1. Data controller

The data controller for personal data processed in connection with TaxVett is the operator of TaxVett, reachable at support@taxvett.com.

2. What data we collect

Account data

• Email address — collected when you sign up or log in via magic link. Used to identify your account, send login links, and for billing if you upgrade to a paid plan.
• API key — we store a one-way hash of your API key, never the key itself.
• Plan and subscription status — free, pro, or enterprise, along with payment-provider customer and subscription IDs for paid accounts.

Usage data

• Request logs — each API call records: a timestamp, the detected country code, the endpoint called, and the response status (valid/invalid/error). The tax number itself is not stored.
• Usage counters — aggregate request counts per API key, used to enforce rate limits and display dashboard statistics.

Technical data

• IP addresses are processed in-flight for routing and abuse prevention but are not stored by TaxVett.
• Standard HTTP request metadata (user-agent, referer) is not logged by TaxVett.

3. Legal basis for processing

Purpose	Legal basis (GDPR Art. 6)
Providing the API service and managing your account	Performance of a contract (Art. 6(1)(b))
Sending magic-link login emails	Performance of a contract (Art. 6(1)(b))
Processing payments via Stripe	Performance of a contract (Art. 6(1)(b))
Aggregate usage analytics (dashboard statistics)	Legitimate interests (Art. 6(1)(f))
Abuse detection and rate limiting	Legitimate interests (Art. 6(1)(f))

4. Data processors (sub-processors)

We use the following third-party services to operate TaxVett. Each acts as a data processor under our instructions and is bound by appropriate data protection agreements.

Service	Purpose	Data region
Cloudflare	Edge network and request routing	Global edge (in-transit only — no long-term storage)
Neon	Account and API key storage	EU
Upstash	Usage counters and short-term cache	EU
Stripe	Payment processing and subscription management	EU/US — see Stripe Privacy Policy
Resend	Transactional email (login links)	EU

5. Data retention

• Account data — retained while your account is active. If you request deletion, account data is removed within 30 days.
• Usage counters — rolling 30-day window, then discarded automatically.
• Request logs — retained for 90 days, then deleted automatically.
• Billing records — invoices and payment records managed by our payment provider are retained for 7 years to comply with accounting requirements.

6. Your rights under GDPR

If you are located in the EU or EEA, you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your account and associated data.
• Restriction — request that we limit how we process your data.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests.

To exercise any of these rights, email support@taxvett.com. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority.

7. Cookies and tracking

TaxVett does not use tracking cookies, analytics scripts, or ad networks. The only session state used is a short-lived login token stored in a secure cookie for authenticated dashboard sessions.

8. International transfers

Stripe may transfer billing data to the United States. Stripe uses Standard Contractual Clauses approved by the European Commission as the legal mechanism for such transfers. All other primary data storage is in the EU.

9. Changes to this policy

We may update this policy as the service evolves. Material changes will be announced via email to registered users. The current version is always available at taxvett.com/privacy.

10. Contact

Questions about this privacy policy or your personal data? Email us at support@taxvett.com.