Privacy Policy

Effective date: 28 July 2026 · Ελληνική έκδοση · Terms of Use

In short: Taxemas has no user accounts, sets no cookies, shows no advertising trackers, and keeps no database of users. Your calculator inputs stay in your browser. We keep only anonymous, cookieless visit statistics that cannot identify you (see 3.7). Data about you leaves your device only when you actively use a specific feature (AI tools, contact forms), and then only as described below.

1. Who is responsible (data controller)

The controller of personal data processed through taxemas.com (the "Service") is Andreas Magirou, the owner and operator of taxemas.com (a private individual based in the Republic of Cyprus). Contact for all privacy matters: info@taxemas.com. This policy is drafted in accordance with Regulation (EU) 2016/679 ("GDPR") and applicable Cyprus law.

2. What we deliberately do NOT do

No user accounts, registration or log-in.
No cookies and no localStorage/sessionStorage for tracking. The Service works without a cookie banner because nothing is stored on your device — including by the visit statistics described in 3.7.
No advertising, no tracking pixels, no fingerprinting, no social-media embeds, and no third-party or advertising analytics. The only measurement is the anonymous, aggregate, cookieless visit counting in 3.7 — it cannot identify or re-identify you.
No database of users. We do not build profiles and we do not sell or rent personal data — to anyone, ever.

Technical note: the installable (PWA) version stores copies of the app's own files in your browser's cache so the calculator can open offline. This cache lives only on your device, contains no personal data, and can be cleared by uninstalling the app or clearing browsing data.

3. What is processed, why, and on what legal basis

3.1 Calculator, deduction finder and comparison tools

Everything you type into the calculator and questionnaires (income, family status, deductions, etc.) is processed locally in your browser. It is not transmitted to us and we never see it — unless you actively use one of the features below, in which case only the specific data described is transmitted.

3.2 AI receipt/expense reader

What: the image or PDF file you upload, transmitted through our server to our AI provider (OpenAI, L.L.C. — GPT models) to extract vendor, date, amounts, VAT and a category. Storage: the file is processed transiently in server memory and is not saved by us; results are returned to your browser and exist only there. Legal basis: your action of uploading the file (GDPR Art. 6(1)(b) — service you request; where the file contains personal data, Art. 6(1)(a) consent expressed by your deliberate upload). Your responsibility: upload only documents you are entitled to process; avoid uploading documents containing third parties' personal data unless you have a lawful basis. Optional report emailing: if you choose to email your expense report with the receipt files attached, the report and files — together with the name and reply email you enter so the recipient can identify and answer you (used as the sender name and Reply-To of that message) — are transmitted once, at your request, via our email provider (Resend) to the address you specify, and are not stored by us. For abuse prevention, that send is subject to strict volume limits and the sending user's IP address is included in the technical headers of the email.

3.3 Accountant handoff (summary for your accountant)

What: a summary of your own calculation plus questions to ask an accountant. How: it is generated entirely in your browser from your calculator inputs — no AI and no server are involved, and nothing is transmitted to us or to any third party. If you choose to email it, that opens your own email app (a "mailto" link) with the text pre-filled; you send it yourself, and we transmit nothing. Saving it as a PDF also happens on your device. Storage: nothing is stored or sent by us.

3.4 Contact / lead form ("find an accountant")

What: name, email or phone, city, an optional message, your language, and — to help the firm prepare — the approximate income figure you entered, work status and estimated savings from your session, plus the firm you selected (if any). Where it goes: it is sent once by email, via our email provider, to the selected or automatically assigned Partner Firm and/or to us. It is not written to any database. Storage: the email remains in the recipients' mailboxes; we retain our copy for as long as needed to handle your request and document the referral, then delete it. Legal basis:Art. 6(1)(b) — steps taken at your request prior to entering into a contract with a firm. Important: once a Partner Firm receives your request, that firm is an independent controller of your data under its own privacy policy.

3.5 Partner application form (for accountants)

Firm name, contact person, email/phone, city, optional licence number and message — emailed to us only, to assess and manage the partnership. Legal basis: Art. 6(1)(b). Retained for the duration of the discussion and, if a partnership is agreed, for its duration.

3.6 IP addresses and technical data (security)

What: when you call one of our server endpoints (AI tools, contact form, report sending), your IP address is used to enforce per-user rate limits, and a global daily usage counter is kept. For the optional report emailing, the recipient email address you enter is additionally used as a short-lived counter key, so that no single address can be flooded with sends. Counters are keyed by IP (or, for that feature, by recipient address), are not combined with any other data, and expire automatically (rate-limit windows: ~1 to ~24 hours; daily counter: ~25 hours). Where configured, counters are held for us by Upstash (Redis). Legal basis: Art. 6(1)(f) — our legitimate interest in preventing abuse and controlling the cost of a free service. In addition, our hosting provider (Vercel) generates short-lived technical request logs (IP, URL, timestamp, status) as any web host does, under its own retention rules.

3.7 Cookieless visit statistics (Vercel Web Analytics)

What: anonymous, aggregate page-view statistics collected by our hosting provider's measurement tool (Vercel Web Analytics). Recorded per view: timestamp, page URL, referrer, coarse location (country/region/city), device type, and browser/OS version. How: no cookies and nothing stored on your device; a visitor is counted via a hash derived from the incoming request, which Vercel automatically discards within 24 hours. The data cannot identify or re-identify you and is not used for cross-site tracking or advertising. Why: to understand which pages are useful and to report aggregate traffic (for example, total monthly visits shown to sponsors — never individual data). Legal basis: Art. 6(1)(f) — our legitimate interest in measuring and improving a free service. Retention: aggregate statistics are retained by Vercel per our plan (currently about one month of history).

4. Recipients and processors

We use a small number of service providers ("processors") that process data on our behalf, under their GDPR-compliant data-processing terms:

Vercel Inc. (USA) — hosting, serverless infrastructure and the cookieless visit statistics described in 3.7.
OpenAI, L.L.C. (USA) — AI model processing for the receipt/expense reader. We send only the content described in 3.2; we use the standard API, under whose terms data submitted via the API is not used to train OpenAI's models. OpenAI may retain API inputs briefly for abuse monitoring under its API data policy before deletion.
Resend, Inc. (USA) — transactional email delivery of form submissions and, at your request, of expense reports (including attachments). Resend retains delivery logs and message content for a limited period under its own policy.
Upstash, Inc. (USA) — short-lived rate-limit counters (where configured).

In addition, Partner Firms receive lead-form data as described in 3.4 — as independent controllers, not as our processors. We do not share personal data with anyone else, except if required by law or to establish, exercise or defend legal claims.

5. International transfers

The providers listed above are established in the United States. Transfers rely on the EU–US Data Privacy Framework where the provider is certified and/or on the European Commission's Standard Contractual Clauses, together with the providers' technical and organisational safeguards. Given the design of the Service, the personal data actually transferred is minimal and transient.

6. Retention — summary

Calculator inputs: never leave your browser; nothing to retain.
AI-uploaded files and AI outputs: processed transiently; not stored by us.
Rate-limit counters: expire automatically within ~1–25 hours (per-recipient send limits: ~24 hours).
Expense reports you email: delivered to the recipient you specify — we do not receive or keep a copy.
Lead and partner-application emails: kept in mailboxes only as long as needed for the purpose, then deleted.
Hosting request logs: per the hosting provider's standard short retention.
Visit statistics: aggregate only (no individual data); visitor hashes discarded within 24 hours; aggregate history retained by Vercel for about one month on our current plan.

7. Your rights (GDPR)

You have the right to request access to, rectification or erasure of your personal data; restriction of processing; objection to processing based on legitimate interests; and data portability, where applicable. Where processing is based on consent, you may withdraw it at any time without affecting prior processing. To exercise any right, email info@taxemas.com — note that for most of the Service we hold no data about you at all, and for form submissions we may need to search our mailbox by the details you submitted.

You also have the right to lodge a complaint with the supervisory authority: the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (dataprotection.gov.cy), or the authority of your habitual residence.

8. Children

The Service provides tax tools intended for adults and is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has submitted personal data through a form, contact us and we will delete it.

9. Security

The Service is served over HTTPS; API keys are held server-side only; endpoints enforce origin checks, size limits, input validation and rate limits; and the no-database design means there is no user data store to breach. No system is perfectly secure, but the most effective protection here is structural: we simply do not keep your data.

10. Changes to this policy

We may update this policy from time to time. The current version, with its effective date, will always be available at this address. Material changes will be indicated by the updated date.

11. Contact

Privacy questions and rights requests: info@taxemas.com.