Privacy policy · Taxaia

1. Controller and contact

Taxaia is the trade name of Alberto Soler Palau, tax ID (NIF) 43149579S, with address at Julia Vicenç 26, 07181 Bendinat, Calvià, Spain. For privacy matters and to exercise your rights you can write to hola@taxaia.es or by post to that address, marked "Privacidad".

The owner is the controller of the registration, contracting, support and security data of the service. When a company or professional adds data about their clients, suppliers or employees, that organisation decides the purposes and Taxaia processes the data on its behalf to provide the contracted features.

2. Data we process

Account and contact data: name, email address, user identifier, organisation and access permissions.
Business data that you enter, import or forward: tax details, contacts, invoices, expenses, quotes, documents and bank transactions. Bank connections, when you use them, require their own specific authorisation.
Data from the integrations you authorise, including the emails and attachments described in the next section and the tokens needed to keep the connection alive.
Questions to the assistant, the content needed to answer them, and the results and proposals generated by Taxaia's helpers.
Technical and support data: account activity, security logs, errors, browser information and the communications you send us.
Your digital certificate, only if the owner of the organisation decides to upload it for submissions to the Spanish Tax Agency (Agencia Tributaria). It is stored encrypted, cannot be downloaded and is governed by the custody policy shown when uploading it.

3. Access to Google and Gmail

Signing in with Google and connecting a Gmail mailbox are separate features. Sign-in uses the openid, email and profile permissions to identify you by your Google identifier, email address and name. Signing in does not by itself grant access to the content of Gmail.

If you connect Gmail, Taxaia requests the following permissions:

Read email (gmail.readonly): allows reading messages, senders and recipients, subjects, dates, labels, content and attachments. It is used to find and import invoices and receipts, link communications to your contacts and detect relevant emails through the helpers you enable.
Send email (gmail.send): allows sending from your account the invoices and communications you request or approve. To do so, the recipients, subject, message and attached files are processed.

Google's read permission covers the whole mailbox. Within Taxaia, processing is limited by the helpers, labels, folders and filters you configure; those filters do not reduce the technical scope of the OAuth permission granted to Google. You can also add documents manually or by forwarding without connecting Gmail.

We store the imported documents, the extracted data and the information needed for the enabled features, such as message identifiers and correspondence data. We keep the authorisation tokens encrypted to maintain the connection; we do not ask for or store your Google password.

4. What we use the data for

We use the data to create and manage your account, provide the features you request, organise documents, extract information from invoices, prepare accounting and tax proposals, send authorised communications, manage the subscription, answer questions and protect the service against unauthorised access.

The legal basis for processing is the performance of the contract to provide the service, compliance with legal obligations where applicable, and the legitimate interest in keeping the service secure and dealing with incidents. Optional connections are enabled through your authorisation, which you can withdraw. If processing requires consent, we will ask for it specifically; withdrawing it does not affect earlier processing.

5. Artificial intelligence and limited use of Google data

AI features may process the text of your questions, documents, emails and selected attachments to extract data, classify information, summarise communications and prepare answers or proposals. The necessary content may be sent to the AI provider serving that feature, such as Anthropic, OpenAI or Google Gemini, depending on the service configuration. This processing serves to answer your request and requires processing the content, which may contain personal data.

We do not use our customers' personal data to train AI models. Data obtained through Google Workspace APIs, including Gmail, is not used to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models, and is not transferred to third parties for those purposes.

The use of information received from Google APIs and its transfer to other applications complies with the Google API Services User Data Policy, including its Limited Use requirements. We do not sell this data or use it for personalised advertising, credit assessment or the sale of databases.

Human access to Google data is limited to the cases allowed by that policy, such as your express authorisation to resolve an incident, security needs or a legal obligation. AI proposals may contain errors and you should review them before approving actions with accounting or tax effects or that send communications.

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly affect you. AI proposals are approved by a person in your organisation, except for the actions you yourself set up as automatic.

6. Providers and recipients

We share the necessary data with providers that make the features you use possible. Each one processes only the information needed for its function; not all of them receive the content of your documents or your mailbox. They are:

DigitalOcean, LLC: Hosting of the application, the database, the files and the backups.
Cloudflare, Inc.: DNS, attack protection and receiving the emails, with their attachments, that you send or forward to your Taxaia address.
Anthropic, PBC: Artificial intelligence models: reading documents, accounting and tax proposals, assistant. Not used for training. Depending on the feature you use and the service configuration.
OpenAI, LLC: Artificial intelligence models: reading documents and emails, accounting and tax proposals, assistant and voice note transcription. Not used for training. Depending on the feature you use and the service configuration.
Google Ireland Limited / Google LLC: Sign-in with Google, the Gmail connection and, when enabled, reading documents with Gemini. Not used for training. Only if you sign in with Google, connect Gmail or Gemini extraction is enabled.
Microsoft Ireland Operations Limited: Connection to an Outlook or Microsoft 365 mailbox. Only if you connect a Microsoft mailbox.
Telegram FZ-LLC: Receiving the photos and documents you send to the Taxaia bot. Only if you link Telegram.
Resend, Inc.: Sending service emails: access, notices, and the invoices and quotes you choose to send.
Stripe Payments Europe, Ltd.: Subscription billing, Taxaia invoices and the payment portal. Only if you take out a paid plan.
Functional Software, Inc. (Sentry): Technical error diagnostics. It does not receive the content of your documents.
Brightfield Software B.V. (Distyra): Connection to your bank to read transactions and balance and reconcile them. It uses Enable Banking Oy (Finland), an authorised payment institution, for PSD2 access. Only if you connect your bank.
Enable Banking Oy: Connection to your bank to read transactions and reconcile them. Only if you connect your bank and your bank is served this way.
Amazon Web Services EMEA SARL: Custody of the key that encrypts your digital certificate (AWS KMS, Spain region). It only receives the wrapped key, never the certificate. Only if you upload your own certificate for VERI*FACTU.

The full list, with where each provider processes data and its safeguards, is in annex II of the data processing agreement. If we change it, we will publish it there and give you 30 days' notice.

The members of your organisation and advisors you grant access to will be able to see information according to their permissions. Data is also disclosed to the recipients of the submissions you authorise and to public authorities when you request it through a feature of the service or there is a legal obligation.

If you connect Taxaia to another company's artificial intelligence assistant (for example, ChatGPT or Claude) from Settings → Connectors, that assistant will be able to look up the data of the organisation you authorise and prepare proposals that you approve in Taxaia. What it looks up goes to that provider under your own account with it and subject to its terms and privacy policy: it does not act as a processor for Taxaia. You can disconnect it at any time from the same screen, and its access ends immediately.

Some providers may process data outside the European Economic Area. For transfers that require it, the safeguards provided for in the GDPR will apply, such as adequacy decisions or standard contractual clauses. You can ask for information about, and a copy of, the applicable safeguards through the privacy contact.

7. Protecting the data

Taxaia uses HTTPS connections, encryption of integration tokens, access controls per user and organisation, and activity logs to protect the data. Access to mailbox features is checked against the authorisations in force. These measures aim to prevent unauthorised access, use or disclosure.

We only use technical and preference cookies: keeping the session, completing sign-in with Google or Microsoft and remembering what you choose to hide. There are no advertising or tracking cookies. The full list is in the legal notice.

8. Retention, disconnection and deletion

These are the retention periods:

Account data, documents, invoices, expenses, conversations with the assistant and AI results: for as long as your account or organisation exists. After you ask to leave, they are deleted within 30 days, with the following exceptions.
Issued invoices and their invoicing records: the period required by tax and commercial law (up to 6 years, Article 30 of the Spanish Commercial Code), with access blocked and only to meet legal obligations.
Invoices for your Taxaia subscription: the same periods, as the holder's accounting records.
Sessions and sign-in links (IP address and browser of each sign-in): 90 days after they expire or are closed, so that unauthorised access can be investigated.
Activity log: for as long as the account exists, to protect the service and reconstruct what happened if there is an incident.
Backups: 14 days on the server and 90 days in the off-site copy, which is stored encrypted; both in the European Union. What you delete disappears from them when those periods expire.

We need your email address and your organisation's tax details to provide the service; without them we cannot create the account or issue invoices. You provide the rest of the data depending on the features you use.

You can disconnect Gmail from Taxaia's connector settings and withdraw the permission in your Google account connections. Disconnecting in Taxaia blocks use of the connection and deletes the correspondence records and important-email indicators linked to it. Disconnecting does not automatically delete invoices and documents already imported, nor is it the same as requesting deletion of the account. Disconnecting also deletes the stored access tokens and, for Google, revokes the permission granted.

To request deletion of your account, documents, data imported from Google or connection credentials, write to hola@taxaia.es stating the account and the scope of the request. We will verify your identity and your permissions over the organisation. We will delete the data we do not need to keep; if a legal obligation or dealing with liabilities requires keeping part of it, we will tell you why and limit its processing to that purpose. Backups will be removed according to their retention cycle. In the mobile app you can also delete your user under Account; that does not delete the organisation's data.

9. Your rights

You can request access, rectification, erasure, objection, restriction of processing and portability where applicable, and withdraw your consent, using the contact in section 1. If the data is processed on behalf of a customer organisation, we will pass the request on to that organisation. You can also lodge a complaint with the Spanish Data Protection Agency (AEPD).

10. Changes to this policy

We will publish changes on this page and update the date. When a change significantly affects how your data is used, we will communicate it through the service's channels and ask for a new authorisation where necessary.