, you can contact your state attorney general or your local data protection authority.
Consumer Health Data Notice
This section applies to residents of Washington State (under the My Health My Data Act), Nevada, and other places with consumer health data laws.
- What we collect: whether a reason for your penalty involved serious illness or incapacity, a death in the family, or who was affected; whether you sent medical records or a death certificate; and any health circumstances you describe in your story.
- Source: only you, through the submission form.
- Why: to publish your case and include it in statistics about penalty relief.
- Sharing: the public sees it in your published case. Our service providers (listed above) process it for us. We never sell consumer health data, and we exclude health-related answers from any case-level dataset we license.
- Your rights: you can confirm whether we hold your consumer health data, see it, have it deleted, and withdraw consent, using your deletion code or by emailing .
Where your data is stored
Our database is hosted in [the United States (Supabase region: e.g. us-east-1)]. If you submit from another country, your information is transferred there. [If the operator is in Singapore: we take steps to ensure transferred data receives protection comparable to the Singapore PDPA, including contractual commitments from our providers.] [For EEA/UK visitors: we rely on the provider's Standard Contractual Clauses / UK Addendum or Data Privacy Framework certification.]
Security
Data is encrypted in transit and at rest. Public visitors can read published cases only through a restricted view. Only moderators can see pending submissions, and they use individual accounts with multi-factor authentication. If a breach affecting your information occurs, we'll notify you and regulators as the law requires. Because we usually can't contact you directly, we would post a notice on this site.
Children
The Ledger is for adults. You must be 18 or older to submit. We don't knowingly collect information from anyone under 18. If you believe a minor has submitted a case, email us and we'll delete it.
Changes
If we change this notice, we'll update the version date at the top. If a change affects how we use cases already submitted, such as a new kind of licensing, we'll apply it only to cases submitted after the change unless the contributor consents.
Contact
[OPERATOR LEGAL NAME], [ADDRESS]. Email: