Terms of Service — draft

Drafting note

Not legal advice. Not reviewed by counsel. Draft v0.1 · 2026-09-24 · not yet published. Drafting notes are in blockquotes like this one; strip them before publishing. {{…}} = fill before publishing.

Business-to-business terms only. The product is not offered to consumers.

Sidesheet Terms of Service

Effective: {{EFFECTIVE_DATE}}

These Terms are an agreement between UNTAP LLC, an Oregon limited liability company that provides Sidesheet ("we", "us"), and the business or firm that creates an account ("Customer", "you"). The individual who creates the Customer's account confirms that they are authorized to bind the Customer; users the Customer invites use the Service on the Customer's behalf under these Terms. The Service is available only to businesses based in the United States.

1. Definitions

• Service: the Sidesheet web application and related support.
• Customer Data: files you upload (including tax returns), the data we extract from them, and the spreads, exports and other outputs the Service generates from them. Outputs of AI processing are Customer Data.
• Account Data: information about your users needed to run your account (names, email addresses, sign-in and billing records).
• Subprocessor: a third party we use to provide the Service, listed at https://sidesheet.co/legal/subprocessors.

2. Your data belongs to you

2.1 Ownership. As between you and UNTAP LLC, you own all Customer Data. We claim no ownership of it.

2.2 Our limited license. You grant UNTAP LLC a limited, non-exclusive license to host, copy, process and display Customer Data only to provide, secure and support the Service for you, and as required by law, and, only if you opt in, for quality improvement under §2.4.

2.3 No training on your data. We do not use Customer Data to train or fine-tune any AI or machine learning model, and we do not allow our Subprocessors to. Our AI provider, Google Cloud, is contractually prohibited from using customer data to train or fine-tune its models without our permission, which we do not give.

2.4 Quality improvement — off unless you turn it on. If you turn on Help improve extraction in your workspace settings, you permit named, authorized UNTAP LLC staff to review copies of Customer Data from uploads you have not marked as prepared by your firm, after we automatically remove names, addresses and taxpayer identification numbers, solely to test and improve the accuracy of the Service. Access is logged. You may exclude any upload, and you can turn the setting off at any time; when you do, we delete the review copies within 30 days. It never applies to returns your firm prepared, or to data uploaded before you turned it on. This permission does not allow training AI models (§2.3), sale, or sharing. You are responsible for having any client consent this use requires (§3.1); our consent template includes an optional item for it.

2.5 No sale, no sharing, no combining. We do not sell, rent, license, or share Customer Data, and we do not combine your Customer Data with other customers' data or with data from other sources.

2.6 Aggregate service metrics. We may keep counts and performance measurements about use of the Service (for example, number of pages processed or processing time) that contain no Customer Data values and cannot identify you, your clients, or any individual.

3. Your responsibilities

3.1 Right to upload. You represent that you have all rights, consents and authority needed to upload Customer Data and to have us process it as described in these Terms, including under any confidentiality agreement with your clients or with a seller of a business, and under the professional rules that apply to you (for example, a state board of accountancy rule requiring your client's written consent before disclosing its information to a service provider).

3.2 Tax return information (26 U.S.C. §7216). If your firm prepared a tax return you upload, you represent and warrant that, before uploading it, you obtained your client's written consent under §7216 and its regulations to disclose it to UNTAP LLC and the Subprocessors that receive return content, and that the consent is in effect. Each upload asks you to confirm one of two statements: that your firm prepared the return and holds that consent, or that your firm did not prepare it and did not take it from its own tax-preparation files. Your answers must be accurate. We provide consent templates as a convenience; they are not legal advice, and you are responsible for your own compliance.

3.3 No tax preparation use. You will not use the Service to prepare, review for filing, or file any tax return.

3.4 Professional judgment. The Service extracts and organizes data using automated processing, including AI, and can make mistakes. You are responsible for reviewing outputs against the source documents before relying on them. The Service does not provide tax, valuation, accounting, or legal advice.

3.5 Accounts. Multi-factor authentication is on by default: every user signs in with an authenticator-app code. An administrator of your firm may make it optional for the firm, and a user who has set one up must then use it at every sign-in. If you make it optional, you accept the lower protection that gives. You are responsible for your users, for keeping credentials secure, and for removing users who should no longer have access. Tell us promptly at security@sidesheet.co if you suspect unauthorized access.

3.6 Acceptable use. You will not: upload malware or files designed to attack the Service; attempt to access another customer's data; probe or test the Service's security without our written permission (report vulnerabilities to security@sidesheet.co instead); or reverse engineer the Service.

4. Security

4.1 We maintain administrative, technical and physical safeguards designed to protect Customer Data, described at https://sidesheet.co/legal/security. Customer Data is encrypted in transit and at rest and is processed and stored in the United States.

4.2 Staff access. UNTAP LLC personnel do not access Customer Data except (a) when you grant support access for a specific issue, for the period you choose, (b) as needed to investigate a security incident or keep the Service running, or (c) as required by law, and (d) only if you opt in, for quality improvement under §2.4. Access is logged.

4.3 Certification status. UNTAP LLC has not completed a SOC 2 audit, ISO 27001 certification, or independent penetration test. We will update https://sidesheet.co/legal/security if that changes.

4.4 Security incidents. If we confirm a security incident that resulted in unauthorized access to or disclosure of your Customer Data, we will notify you within 48 hours of confirming it, and will provide the information we have that you reasonably need to meet your own notification obligations.

5. Data retention, return and deletion

5.1 During your subscription you control Customer Data: you can view, export and delete it at any time. You choose how long uploaded source files and their spreads are kept (for example 30 days, 1, 3 or 7 years); we delete them automatically at the end of that period, and you can delete any file or client sooner.

5.2 On termination you may export Customer Data for 30 days. At the end of that period we delete Customer Data from production systems, and backups containing it expire within a further 30 days. On request we will confirm deletion in writing.

5.3 Legal holds. We will retain Customer Data beyond these periods only where required by law or valid legal process, only for as long as required, and we will tell you unless the law prohibits it.

6. Fees

Drafting note

Drafting note: structure decided 2026-09-24 (docs/pricing-plan.md); amounts are placeholders. Refund and cancellation wording (6.6) is our proposal; decision #4 is still open.

6.1 Plans. You choose a plan on our pricing page (https://sidesheet.co/pricing) or in an order form. Each plan includes a number of Returns per billing period and a number of users. A Return is one entity's federal income tax return for one tax year, including its schedules, statements and K-1s, up to {{PAGE_CAP}} pages. Processing the same Return again does not count as a new Return.

6.2 Beta access and trials. If we give you beta access, the Service is free until the end date we give you, and it does not convert to a paid plan unless you choose one. A self-serve plan may start with a free trial of {{7}} days; we collect a card when the trial starts and show you its end date. During a trial you may process at most 50 Returns; when you reach that number, new uploads pause until you choose a plan. Unless you cancel before the trial ends, your plan starts and your card is charged.

6.3 Limits. When you reach your plan's Return allowance, new uploads pause until you upgrade or buy a one-time pack of additional Returns, or your allowance resets. We never charge for Returns beyond your allowance without your choosing to. On annual plans, the year's allowance is available from the start of the term. Unused Returns do not carry over to the next billing period.

6.4 Payment. Self-serve plans are billed in advance by card through our payment processor, monthly or annually, and renew automatically at the end of each period until you cancel. Enterprise plans are invoiced as stated in the order form, payable within {{30}} days. Fees exclude taxes; you pay applicable sales and use taxes.

6.5 Changes to your plan. Upgrades take effect immediately, with the price difference prorated. Downgrades take effect at the next billing period. We will give you at least 30 days' notice of any price increase, which applies from your next billing period after the notice period.

6.6 Cancellation and refunds. You may cancel at any time; your plan stays active until the end of the period you have paid for, and we do not refund partial periods. We refund prepaid fees for the remaining period if you terminate because we materially breached these Terms and did not cure within 15 days of notice, or under §8 (subprocessor objection).

6.7 Accounts are individual. Each user needs their own login; do not share credentials.

7. Term and termination

7.1 These Terms apply while you have an account. You may close your account at any time.

7.2 We may suspend or terminate your access for material breach not cured within 15 days of notice, or immediately where needed to prevent harm to the Service, other customers, or third parties (including a suspected §7216 violation, §3.2).

7.3 Lapsed subscriptions. If your subscription or beta access ends without renewal, your account becomes read-only: your users can still sign in, view, export and delete Customer Data, but cannot upload or process anything new. This is not termination. Customer Data stays subject to your retention settings (§5.1) until you renew or close your account.

7.4 Users. When an admin removes a user, or a user leaves your account, that user's login is deleted. Records of what they accepted, uploaded and attested are kept as described in our Privacy Policy.

7.5 Sections 2, 3.2, 5, 9–12 survive termination.

8. Subprocessors

8.1 Our current Subprocessors are listed at https://sidesheet.co/legal/subprocessors. We bind each to written terms that restrict use of Customer Data to providing its service to us, and we remain responsible for them.

8.2 We give at least 30 days' notice before adding or replacing a Subprocessor. If you object on reasonable grounds and we cannot accommodate the objection, you may terminate and receive a pro-rata refund of any prepaid fees.

9. Confidentiality

Each party will protect the other's non-public information with at least reasonable care and use it only to perform under these Terms. Customer Data is your confidential information.

10. Warranties and disclaimers

10.1 We will provide the Service with reasonable skill and care and in line with §§2, 4 and 5.

10.2 Except as stated in these Terms, the Service is provided "as is". We disclaim implied warranties of merchantability, fitness for a particular purpose and non-infringement, to the extent the law allows. We do not warrant that outputs will be error-free (§3.4).

11. Liability

11.1 Neither party is liable for indirect, consequential, special or punitive damages, or lost profits, to the extent the law allows.

11.2 Each party's total liability under these Terms is limited to the greater of (a) the fees you paid in the 12 months before the claim and (b) US $10,000.

11.3 The limits in 11.1–11.2 do not apply to your obligations under §§3.1–3.3 and §12, to either party's breach of §9 caused by gross negligence or wilful misconduct, or to liability that cannot be limited by law.

Drafting note

Drafting note: $10,000 floor decided 2026-09-24 so the cap is meaningful during pilots and early months. Higher caps (e.g. a separate data-breach cap) only case by case in Enterprise order forms. Revisit once we carry cyber liability insurance.

12. Your indemnity

You will defend and indemnify UNTAP LLC against third-party claims arising from (a) your breach of §§3.1–3.3, including uploading a return without a consent required by §7216, or (b) your use of outputs without the review required by §3.4.

13. Changes to these Terms

We may update these Terms by giving at least 30 days' notice by email and in the Service. Users are asked to accept the new version the next time they sign in after it takes effect. We will not make any change that expands how we use Customer Data (§2) without your express, affirmative agreement; continued use alone will not count as agreement to such a change.

14. General

14.1 Governing law. Oregon law governs these Terms, without regard to conflict-of-laws rules.

14.2 Disputes. Before starting any lawsuit, the party with the dispute will send the other a written description of it, and both parties will try in good faith to resolve it for 30 days. After that, disputes will be brought only in the state courts located in Marion County, Oregon, or the United States District Court for the District of Oregon, and each party consents to those courts' jurisdiction. Either party may seek urgent court relief at any time to protect its confidential information or data.

14.3 Notices. To UNTAP LLC: legal@sidesheet.co and {{MAILING_ADDRESS}}. To you: the email addresses of your account's admins.

14.4 Neither party may assign these Terms without the other's consent, except in a merger or sale of substantially all assets, with notice. These Terms (with the Data Processing Addendum at https://sidesheet.co/legal/dpa, the Privacy Policy and any order form) are the entire agreement. If an order form conflicts with these Terms, the order form controls for that customer. If a provision is unenforceable, the rest remain in effect.

Drafting note

Open items before publishing

• {{…}} placeholders: fees, trial length, page cap, mailing address.
• Every security statement in §4 must be true in production before publishing (encryption, US-only, logged support-access grant, MFA).
• Create mailboxes: security@, privacy@, legal@sidesheet.co.
• A Data Processing Addendum (checklist §1) will sit alongside these Terms; §§2, 4, 5, 8 are written to be consistent with it.