Privacy Notice

Act 60 Filing. Version 2026-10-19.2. Effective October 19, 2026.

This notice has two parts. Part A is the standard federal privacy notice that financial institutions, including tax preparers, give under the Gramm-Leach-Bliley Act. Part B explains in more detail what we collect, how we use and protect it, who helps us, how long we keep it and your choices, including the rules of Puerto Rico.

This notice is not a consent to disclose or use your tax return information. When the law requires your consent (for example, before we use AI checks on your documents), we ask for it in a separate document that you sign.

Part A. Federal privacy notice (Gramm-Leach-Bliley Act)

rev. October 2026

Part B. Full Privacy Notice

1. Who we are and what this notice covers

"Act 60 Filing," "we," "us" and "our" mean Brian Bailey, doing business as Act 60 Filing, and, once it is formed (expected on or about January 1, 2027), Fast Filing LLC, a Puerto Rico limited liability company doing business as Act 60 Filing, which will take over this relationship.

This notice covers information we collect through our website at act60filing.com, our client portal and email, and while we prepare your returns. It applies to people who visit our site, people who ask for a quote, our clients, and people whose information our clients give us (for example, a spouse, dependents, business co-owners or officers).

We are a tax return preparation service. Federal law treats tax preparers as financial institutions for privacy purposes. Several laws protect your information, and we follow the strictest rule that applies:

•section 7216 of the Internal Revenue Code and its regulations, which make it a crime for a tax preparer to disclose or use tax return information without consent except as the law allows;

•the Gramm-Leach-Bliley Act privacy rule (Regulation P) and the Federal Trade Commission's Safeguards Rule;

•the Puerto Rico Internal Revenue Code, which limits how preparers may use and disclose information from Puerto Rico returns; and

•Puerto Rico Act 111-2005 on security breach notification.

2. What we collect

We do not buy personal information, use data brokers or pull credit reports.

3. How we use your information

We use your information only to:

1.provide our services: decide whether we are a fit, prepare a quote, prepare and file your returns and related filings, answer your questions and support you;

2.operate your account securely: verify your identity, keep your account safe, detect and prevent fraud and misuse;

3.comply with the law: keep the records preparers must keep, respond to lawful requests from courts and government agencies, and meet our regulatory duties;

4.bill and collect our fees; and

5.maintain and fix the portal, using information about how the portal is used (not the contents of your tax documents).

We use tax return information only to prepare your returns and provide the services you ask for, or as the law otherwise allows.

We never:

•sell your information;

•use your information for marketing, or share it with anyone so they can market to you;

•use your information, or let anyone use it, to train AI models;

•share your information with our affiliates; or

•create statistics from your information for marketing or advertising.

4. AI checks

Our own software, running on our own servers, reads the documents you upload; no outside company or AI reads them for that. With your separate written consent, we also use AI tools, currently Claude from Anthropic, PBC, on copies with identifiers removed, for four things only: reviewing the documents you upload for your quote; reading a figure our own software could not read with confidence; checking the returns we prepare before we file them; and answering questions you type in the "Message us" panel from our own approved help articles (your message is sent with identification numbers removed and without your account details). A member of our team reviews every AI output about your documents or returns before we rely on it or send you anything based on it; the help panel's general answers are marked as coming from our assistant, and questions about your own return go to a person.

•Optional, and the same price either way. No AI tool processes your tax return information unless you have signed our consent under section 7216 and it is still in effect. If you do not consent, or you revoke your consent, our team prepares your returns without AI checks, at the same price, and no AI tool sees your information.

•Redaction first. Before a document goes to the AI provider, our system automatically removes or replaces names, taxpayer identification numbers, account numbers and addresses, and a second automated check blocks any document that still appears to contain them. Automated redaction is not perfect, and some identifying information may still be sent.

•United States only. We configure our account with the AI provider so your information is processed only in the United States.

•No training, limited retention. The AI provider's commercial terms prohibit it from training its models on what we send. It deletes what we send within 30 days, except where it must keep it to comply with the law, or where its automated safety systems flag a request as possibly violating its usage policy, in which case it may keep the request for up to 2 years.

5. Who we share it with

We share your information only as described here. We require every service provider that receives your information to protect it and to use it only to provide services to us.

5.1 Service providers

Electronic signatures are made in the portal itself, so no signature company receives your documents.

We will give you at least 30 days' notice in the portal before we add a service provider that will receive your tax return information.

5.2 Others

•Tax authorities. We file your returns and reports with the IRS, Hacienda, DDEC, CRIM, the Puerto Rico Department of State and municipalities, as your engagement requires and you authorize.

•People you direct. We share information with our partner CPA firm, your attorney or other advisers, or with users you invite to your account, only as you direct and, where the law requires, with your written consent.

•Legal requirements. We disclose information when the law requires it, for example in response to a court order, subpoena or lawful request from a regulator, and we tell you first unless the law prohibits it. We may also disclose information to the extent the law allows to secure legal advice, to defend ourselves in a claim, or to report a crime.

•Change of business. Fast Filing LLC will take over this relationship when it is formed. If our business is ever sold, your information may be transferred only as federal tax law allows, and it will remain subject to this notice.

6. Where your information is kept

We store and process your information in the United States, including Puerto Rico.

7. How we protect your information

•Encryption. Information is encrypted in transit and at rest. Your tax documents and identification numbers get an extra layer: they are encrypted before they reach our database, using keys held in AWS Key Management Service, separate from the database provider.

•Two-step sign-in. Clients must use two-step sign-in before uploading documents or seeing sensitive information, and enter a fresh code to sign a document. Our team uses two-step sign-in on every system that holds client information.

•Least access and logging. Only people who need access to do their work have it, and access to your information is logged.

•Redaction before AI. Identifiers are removed or replaced before any document goes to an AI provider, and a document that fails the check is not sent.

•No identifiers in email or web addresses. We never put identification numbers or tax figures in emails or in web addresses.

•A written security program. We maintain a written information security program under the FTC Safeguards Rule, overseen by Brian Bailey as our Qualified Individual, including risk assessments, vendor oversight and an incident response plan.

No system is perfectly secure. If you think your account has been compromised, tell us immediately.

8. How long we keep your information

Why we keep client records indefinitely. A tax authority can examine a return years after it is filed (the IRS has three years in most cases, six years for a large omission of income, and no limit when no return was filed or for fraud; a Puerto Rico resident who files no federal return leaves every year open), and claims about our work can come later still. Keeping a client's documents, returns and our working papers lets us support the return and our work whenever that happens. This is the legitimate business purpose for which the FTC Safeguards Rule allows us to keep client information beyond its usual two-year limit. We review what we keep each year and dispose of anything we no longer need for these reasons. Removing a document from your portal hides it from your view; it does not delete our copy.

9. Your rights and choices

You may:

•see and download your information in the portal, or ask us for a copy;

•correct information that is wrong;

•ask us to delete your information; we delete what we do not keep for the reasons in Section 8, and tell you what we keep and why (removing a document from your portal hides it from your view but does not delete our copy);

•ask for a copy of any document you gave us, at any time;

•revoke your AI consent at any time in the portal; from then on, no AI tool processes your information, and our team continues your work without AI checks;

•withdraw your consent to electronic records, as described in that consent (because our service is delivered through the portal, this may end our services);

•close your account; and

•complain to us, to the Puerto Rico Department of Consumer Affairs (DACO), to the Federal Trade Commission, or, if you believe your tax return information was disclosed or used improperly, to the Treasury Inspector General for Tax Administration (TIGTA) at 1-800-366-4484 or complaints@tigta.treas.gov.

Because we do not share your information for marketing or with affiliates, there is nothing you need to opt out of.

To make a request, message us in the portal or email admin@act60filing.com. We will verify your identity before acting and respond within 30 days. We will not treat you differently for exercising these rights.

Puerto Rico does not currently have a general consumer privacy law beyond the rules described in this notice; we give these rights to every client wherever they live. If the law of the place where you live gives you more rights, contact us.

10. If there is a security breach

If a security breach affects your personal information, we will:

1.notify you as quickly as possible, taking into account any request from law enforcement and the steps needed to restore the security of our systems, and in any case within the time the law requires;

2.report the breach to DACO within 10 days of detecting it, as Puerto Rico Act 111-2005 requires (DACO then announces it publicly);

3.tell you, in plain terms, what happened, what kind of information was involved, what we are doing, what you can do, and how to reach us for more information;

4.notify the IRS, the FTC (for an event involving 500 or more people, within 30 days of discovery, as the Safeguards Rule requires), and any other authority the law requires; and

5.notify you even when the information was encrypted, if we have reason to believe the encryption key was also compromised.

If a breach at one of our service providers affects your information, we will notify you in the same way.

11. Children

Our services are for adults. We do not knowingly collect personal information online from children under 13, and only people 18 or older may open an account. When clients give us information about their minor dependents, we use it only to prepare their returns.

12. Cookies and tracking

We use only the cookies needed to run the site, keep you signed in, remember your language and protect your account. We do not use advertising or analytics cookies, we do not track you across other websites, and we do not let advertisers track you on our site.

13. Changes to this notice

We will post any change to this notice on our website and in the portal. If a change is material, we will tell you at least 30 days before it takes effect. We will never use information we already have in a materially new way without your consent. We give you this notice when you open an account and whenever we change it. Because we share information only in ways that federal law does not let you limit, and we have not changed our practices, federal law does not require us to send this notice to you every year.

14. Contact

Act 60 Filing (Brian Bailey, doing business as Act 60 Filing)

Privacy questions and requests: admin@act60filing.com, or a message in the portal. We handle requests in writing.