Privacy Policy

1. Overview

This Privacy Policy explains what data Taxxy ("we", "the Service") collects, why, and how it is handled while the Service is in free public beta. Contact for all privacy matters: contact@taxxy.eu.

2. Data We Collect

• Account data — email address, name, country of tax residence (used to select your tax jurisdiction), managed through our authentication provider.
• Transaction data — trades, transfers, and balances you import via CSV files, exchange APIs, or public blockchain addresses.
• Wallet addresses — public blockchain addresses you choose to track.
• Exchange API credentials — if you connect an exchange, your API keys are stored encrypted (AES-256-GCM). We recommend creating read-only keys.
• Technical data — request logs (IP address, timestamps, endpoints) kept for security and debugging.

3. How We Use Your Data

• To import, normalize, and display your transactions.
• To calculate capital gains, income, and tax estimates for your jurisdiction.
• To generate tax reports and forms you request.
• To operate, secure, and improve the Service.

We do not sell your data, use it for advertising, or share it with third parties except the processors listed below.

4. Processors and Sub-processors

Your data is processed by the following infrastructure providers:

• Supabase — authentication and user profiles.
• MongoDB Atlas — transaction and report storage.
• Railway — backend application hosting.
• Vercel — frontend hosting.
• AI providers (via OpenRouter) — only if AI-assisted transaction categorization is triggered, the minimal transaction fields needed for classification are sent; never your credentials or identity.
• Market data providers (exchanges, CoinGecko, blockchain explorers) — receive asset symbols, dates, and public addresses needed to fetch prices and transactions; never your identity.

5. Data Retention and Deletion

Your data is retained while your account is active. You can delete imported transactions and wallets in the app at any time. To delete your account and all associated data, email contact@taxxy.eu — deletion is completed within 30 days. Note that during the beta, backups may persist for up to a further 30 days before being purged.

6. Your Rights

Depending on your jurisdiction (e.g., under the EU GDPR), you may have rights to access, correct, export, restrict, or erase your personal data, and to object to processing. To exercise any of these rights, contact contact@taxxy.eu.

7. Security

• All traffic is encrypted in transit (TLS/HTTPS).
• Exchange API credentials are encrypted at rest with AES-256-GCM.
• Access to production systems is restricted to the operator.

No system is perfectly secure; this is beta software. Avoid granting withdrawal-enabled API keys and report suspected issues to contact@taxxy.eu.

8. Changes

We may update this policy as the Service evolves; material changes will be announced in the application. See also our Terms of Service and Cookie Policy.