Privacy policy

This policy covers the website of Kit Leung CPA. Information you give Kit as a client, for tax or accounting work, is handled under the rules that apply to tax return information. It is used solely to provide the services you engaged Kit for and is not disclosed to anyone except as required by law. How the office itself handles it is set out under How the office handles your information.

What the site collects

When you contact us. The contact form does not send anything to this website. It opens your own email program with your message filled in, and we receive it only if you press send. The email then contains what you wrote: usually your name, an email address or phone number, and your question. If no email program opens, the form offers to copy the message, or to write it in Gmail or Outlook.com. Choosing one of those passes your message to Google or Microsoft in the link that opens their page, and the link stays in your browser history.

When you use the assistant. Your question, as you typed it, is sent to the company that runs the AI model (Anthropic, below) so it can write an answer. A question containing an account number, or anything shaped like a Social Security, ITIN or EIN number, is refused and never sent to the model. Most phone numbers are refused in the same way. An email address, or a phone number written in some formats, reaches the model as typed, although it is removed before the question is written to our log — so please leave them out. That log is a live stream we can watch while it happens; Cloudflare does not store it (Cloudflare).

To keep the assistant from being abused. Cloudflare Turnstile checks that a person, not a program, is asking. It uses signals such as your IP address and browser details. We also count how many questions come from each address, so no one can use up the service. The count is filed under a hashed form of the address rather than the address itself. That is not anonymous: the address could be recovered by trying every possible address against the hash. The count is deleted when its time window ends — within one day.

In your browser. This website sets no cookies and uses no analytics or advertising tools. If you pass an assistant conversation to the contact form, it is held in your browser's temporary storage for that tab and deleted as soon as the form reads it. The checklist, the deadline calendar, the 183-day counter and the estimated-tax calculator run entirely in your browser. What you tick or type into them stays in the page address, after the “#”. Your browser does not send that part to any website, but it does keep it in your browsing history like any address, and anyone you send a copied link to can see it.

Like every website, our host (Cloudflare) receives your IP address and browser details in order to deliver the pages.

How it is used

To answer your question or your message, to keep the assistant working and within its limits, and to deliver the site. The site shows no advertising and shares nothing with advertisers.

Who else sees it

• Cloudflare hosts the site and runs Turnstile. Cloudflare describes Turnstile's data in its Turnstile privacy addendum: the signals are used "solely to detect and block bots."
• Anthropic runs the AI model behind the assistant and receives the question you ask. For its API, Anthropic says it does not use inputs or outputs to train its models by default (Anthropic) and deletes them within 30 days, or, if its safety systems flag a conversation, keeps the inputs and outputs up to two years and its safety classification scores up to seven years (Anthropic).
• Google receives nothing from the contact page itself: it links to Google Maps rather than embedding a map, so Google sees your visit only if you follow that link, and then under Google's own policy (Google).
• Your email provider and ours carry any email you send.
• WeChat and WhatsApp carry any message or document you send the office through them, under their own policies.

Please do not type sensitive numbers into this website

Do not type Social Security numbers, account numbers or other identifiers into the assistant or the contact form. To send documents to the office, see below.

How the office handles your information

These are Kit's own answers, about the office rather than the website.

• Social Security numbers. If you are already our client, we only ask for the last 4 digits of your Social Security number.
• Emails. We keep emails with our client records. Only Kit and her staff read them.
• What we hold. You can ask what information we have about you, and ask us to correct it.
• Selling. We never sell anything you send us.
• Sending documents. You can send documents by email, WeChat or WhatsApp, or bring them to our office. For very sensitive papers, bringing them in person is safest.

Do Not Track

This website does not track you across other websites, so it treats every visit the same whether or not your browser sends a "Do Not Track" signal. It embeds nothing from Google or any other outside party that could recognize you across websites: the office map is a link, not an embed.

Children

This site is meant for adults and businesses. It is not directed to children under 13, and we do not knowingly collect their information.

Changes to this policy

When this policy changes, the new version is posted on this page with a new effective date. A significant change is noted at the top of the page.

Contact

Kit Leung CPA · 228 W Valley Blvd #205B, Alhambra, CA 91801 · (626) 570-4529 · [email protected]