TaxItEasy Privacy Policy

1. Overview

TaxItEasy® ("we", "us", "our") operates the TaxItEasy platform for invoice processing and document management. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our website and services.

We are committed to protecting your privacy and processing your data in accordance with the General Data Protection Regulation (GDPR) and applicable national data protection laws.

2. Data Controller

The data controller responsible for processing your personal data is:

THE GROVVEST AI LTD
Evangelou Floraki 10, Villa 4
8220 Paphos, Cyprus

Email: [email protected]
Website: taxiteasy.org

3. What Data We Collect

When you create an account, we collect:

• Name — Your first and last name
• Email address — Used for login, verification, and communication
• Phone number — Optional, for account recovery and communication
• Password — Stored only as an Argon2 hash (we never see your actual password)
• Language preference — Your preferred language for emails and notifications (German or English)
• Notification preferences — Your custom notification settings
• Two-factor authentication — If enabled, we store an encrypted TOTP secret for generating verification codes

When you create a company on our platform, we collect:

• Company name and legal form
• Business address — Street, city, postal code, state/province, country
• Tax identification number — Tax ID, VAT number, or EIN (optional)
• Company registration number — e.g. Handelsregister (optional)
• Banking information — IBAN, routing number, and SWIFT/BIC code (optional, stored from invoice data)
• Billing details — Billing email, billing address, and billing VAT ID for invoice generation

When you upload documents, we process:

• Uploaded files — Invoices, receipts, bank statements, and other documents you upload
• Extracted data — Invoice numbers, amounts, dates, VAT rates, sender/recipient details, line items, and other data extracted by our AI
• Metadata — Upload timestamps, file sizes, file types, processing status, and file hashes
• OCR data — Full text extracted from documents via optical character recognition, including confidence scores
• Version history — Previous versions of re-uploaded documents

If you import a bank statement (via statement-file upload, e.g. PDF; automated bank connections are planned), we collect:

• Bank account details — IBAN, BIC, account holder name, bank name, account type, and current balance
• Transactions — Transaction date, amount, currency, description, counterparty name/IBAN, merchant information, and categorization
• Bank statements — Statement periods, opening/closing balances, and transaction summaries
• OAuth tokens — Encrypted access and refresh tokens for API connections (you can revoke access at any time)

If you set up automatic email invoice forwarding, we collect:

• Email credentials — Your email address and app password, stored encrypted (AES) on our servers
• IMAP settings — Server address, port, and folder to monitor
• Processing logs — Email subject, sender address, received date, and number of attachments processed

When you share documents with others (e.g. tax advisors), we collect:

• Recipient information — Name and email address of the person you share with
• Access logs — IP address, browser information, and timestamps of each access to shared documents
• Share settings — Access level, expiry date, password protection status, and access limits

When you use our platform, we automatically collect:

• IP address — For security, rate limiting, and audit logging
• User agent — Browser and device information
• Action logs — Records of actions taken within the platform (uploads, shares, logins, downloads)
• Timestamps — When actions were performed
• Login security data — Failed login attempts, account lockout timestamps

Payment processing is handled by Stripe (PCI-DSS Level 1 compliant). We do not store or have access to your full credit card numbers. We store:

• Stripe customer and subscription IDs
• Subscription status, plan, and billing interval
• Payment confirmation and invoice records (amount, status, dates)
• Last 4 digits of your payment method (for display purposes only)
• Usage records per billing period (invoices processed, storage used)

Our public website carries an AI assistant that answers questions about the product. You do not need an account to use it, and it has no access to any account, document, banking or tax data — it can only read our published website content. When you type a message into it, we collect:

• The message text you type — stored as you wrote it, so please do not type tax IDs, IBANs, card numbers or other sensitive details into it
• The assistant's reply, and whether you rated it helpful
• The page you were on when you opened the chat, and the language of that page
• A random session identifier — generated in your browser tab so the assistant can follow the conversation. It is not linked to any account, and it is not an identifier we can trace back to you

We do not store your IP address or a browser fingerprint against the conversation. See section 11 for who processes these messages and section 6 for how long we keep them.

If you use our iPhone or Android app, we additionally collect:

• Device pairing (iPhone) — when you sign in, the app creates a key pair on your iPhone and Apple confirms (App Attest) that the key belongs to the genuine TaxItEasy app. We store the public key, its identifier, the device name, the app version and the times of pairing and last use. This lets you sign in on that iPhone without a code. You can see and remove paired devices in the app under Settings → Devices.
• Push notifications — if you allow notifications, a push token issued by Apple (iPhone) or by Google Firebase Cloud Messaging (Android), the platform, and the sign-in session that registered it. The token is deactivated when you sign out or that session ends. A notification carries a short fixed text and internal reference numbers only, never amounts, names or document content.
• Crash and error reports — if the app crashes or runs into an unexpected error, it sends a report to our error monitoring service Sentry: device model, operating system version, app version and build, the error message and technical trace, and a random installation identifier created by the reporting library. The report is not linked to your account: it contains no user ID and no email address, and request contents, headers, email addresses, IBANs and access tokens are removed before it is sent. Sentry does not store your IP address for these reports.
• Update check — the app asks the update service of Expo whether a newer version of its program code is available. The request contains the app's version, the platform, the update channel and a random installation identifier, and, like any internet request, your IP address.

If you choose to send us a problem report (“Report a problem” in the web app or the mobile app), we collect:

• Your message
• A screenshot of the screen you were on, if you leave the option switched on — you see it before sending and can switch it off. It can show whatever was on that screen, such as document names or amounts. The app never takes one on sign-in, password, security or two-factor screens.
• Technical context — the page or screen you were on, app or browser version, time, window size, the error message shown, and your last up to five failed requests (method, address with access tokens removed, status, error code and a short error text)

Message and screenshot are stored encrypted, only our support staff can read them, and we delete each report after 90 days, or earlier together with your account.

4. How We Use Your Data

We process your personal data for the following purposes:

4a. Newsletter, and how we measure it (with your consent)

If you sign up for our newsletter on taxiteasy.org, we send you a weekly email about EU tax and compliance topics and TaxItEasy product news. Subscribing is entirely optional and separate from having a TaxItEasy account.

The legal basis is your consent (Art. 6(1)(a) GDPR). We use double opt-in: after you submit your email address, we send you a confirmation email, and only after you click the confirmation link do you become a subscriber. Without confirmation, no newsletter is ever sent to your address.

• Email address — the address you subscribe with
• Consent proof — timestamp and IP address of the signup request and of the confirmation, plus the version of the consent text you agreed to (required to demonstrate consent under Art. 7(1) GDPR)
• Signup source — the page you signed up on and, if your visit came from a campaign link, its UTM parameters
• Measurement consent, if you gave it: timestamp and IP address of the tick or of the click in our re-consent email, plus the version of the consent text, and the timestamp of a withdrawal.

By default our newsletter emails contain no tracking image and no per-recipient link redirects. If you tick the separate measurement box when you subscribe, or accept it later in our re-consent email, two things change: the email contains a tiny image that reports when it was opened, and links in the email pass through our own redirect on api.taxiteasy.org before they reach their destination. Both are first-party; no third party is involved.

What we record per address: the time of the first open, the time of the first click, and small counters. We keep these for 90 days, then they are erased. Per issue we keep totals without any person (how many opened, how many clicked, which link) without a time limit.

What we do not record: your IP address and your email client are used once, at the moment of the hit, to tell a real open from an automatic one (Apple Mail Privacy Protection loads every image in advance; we count those opens as unreliable). Neither is stored. Our servers and our error tracking do not log these requests.

Small counts are never shown: any figure below five stays hidden, so a number can never point at a person.

Forwarding: if you forward a measured email, an open or click by the person you forwarded it to is counted against your address. Do not forward it if you do not want that.

You can stop the measurement at any time without unsubscribing: every measured email carries the link "Stop counting my opens and clicks (keep the newsletter)". Stopping erases the per-address data at once and keeps the proof that you had consented.

Resend, our email provider, receives no measurement data and does not track opens or clicks for us.

We still measure how newsletter content performs in aggregate on our own website (see Section 10): links carry campaign parameters (utm_source, utm_campaign, utm_content) and our own page beacon counts them per page and calendar week, never per person.

Newsletter emails are delivered through Resend, Inc. (United States), under Standard Contractual Clauses — see our Sub-processors page. Unconfirmed signups are deleted after 30 days. Confirmed subscriptions are kept until you unsubscribe. After you unsubscribe we keep your address only to honour the opt-out (Art. 6(1)(f)); ask [email protected] for full erasure. Addresses that bounce or complain go on a suppression list for the same reason.

You can withdraw your consent at any time: every newsletter email contains an unsubscribe link that works without logging in. Withdrawal stops all further newsletter emails immediately and does not affect the lawfulness of processing before the withdrawal. You can also contact us at [email protected]. Most email clients also show a one-click unsubscribe button next to the sender; it uses the same mechanism.

4b. Account, onboarding and product emails, and how we measure them

When you create a TaxItEasy account, we send you a fixed set of emails about that account. They come from Tom Klein <[email protected]>; replies go to [email protected]. This section covers these account emails only. The promises of Section 4a about the newsletter are unchanged by it.

• Account emails — the code that verifies your email address after sign-up and, while the address stays unverified, up to three reminders with a fresh code (after 4 hours, 24 hours and 3 days; then we stop), and a notice when the monthly upload limit of your plan is reached, with up to two follow-ups after 2 and 5 days. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Onboarding help — short emails that help you take the next step in the service you signed up for: company details, your first invoice, the mobile app, your first scan, outgoing invoices and the email inbox, inviting your team; later a monthly summary of what is still open in your account. Legal basis: our legitimate interest in helping you use the service you signed up for (Art. 6(1)(f) GDPR). You can stop them at any time, see below.
• Product tips, the newsletter invitation and our partner programme — only if you ticked the separate box for them when you registered. The box is not pre-ticked; if you left it empty, none of these are sent. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. Ticking that box does not subscribe you to the newsletter: the newsletter still needs its own double opt-in (Section 4a).

Onboarding help and product tips are capped together: in your first four weeks at most three of them in any seven days; from then on at most two in any seven days and six per calendar month. If your account shows no progress for 90 days, you get the monthly summary only. They leave Tuesday to Thursday between 08:00 and 10:00 in your time zone, and not between 24 December and 1 January. If three in a row get no reaction from you, we pause the sequence; after six months without any reaction it ends for good. Verification codes and limit notices are outside these caps: they go out when they are due.

Onboarding help and product tips contain a tiny image that reports when the email was opened, and their main link passes through our own redirect on api.taxiteasy.org before it reaches the app. Both are first-party; no third party is involved, and Resend, our email provider, receives no measurement data and does not track opens or clicks for us. No verification-code email contains a tracking image or a redirect.

What we record per email we sent you: whether your provider reported it delivered, bounced or marked as spam; the time of the first open and what kind of open it was (a person, an automatic pre-load such as Apple Mail Privacy Protection, a security scanner or a preview); the time of the first and the last click; small counters (capped at 50); whether you logged in within 7 days after the email (after a click we know it from the cookie described below, otherwise from the time of your login); whether you completed the step the email was about; and whether you unsubscribed from it. Your IP address and your email client are read once, at the moment of the hit, to tell one kind of open from another, and then discarded: neither is stored, and our servers and our error tracking do not log these requests.

Why: to see which of these emails work, and to stop writing to you when you do not react. The pause after three unanswered emails counts only opens by a person, clicks, logins and completed steps, so an automatic pre-load does not keep the emails coming.

Unlike the newsletter (Section 4a), these records are kept per account, and we look at them per account when we check what a particular email did; the small-count rule of Section 4a does not apply here. We do not use them for pricing, for access to features or for advertising, and we do not pass them to anyone.

When you click the main link of one of these emails and it leads to our login page or to the app, the redirect sets one cookie in your browser, tie_lc: a signed reference to that one email, with no email address and nothing else in it. If you log in within 7 days, we note that this login followed that email; the cookie is deleted at that login and expires by itself after 7 days otherwise. Links to the app-download page carry the same reference as a short code in the address (lc) so that a phone can do the same. The cookie is not set by the cookie banner, because the click happens in your email program, not on our website; you switch it off by objecting to the measurement (next paragraph). See also Section 10 and our Cookie Policy.

We measure these emails on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in knowing whether they help and in not writing to people who do not react. You can object at any time (Art. 21 GDPR): write to [email protected] or [email protected] (Section 8). From then on your emails contain no tracking image and no redirect, no cookie is set, and no login is attributed to an email, including emails sent before you objected.

• Onboarding help and product tips: every one of them carries a stop link at the bottom that works without logging in and stops both kinds at once. Most email programs also show a one-click unsubscribe button next to the sender; it uses the same mechanism. In the app the same switch is in your notification settings, where you can also turn them back on. Stopping does not affect the lawfulness of what happened before.
• Verification reminders: the "Stop these reminders" link ends the remaining reminders and puts the address on our block list (below), so we do not write to it again.
• Limit notices: the link in them stops the follow-ups; the first notice of a month still comes, because it tells you that new uploads are paused.
• Objection (Art. 21 GDPR) to onboarding help and product tips as a whole: write to us (Section 8); it stops both immediately and also withdraws the consent for product tips.
• Restriction (Art. 18 GDPR): while your processing is restricted, verification codes and limit notices still go out, onboarding help and product tips wait, and nothing is measured or attributed.

Some addresses we must not write to again: an address that stayed unverified after all four codes (blocked for 30 days; permanently from the second time), an address whose owner told us "that was not me", an address that reported one of our emails as spam, and an address that bounces permanently. We keep such an address only as a SHA-256 hash, not as the address itself and not linked to an account, so the block still holds after the account is gone. Every email we are about to send is checked against it first.

The record of each email we sent you (which email, when, delivery status, first open and its kind, first click, login within 7 days, step completed, unsubscribed) is kept for 24 months after sending, then deleted. Every further open or click, and the technical class of each hit, is erased 90 days after sending: from then on only the time of the first open and the first click remain. The block list entry stays (hash only). The proof of your consent to product tips (version of the text, time, IP address) stays until your account is deleted, with the time of a withdrawal next to it. Your data export (Section 8) includes these records; deleting your account deletes them, except the hash on the block list.

4c. Our social media pages

We run pages on LinkedIn, YouTube, Instagram and TikTok. When you visit or follow one of them, the platform processes your data under its own privacy policy, and for the page statistics it shows us we are joint controllers with the platform (Court of Justice of the EU, C-210/16). We see aggregate counts only: followers, impressions, reactions per post. For our LinkedIn page we also retrieve these per-post counts (impressions, clicks, reactions, comments) through LinkedIn's API once a day and keep them as daily totals in our own database; they contain no member data. We never receive follower lists or demographics, and we do not combine platform data with TaxItEasy account data.

We upload our own videos to our YouTube channel through YouTube API Services. What that integration accesses, stores and deletes is described in Section 7b.

LinkedIn: LinkedIn Ireland Unlimited Company, Page Insights Joint Controller Addendum. YouTube: Google Ireland Limited. Instagram: Meta Platforms Ireland Limited, Page Insights Controller Addendum. TikTok: TikTok Technology Limited (Ireland).

• TaxItEasy on LinkedIn
• TaxItEasy on YouTube
• TaxItEasy on Instagram
• TaxItEasy on TikTok

4d. Invitations to people without an account

A tax advisor who does not have a TaxItEasy account yet can be invited to open an advisor account. We send such an invitation only on request: either you asked us for access, or you asked one of our partners to introduce you. This section covers the person who receives the invitation.

Your name, email address and practice name, as typed in by the person who invites you: Tom Klein for TaxItEasy, or one of our partners. We did not collect them from you. We use them only to send you the invitation and, if you accept it, to set up your advisor account. We send the invitation once; if the first email did not arrive, it can be sent one more time.

• When we invite you because you asked us for access: steps prior to entering into a contract at your request (Art. 6(1)(b) GDPR).
• When a partner invites you: our legitimate interest in passing on an introduction you asked for (Art. 6(1)(f) GDPR). Before sending, the partner has to confirm that you asked for the invitation.

The person who invited you sees only whether you accepted the invitation, never your clients or your work in TaxItEasy. The email is sent through Resend (Section 7); no one else receives your details.

If you do not accept, we delete your name, email address and practice name 30 days after the link expires. What stays is a one-way fingerprint (SHA-256 hash) of your email address, kept as a record that this invitation was sent, together with who sent it and when; it cannot be turned back into the address. If you accept, your details become part of your account (Section 6).

You can object at any time (Art. 21 GDPR): write to [email protected] or [email protected] (Section 8). An invitation from a partner also carries a link to block all future invitations to your address; it works without an account. A blocked address is kept on our block list (Section 4b) as a hash only, so the block holds. Your other rights under Section 8 apply as well.

5. Where We Store Your Data

Your primary data — documents, invoices, account records, bank transactions — is stored on servers physically located in Frankfurt, Germany (EU), operated by DigitalOcean (DOKS Kubernetes cluster, managed PostgreSQL, Spaces object storage). Your data does not leave the European Union for storage.

Documents are stored in encrypted object storage. Database records are stored in encrypted PostgreSQL databases. All connections between services use TLS encryption.

AI extraction (OCR / document reading) uses the Anthropic API. Anthropic, PBC is located in the United States. Transfers to Anthropic for AI processing are made under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses (SCCs). Retention of API request content follows Anthropic's commercial default (up to 30 days for safety monitoring); a contractual zero-retention addendum is in active negotiation. Messages typed into the AI assistant on our public website are sent to Anthropic in the United States on the same terms — see section 11a. See our Sub-processors page for the full list and transfer mechanisms.

6. How Long We Keep Your Data

7. Who We Share Your Data With

We share your data only with the following recipients (sub-processors and authorized third parties), and only to the extent necessary. The complete current list with locations and transfer mechanisms is on our Sub-processors page.

• DigitalOcean, LLC (cloud infrastructure) — Hosts our Kubernetes cluster, managed PostgreSQL database, and Spaces object storage in Frankfurt, Germany (EU). DigitalOcean is a US-incorporated company; data residency in Frankfurt is contractually guaranteed. DigitalOcean Privacy Policy
• Anthropic, PBC (AI provider) — Processes document content (invoices, receipts) for field extraction via the Claude API, and generates the answers of our public website assistant from the messages typed into it. Located in the United States. Transfers under EU-U.S. Data Privacy Framework and SCCs. Retention follows Anthropic's commercial default (up to 30 days for safety monitoring); a contractual zero-retention addendum is in active negotiation. Anthropic Privacy Policy
• Stripe, Inc. (payment processor) — Receives payment-related data only. Located in the United States. Transfers under EU-U.S. Data Privacy Framework and SCCs. Stripe Privacy Policy
• Resend (outbound transactional, account and newsletter email) — Sends transactional emails (verification, notifications, receipts), the account, onboarding and product emails of Section 4b and, if you subscribe, newsletter emails on our behalf. Receives no open or click data from any of them. Resend Privacy Policy
• MailPace (OhMySMTP Ltd) (inbound email receiving) — Receives emails forwarded to your private @in.taxiteasy.org address and delivers them to our systems for processing. UK company; email data is hosted in France (EU) with backups in Germany (EU). Transfers covered by the UK adequacy decision. MailPace Privacy Policy
• Mistral AI SAS (website assistant) — Generates text embeddings for the public website assistant (chatbot). Receives only messages typed into the website assistant — no account, document, banking, or tax data. EU provider located in France; we configure processing within the EU.
• Sentry (Functional Software, Inc.) (error monitoring) — Receives error events from the web app with limited PII (user ID, IP), and crash and error reports from the mobile app without any account reference and without storing the IP address (see 3.10). Used to detect and fix bugs. Our data is kept in Sentry's EU data region in Germany; as a U.S. company, Sentry is covered by the EU-U.S. Data Privacy Framework and SCCs. Sentry Privacy Policy
• Apple Inc. (iPhone app) — Delivers push notifications to iPhones (Apple Push Notification service) and confirms during sign-in that the app is genuine (App Attest). Receives the push token, the short notification text and reference numbers, and the device key check. Transfers under EU-U.S. Data Privacy Framework and SCCs. Apple Privacy Policy
• Google (Firebase Cloud Messaging) (Android app) — Delivers push notifications to Android phones. Receives the push token, the short notification text and reference numbers, never amounts, names or document content. Transfers under EU-U.S. Data Privacy Framework and SCCs. Firebase Privacy and Security
• Expo (650 Industries, Inc.) (app updates) — Serves the program code updates of the mobile app and receives the app's update check (app version, platform, update channel, a random installation identifier, IP address). Receives no account, document, banking or tax data. Transfers under SCCs. Expo Privacy Policy
• Cloudflare, Inc. (CDN & network security) — Web traffic to our public website (taxiteasy.org) passes through Cloudflare for DDoS protection, WAF, and CDN. Processes IP addresses and request metadata but has no access to documents or account content. Cloudflare Privacy Policy
• Your tax advisor (if you invite one) — Receives access only to invoices and transactions for the company you invite them to. Permissions and revocation are managed in your settings.
• Google (Gmail) / Microsoft (Outlook) (email integration, optional) — If you connect Gmail or Outlook via OAuth, we read invoice emails (read-only scope). OAuth tokens are encrypted at rest.

We do not sell, rent, or otherwise share your personal data with any other third parties.

7a. Google API Services — Limited Use Disclosure

TaxItEasy's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We request the gmail.readonly scope only to identify and parse invoice / receipt emails on your behalf. We never modify, send, or delete email on your account.
• Data obtained via Google APIs is used only to provide and improve user-facing features within TaxItEasy — specifically: detecting invoice emails, extracting attachments, and surfacing them in your document inbox.
• We do not use Gmail data to develop, improve, or train generalized AI / machine-learning models. Per-account OCR / classification runs on the attachments you choose to ingest, never as training input for shared models.
• We do not transfer Gmail data to third parties except as necessary to provide or improve user-facing features (e.g. our OCR sub-processor) or to comply with applicable law.
• We do not allow humans to read Gmail data unless we have your explicit consent for specific messages, it is necessary for security purposes (e.g. investigating abuse), to comply with applicable law, or for our internal operations and where the data is aggregated and anonymized.
• You can revoke our access at any time from the “Email Accounts” settings in TaxItEasy or via your Google Account > Security > Third-party access. On revoke we delete the OAuth token locally and call Google's revocation endpoint to invalidate it server-side.

7b. YouTube API Services

TaxItEasy uses YouTube API Services. We use them for one purpose: to publish our own short educational videos on our own YouTube channel, TaxItEasy on YouTube. This runs in an internal tool that only our company uses. You never connect a YouTube account to TaxItEasy, no part of the app or this website asks you to, and we collect no data about the people who watch our videos.

YouTube is a Google service. How Google processes data is described in the Google Privacy Policy, and the use of YouTube is governed by the YouTube Terms of Service.

THE GROVVEST AI LTD connected its own YouTube channel once through Google's OAuth 2.0 sign-in and granted two permissions: youtube.upload (upload videos) and youtube.readonly (read information about our own channel and videos). We make these calls:

• videos.insert: uploads a short educational video that we have approved to our channel and publishes it at the time we scheduled.
• channels.list, for our own channel only: shows which channel is connected and the ID of its uploads playlist.
• playlistItems.list: reads the uploads playlist of our own channel to confirm that an upload arrived.

• The OAuth refresh token of our channel, encrypted under its own key (envelope encryption) on our servers in Frankfurt, Germany (EU), operated by DigitalOcean. Access tokens are never stored: each task requests one from Google and keeps it in memory only.
• The ID and title of our channel and the ID of its uploads playlist.
• For each upload: the video ID, its link, the ID of the channel it was uploaded to, and when it was uploaded and confirmed.
• An entry in our audit log for each connection and disconnection of our channel, with the channel ID.

We store no personal data of YouTube users: no names, no comments, no subscriber lists, no demographics.

We use this data only to upload our videos and to confirm that they arrived. We do not sell it and do not share it with anyone outside our company, except the processors listed in Section 7 that host and run our systems. The videos and the API requests themselves go to Google, because YouTube is a Google service. No third party serves advertising or content through this integration, and it sets no cookies or similar tracking technology on your device; the cookies of this website are described in Section 10.

We can disconnect the channel in our internal tool at any time. When we do, we revoke the token at Google and delete it at once; the other connection data (channel ID, channel title, uploads playlist ID) is deleted within 7 days. Access can also be revoked at any time on Google's security settings page, security.google.com/settings/security/permissions; if access is revoked there, we delete the token and the connection data within 30 days. The video IDs and links of our own videos, together with the ID of the channel they were uploaded to, are kept as a record of what we published, as long as the video exists on our channel. Our audit log, which records every connection and disconnection and cannot be changed, keeps the channel ID of that event. All periods are listed in Section 6.

Questions about this integration go to [email protected] or [email protected] (see Section 14).

8. Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights:

To exercise any of these rights, contact our data-protection contact at [email protected] (or general support at [email protected]). We will respond to your request within 30 days.

9. Security Measures

We implement the following technical and organizational measures to protect your data:

• Encryption in transit — All data transfers use TLS encryption
• Encryption at rest — All stored data is encrypted with AES-256
• Password hashing — Argon2, a modern memory-hard one-way hash
• Access control — Role-based access with principle of least privilege
• Tenant isolation — Complete data separation between companies at the database level
• Rate limiting — Protection against brute-force and abuse
• Account lockout — Automatic lockout after 10 failed login attempts (30-minute lock)
• Audit logging — Complete trail of all user actions
• File validation — Magic bytes validation to prevent malicious uploads
• Temporary download links — Presigned URLs expire after 1 hour

10. Cookies & Consent

TaxItEasy uses strictly necessary cookies to run the service, plus — only with your explicit consent — preference storage and anonymous analytics. Our website loads Google Tag Manager (container GTM-MZCTLJZD) and Google Analytics 4 (property G-2XK83JG0B3) with Consent Mode v2: all consent signals default to “denied”, and analytics storage is enabled only after you accept the Analytics category in the cookie banner. Advertising signals (ad_storage, ad_user_data, ad_personalization) are permanently denied, regardless of your banner choice — we do not use advertising, retargeting, or social-media tracking cookies. When you create a TaxItEasy account and have accepted analytics cookies on taxiteasy.org, our server reports one "sign_up" event to Google Analytics using the client id from your _ga cookie; without that cookie nothing is sent, and no email address is ever included. One cookie is set outside the banner: tie_lc, by our own redirect when you click the main link of one of the account emails described in Section 4b; see there and the row below.

You can change or revoke your consent at any time via the “Cookie settings” link in the footer. The complete list of every cookie and local-storage entry — including what happens when you revoke — is in our Cookie Policy. The Cloudflare cookies listed above are strictly necessary security cookies set by our CDN provider and cannot be disabled without affecting the security and availability of the service.

11. AI and Automated Processing

When you upload invoices and documents, our AI system automatically processes them to extract structured data (invoice numbers, amounts, dates, etc.). This constitutes automated processing under GDPR.

• AI extraction is performed via the Anthropic Claude API. Anthropic, PBC is located in the United States. The transfer is governed by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses (SCCs). Retention of API request content follows Anthropic's commercial default (up to 30 days for safety monitoring); a contractual zero-retention addendum is in active negotiation.
• Our primary infrastructure (Kubernetes, database, object storage) is EU-hosted in Frankfurt (DigitalOcean DOKS).
• Your documents are not used to train or improve any AI models — ours or Anthropic's.
• AI-extracted data is shown to you for review. An invoice the AI reads with high confidence is created at once and counts in your books as read until you change it.
• You can manually correct any AI-extracted data at any time
• No automated decisions with legal or similarly significant effects are made

Separately from document processing, our public website carries an AI assistant that answers questions about the product. It is anonymous, requires no account, and has no access to customer data of any kind — it answers only from our published website content. What you type into it is processed as follows:

• The answer is generated by the Anthropic Claude API. Anthropic, PBC is located in the United States, under the EU-U.S. Data Privacy Framework and SCCs. The same retention applies as above: up to 30 days for Anthropic's safety monitoring, with a zero-retention addendum in active negotiation.
• To find the right help article, your message is also turned into a numeric representation by Mistral AI SAS, located in France (EU). We pin their EU endpoint explicitly.
• We store the conversation for 90 days and then delete it permanently. It is stored unencrypted, which is why the assistant asks you not to type sensitive details into it.
• Your conversations are not used to train or improve any AI models — ours, Anthropic's, or Mistral's.
• The assistant does not give tax advice and makes no automated decisions about you.

12. Children's Privacy

TaxItEasy is a business tool and is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or through a prominent notice on our platform at least 30 days before the changes take effect.

The "Last updated" date at the top of this page indicates when this policy was last revised.

14. Contact Us

If you have questions about this Privacy Policy, want to exercise your rights, or have concerns about how we handle your data, please contact us:

• Data protection (GDPR rights): [email protected]
• Email: [email protected]
• General support:

You also have the right to lodge a complaint with a supervisory authority in your EU member state if you believe your data protection rights have been violated.