The change

TaxDome is practice management software that accounting and tax firms use to store client documents, collect e-signatures and take payments from clients. On November 2, 2026, it rewrote its Terms of Service, Privacy Policy, Data Processing Addendum and list of sub-processors.

TaxDome’s own update notice lists “New provisions covering TaxDome AI (and related data use), impacting U.S. users,” along with pricing changes for all users and new terms for integrations. The sub-processor list now shows “Last updated: November 2, 2026,” where it used to show January 27, 2023.

What changed

• Client data can improve TaxDome’s products. The DPA now says “TaxDome may use personal data for internal use and improvement of its products and services as permitted by Applicable Data Protection Law.”

• The AI training line is narrower. The Privacy Policy used to say “Your data is not used for AI model training purposes.” Now it says “TaxDome AI models do not train on Personal Data.”

• Anonymized data can be commercialized. TaxDome may “create, disclose, commercialize, and otherwise use Aggregate Data and Anonymized Data received or created from providing the Services.”

• No more return option. The DPA used to say TaxDome would “delete, or at customer’s request, return all personal data” when an account ends. Now it says TaxDome “will delete all personal data.”

• Client consent is on you. The new AI section says TaxDome does not inform your clients or obtain their consent on your behalf.

• AI vendors on the list. OpenAI is now listed for “AI processing for in-app AI features (when enabled)” and OpenRouter for “AI model routing for in-app AI features (when enabled).”

The AI training promise, before and after

The old Privacy Policy had a short list of safeguards for TaxDome’s AI features. One of them read: “No training: Your data is not used for AI model training purposes.”

The new version replaces it with two narrower lines: “TaxDome AI models do not train on Personal Data” and “Personal Data will not be used to train commercial third-party AI models.” Both promises cover Personal Data only. The same paragraph says TaxDome uses anonymized and aggregate data “to provide, support, maintain, secure, analyze, and improve Services.”

The Terms of Service go further. A new “Use of Data” clause in the TaxDome AI section says “TaxDome will use Anonymized Data and Aggregate Data to test, improve, monitor, and otherwise provide the Services as detailed in our Privacy Policy,” including “To test new TaxDome AI features, Services, or other products.” You must also have the legal basis to let TaxDome use data for “improving and training our products and Services as set forth herein and in our Privacy Policy.”

The old AI section in the Terms was much shorter. It said that “The AI features within TaxDome are powered by technology provided by OpenAI and Google” and asked you to follow their usage policies.

What the DPA now allows

The DPA is the contract for the personal data you upload about your clients. TaxDome acts as your processor, and the DPA says the customer “maintains control over its clients’ personal data.”

The old DPA said TaxDome would process that data “only to the extent strictly necessary for the purpose of providing the services.” The new one still says TaxDome is “prohibited from using the personal data it receives from Customer for any other purpose,” and then adds two exceptions. TaxDome “may use personal data for internal use and improvement of its products and services as permitted by Applicable Data Protection Law.” It also “may generate anonymized data from any Customer Data, including personal data, and use the resulting data for any lawful purpose,” as long as that data cannot be used to identify a person or a customer again.

The old DPA had a California section that let TaxDome de-identify or aggregate personal data “as part of performing the Service.” That section is no longer in the DPA.

The Privacy Policy widened the same way. The old text said TaxDome “may disclose aggregated, non-personal data received from providing the Services, including information that does not identify any individual, without restriction,” and allowed demographic information to be shared with business partners once aggregated. The new text lets TaxDome “create, disclose, commercialize, and otherwise use” aggregate and anonymized data and share it “for any legal purpose, including with our business partners.”

Getting your data back when you leave

The old DPA gave you a choice when your account ends: “TaxDome will delete, or at customer’s request, return all personal data in accordance with our standard backup and retention policy per the ToS, normally, no later than 90 days.”

The new DPA keeps the deletion and drops the return: “TaxDome will delete all personal data in accordance with our standard backup and retention policy per the Terms, normally, no later than 90 days.” The Terms still mention “standard backup tools provided by the TD Platform,” so the safe move is to export what you need before you close the account.

Other changes in the update

• Pricing. TaxDome may now charge “on a user, per-feature or per-client basis, or as otherwise set forth at your time of payment or in an order form.” The old text said “on a periodic (e.g., weekly or monthly) basis or otherwise.”

• Sensitive data. The old Privacy Policy said “We do not collect any special categories of Personal Data about you.” The new one says some data “may be considered ‘Sensitive Personal Information’ under the applicable law” and lists “research and development” among the purposes it may be used for.

• AI output. You may not use TaxDome AI “as the sole basis for decisions that produce legal or similarly significant effects on individuals (including tax-related decisions) without appropriate human review and compliance checks.”

• Courts. The Terms now follow Wyoming law instead of New York law, and disputes go to courts in or with jurisdiction over Chicago, Illinois, instead of New York.

What improved

• The DPA adds a breach notice deadline: TaxDome must notify you “promptly (and in any event within 72 hours)” when it believes a security incident has happened.

• The DPA now says TaxDome “shall not Sell (as defined in the CCPA) or Share (as defined in the CCPA)” the personal data it processes for you.

• The Privacy Policy says data sent to third-party AI models “is not stored on those providers’ AI servers beyond the processing of your request.”

• TaxDome says it will exclude a client from TaxDome AI processing at your request.

Why this matters

Firms keep their clients’ tax documents in TaxDome, so a change in how TaxDome may use that data reaches people who never signed up for TaxDome themselves. The DPA is also the document a firm points to when a client asks who can use their data.

AI promises are narrowing across vendors. Retool dropped its promise not to train its own AI on customer data, and Articulate’s AI training promise now covers only generative models. Exit terms are moving too: Airtable no longer gives you 30 days to export data after you leave, and StreamYard can now keep personal data for three years after you leave.

A DPA is easy to forget once it is signed. That is why vendor contract monitoring should cover DPAs and AI subprocessors, not only the Terms of Service.

Potential impact

If you use TaxDome, the update raises four practical questions:

• Do your engagement letters or privacy notices tell clients that their data may be used to improve TaxDome’s products?

• Which clients should be excluded from TaxDome AI processing?

• Does your security review rely on the old line “Your data is not used for AI model training purposes”?

• Have you exported the files you need, now that the DPA no longer offers to return them?

How Venpo detected it

Venpo monitors TaxDome’s legal pages and flagged each rewritten document, with every inserted and deleted line marked. You can see the Data Processing Addendum change on Venpo and the Privacy Policy change on Venpo. Every quote in this article was checked against those redlines.

Business outcome

Firms that catch this update can ask TaxDome to exclude sensitive clients from its AI, update their client notices and keep their own backups before anyone asks. That is the point of continuous vendor risk monitoring over a yearly review, as this comparison of manual and automated vendor monitoring shows.

Key takeaway

Since November 2, 2026, TaxDome’s DPA lets it use client data to improve its own products, its no-training promise covers only Personal Data, and the option to get your data back when you leave is no longer in the contract.