GetW8BEN is designed to prepare a W-8BEN without an account. This policy explains what information the service handles, why it is needed, where it goes, and when it is removed.
1. Scope and who is responsible
This policy applies to getw8ben.com and the GetW8BEN form-preparation service (the “Service”). GetW8BEN (“we,” “us,” or “our”) controls the personal information described here, except for information that Polar collects independently at checkout under its own privacy policy.
The Service is not operated by, endorsed by, or affiliated with the U.S. Internal Revenue Service. This policy does not cover websites or services that we do not control.
2. Information we collect
Form information
We collect the answers you choose to enter, which may include your name, citizenship, date of birth, residential and mailing addresses, U.S. and foreign tax identifiers, reference numbers, treaty information, and related eligibility answers. We use those answers to create your review and generated PDF.
Session and security information
We create a random session identifier and place a signed identifier in an essential browser cookie. For abuse prevention, we create salted, one-way hashes of your IP address and browser user-agent. Raw IP addresses and user-agent strings are not stored in the application database.
Purchase and recovery information
When you buy a document, we receive limited transaction references from Polar, such as checkout, order, customer, and recovery-key identifiers, transaction amount, currency, payment status, and relevant timestamps. We do not receive or store your full payment-card number. Polar collects the checkout and billing information it needs as merchant of record.
Usage, diagnostics, and support
If analytics and error monitoring are enabled, we collect limited funnel events, coarse form context such as a treaty-country code or step name, an anonymous session identifier, and technical error data. Names, addresses, dates of birth, tax identifiers, reference numbers, free-text answers, input text, cookies, and request bodies are excluded from these tools. If you contact support, we receive the message and contact details you provide.
3. How and why we use information
We use information to:
- create, preview, sell, deliver, and recover your completed W-8BEN;
- maintain your anonymous session and confirm access to your form;
- process purchases, refunds, and transaction records with Polar;
- protect the Service from misuse, fraud, and security threats;
- diagnose errors and understand the product funnel without sending form answers to analytics; and
- respond to support, privacy, and legal requests.
Where applicable law requires a legal basis, we rely on performance of our contract with you for document preparation and delivery; our legitimate interests in securing and improving the Service; compliance with legal obligations for transaction and regulatory records; and consent where the law requires it. You may withdraw consent for future processing at any time, but that does not affect earlier lawful processing.
5. Cookies and browser storage
The Service uses an essential, signed, HttpOnly session cookie to keep your form connected to your browser. It is sent only over secure connections in production, uses SameSite=Lax, and normally expires after seven days. Blocking it prevents the wizard from working.
We also use session storage in your browser for an anonymous analytics identifier and limited wizard-activity state. This information normally disappears when the browser tab or session closes. We do not use advertising cookies, cross-site tracking, analytics autocapture, or session replay.
6. How long we keep information
- Anonymous session: normally active for seven days. Security hashes are anonymized when the session expires.
- Unpaid form and preview: removed after a 30-day grace period following session expiry.
- Paid form and PDF: retained for up to seven years from purchase so we can deliver recovery, support refunds or disputes, and maintain records. At the end of that period, the PDF is deleted and personal form fields are removed; minimized purchase records may remain where required for legal or accounting purposes.
- Refunded PDF: scheduled for deletion after the refund is recorded. Other records follow the retention rules above where legally necessary.
- Support and diagnostics: kept only as long as reasonably necessary for support, security, dispute resolution, and legal obligations.
Backup copies may remain for a limited period until they are overwritten under normal backup cycles.
7. Your choices and privacy rights
Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, or objection; withdraw consent; appeal a decision; or complain to your local data-protection authority. We will not discriminate against you for exercising a privacy right.
Because there is no account, include your form ID, Polar order ID, or recovery-key identifier when contacting us so we can locate and verify the correct record. Do not email a full taxpayer identification number or attach your completed form. We may ask for additional verification before acting on a request. Some information may be retained when the law requires it or when needed to establish, exercise, or defend legal claims.
To make a privacy request, email [email protected] with the subject “Privacy request.”
8. Security and international transfers
We use safeguards intended to protect form information, including encrypted transport, signed session cookies, access checks, rate limiting, redaction of sensitive fields from logs and monitoring, and separation of form data from payment and analytics metadata. No online service can guarantee absolute security.
Our providers may process information in countries other than your own. Where required, we use recognized transfer mechanisms and contractual safeguards. Contact us if you want more information about safeguards relevant to your data.
9. Children
The Service is intended for adults who can complete a tax certification and enter into a contract. It is not directed to children under 18, and we do not knowingly collect their personal information. Contact us if you believe a child has provided information.
10. Changes and contact
We may update this policy when the Service or law changes. We will post the revised policy here and change the effective date. If a change materially affects how we use information already collected, we will provide additional notice when required.
Privacy contact
GetW8BEN
[email protected]