Privacy Policy

Effective date: 3 September 2026 · Ελληνική έκδοση · Terms of Use

In short: Taxemas has no user accounts, sets no cookies, shows no advertising trackers, and keeps no database of users. Your calculator inputs stay in your browser. We keep only anonymous, cookieless visit statistics that cannot identify you (see 3.7). Data about you leaves your device only when you actively use a specific feature (AI tools, contact forms), and then only as described below.

1. Who is responsible (data controller)

The controller of personal data processed through taxemas.com (the "Service") is Andreas Magirou, the owner and operator of taxemas.com (a private individual based in the Republic of Cyprus). Contact for all privacy matters: info@taxemas.com. This policy is drafted in accordance with Regulation (EU) 2016/679 ("GDPR") and applicable Cyprus law.

2. What we deliberately do NOT do

No user accounts, registration or log-in.
No cookies and no localStorage/sessionStorage for tracking, and the Service works without a cookie banner. One functional exception: the calculators may keep the values you type in your browser's temporary memory (sessionStorage), on your device only, so they aren't lost on a navigation or refresh; they are deleted when the tab closes, are never transmitted anywhere, and are not used for tracking or identification. The visit statistics described in 3.7 store nothing on your device.
No advertising, no tracking pixels, no fingerprinting, no social-media embeds, and no third-party or advertising analytics. The only measurement is the anonymous, aggregate, cookieless visit counting in 3.7 — it cannot identify or re-identify you.
No database of users. We do not build profiles and we do not sell or rent personal data — to anyone, ever.

Technical note: the installable (PWA) version stores copies of the app's own files in your browser's cache so the calculator can open offline. This cache lives only on your device, contains no personal data, and can be cleared by uninstalling the app or clearing browsing data.

3. What is processed, why, and on what legal basis

3.1 Calculator, deduction finder and comparison tools

Everything you type into the calculator and questionnaires (income, family status, deductions, pension details, Provident Fund balance and contributions, etc.) is processed locally in your browser. It is not transmitted to us and we never see it — unless you actively use one of the features below, in which case only the specific data described is transmitted.

3.2 AI receipt/expense reader

Note: this feature is currently switched off. While that is the case, no file uploads take place and none of the processing by the providers described in this section occurs — the description is kept for transparency about how the tool works when active.

What: the image or PDF file you upload, transmitted through our server to our AI provider (OpenAI, L.L.C. — GPT models) to extract vendor, date, amounts, VAT and a category. Storage: the file is processed transiently in server memory and is not saved by us; results are returned to your browser and exist only there. Legal basis: your action of uploading the file (GDPR Art. 6(1)(b) — service you request; where the file contains personal data, Art. 6(1)(a) consent expressed by your deliberate upload). Your responsibility: upload only documents you are entitled to process; avoid uploading documents containing third parties' personal data unless you have a lawful basis. Optional report emailing: if you choose to email your expense report with the receipt files attached, the report and files — together with the name and reply email you enter so the recipient can identify and answer you (used as the sender name and Reply-To of that message) — are transmitted once, at your request, via our email provider (Resend) to the address you specify. We keep no copy of our own; Resend, as our processor, retains the message and attachments for about 30 days for delivery and troubleshooting, then deletes them (see section 4). For abuse prevention, that send is subject to strict volume limits and the sending user's IP address is included in the technical headers of the email. Content screening: the files you upload (images and PDFs) are automatically checked — via the AI provider's content-safety system, plus a technical structure check for PDFs — before any processing or sending. If a file is rejected as unacceptable or technically dangerous content, it is not processed and not forwarded; a security event is then recorded (timestamp, feature, IP address, file type, screening category and — on report sending only — the recipient address and the sender details declared in the form; never the file itself), emailed to the administrator, and kept for as long as handling the incident requires, including any report to the competent authorities — where the law so requires, or where we judge in good faith that reporting a suspected unlawful act is necessary (see section 4). Legal basis: Art. 6(1)(f) — legitimate interest in preventing abuse and reporting suspected crime; and Art. 6(1)(c) where a legal obligation applies.

3.3 Accountant handoff (summary for your accountant)

What: a summary of your own calculation plus questions to ask an accountant. How: it is generated entirely in your browser from your calculator inputs — no AI and no server are involved, and nothing is transmitted to us or to any third party. If you choose to email it, that opens your own email app (a "mailto" link) with the text pre-filled; you send it yourself, and we transmit nothing. Saving it as a PDF also happens on your device. Storage: nothing is stored or sent by us.

3.4 Contact / lead form ("find an accountant")

What: name, email or phone, city, an optional message, your language, plus the firm you selected (if any) — only what you type into the form. Nothing from your calculations (incomes, amounts, results) is sent or included. Where it goes: it is sent once by email, via our email provider, to the selected or automatically assigned Partner Firm and/or to us. It is not written to any database. Storage: the email remains in the recipients' mailboxes; we retain our copy for as long as needed to handle your request and document the referral, then delete it; the delivery provider (Resend, see section 4) also keeps a transient copy of the message (~30 days) for delivery, then deletes it. Legal basis:Art. 6(1)(b) — steps taken at your request prior to entering into a contract with a firm. Important: once a Partner Firm receives your request, that firm is an independent controller of your data under its own privacy policy.

3.5 Partner application form (for accountants)

Firm name, contact person, email/phone, city, optional licence number and message — emailed to us only, to assess and manage the partnership — via the same delivery provider (Resend), which keeps a transient copy (~30 days) for delivery. Legal basis: Art. 6(1)(b). Retained for the duration of the discussion and, if a partnership is agreed, for its duration.

3.6 IP addresses and technical data (security)

What: when you call one of our server endpoints (AI tools, contact form, report sending), your IP address is used to enforce per-user rate limits, and a global daily usage counter is kept. For the optional report emailing, the recipient email address you enter is additionally used as a short-lived counter key, so that no single address can be flooded with sends. Counters are keyed by IP (or, for that feature, by recipient address), are not combined with any other data, and expire automatically (rate-limit windows: ~1 to ~24 hours; daily counter: ~25 hours). Where configured, counters are held for us by Upstash (Redis). Legal basis: Art. 6(1)(f) — our legitimate interest in preventing abuse and controlling the cost of a free service. In addition, our hosting provider (Vercel) generates short-lived technical request logs (IP, URL, timestamp, status) as any web host does, under its own retention rules.

3.7 Cookieless visit statistics (Vercel Web Analytics & Speed Insights)

What: anonymous, aggregate page-view statistics collected by our hosting provider's measurement tool (Vercel Web Analytics). Recorded per view: timestamp, page URL, referrer, coarse location (country/region/city), device type, and browser/OS version. How: no cookies and nothing stored on your device; a visitor is counted via a hash derived from the incoming request, which Vercel automatically discards within 24 hours. The data cannot identify or re-identify you and is not used for cross-site tracking or advertising. Why: to understand which pages are useful and to report aggregate traffic (for example, total monthly visits shown to sponsors — never individual data). Legal basis: Art. 6(1)(f) — our legitimate interest in measuring and improving a free service. Retention: aggregate statistics are retained by Vercel per our plan (currently about one month of history). On exactly the same model (no cookies, no identifiers, aggregate-only) we also use Vercel Speed Insights, which anonymously measures page-loading performance (Core Web Vitals) so we can find and fix slow pages.

4. Recipients and processors

We use a small number of service providers ("processors") that process data on our behalf, under their GDPR-compliant data-processing terms:

Vercel Inc. (USA) — hosting, serverless infrastructure and the cookieless visit statistics described in 3.7.
OpenAI, L.L.C. (USA) — AI model processing for the receipt/expense reader. We send only the content described in 3.2; we use the standard API, under whose terms data submitted via the API is not used to train OpenAI's models. OpenAI may retain API inputs briefly for abuse monitoring under its API data policy before deletion.
Resend, Inc. (USA) — transactional email delivery of form submissions and, at your request, of expense reports (including attachments). Resend retains delivery logs and message content (attachments included) for about 30 days on our current plan under its own policy, then deletes them; early deletion of a specific message is available on request to Resend. Processing is governed by a signed Data Processing Addendum under Article 28 GDPR — processing only on our instructions, security and confidentiality obligations, breach notification without undue delay, a published sub-processor list with a right to object; on termination of the engagement, data is deleted within 90 days.
Upstash, Inc. (USA) — short-lived rate-limit counters (where configured).

In addition, Partner Firms receive lead-form data as described in 3.4 — as independent controllers, not as our processors. We do not share personal data with anyone else, with two exceptions: (a) with the competent authorities (e.g. the Cyprus Police Cybercrime Subdirectorate), where required by law or where we report a suspected unlawful act in good faith — and then only the security-event metadata described in 3.2, never files we do not hold; and (b) to establish, exercise or defend legal claims.

5. International transfers

The providers listed above are established in the United States. For Resend we have concluded a Data Processing Addendum incorporating the European Commission's Standard Contractual Clauses (Decision 2021/914, Module 2: controller → processor), with supplementary measures for public-authority requests. For the remaining providers, transfers rely on the EU–US Data Privacy Framework where the provider is certified and/or on the same Standard Contractual Clauses, together with the providers' technical and organisational safeguards. Given the design of the Service, the personal data actually transferred is minimal and transient.

6. Retention — summary

Calculator inputs: never leave your browser; nothing to retain.
AI-uploaded files and AI outputs: processed transiently; not stored by us.
Rate-limit counters: expire automatically within ~1–25 hours (per-recipient send limits: ~24 hours).
Expense reports you email: delivered to the recipient you specify; we keep no copy of our own, but the sending provider (Resend) retains the message and attachments for ~30 days for delivery, then deletes them.
Lead and partner-application emails: kept in mailboxes only as long as needed for the purpose, then deleted; the delivery provider (Resend) keeps a ~30-day transient copy for delivery.
Security events (content refusals, abuse reports — metadata only, never files): kept for the duration of handling the incident and any proceeding before an authority, then deleted; any IP block is kept for as long as necessary to prevent the abuse.
Hosting request logs: per the hosting provider's standard short retention.
Visit statistics: aggregate only (no individual data); visitor hashes discarded within 24 hours; aggregate history retained by Vercel for about one month on our current plan.

7. Your rights (GDPR)

You have the right to request access to, rectification or erasure of your personal data; restriction of processing; objection to processing based on legitimate interests; and data portability, where applicable. Where processing is based on consent, you may withdraw it at any time without affecting prior processing. To exercise any right, email info@taxemas.com — note that for most of the Service we hold no data about you at all, and for form submissions we may need to search our mailbox by the details you submitted.

You also have the right to lodge a complaint with the supervisory authority: the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (dataprotection.gov.cy), or the authority of your habitual residence.

8. Children

The Service provides tax tools intended for adults and is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has submitted personal data through a form, contact us and we will delete it.

9. Security

The Service is served over HTTPS; API keys are held server-side only; endpoints enforce origin checks, size limits, input validation and rate limits; and the no-database design means there is no user data store to breach. No system is perfectly secure, but the most effective protection here is structural: we simply do not keep your data.

10. Changes to this policy

We may update this policy from time to time. The current version, with its effective date, will always be available at this address. Material changes will be indicated by the updated date. We do not send individual notifications of changes — by design there are no accounts and no stored user contact details to notify; checking the effective date on this page is how you stay informed. Any new processing purpose will apply only to data collected after it is posted.

11. Contact

Privacy questions and rights requests: info@taxemas.com.