Privacy Policy

This notice covers the service at taxreclaim.eu. For anything in it, write to privacy@taxreclaim.eu.

What we collect

Account and identity. The email address you sign in with. If you fill in a filing profile so that forms can be generated: your name, tax identification number, street address, postal code, city and country of residence. These identity fields are held in our sign-in system (Supabase Auth) rather than in an application table, which matters for the export described below.

Tax and portfolio data. What you enter or import: asset name, ticker, ISIN, source and residence country, income type, payment date, gross and withheld amounts, exchange rates, share counts, any notes you write, and the holdings you track.

Uploaded broker statements. See the section below; the boundary between what is processed and what is stored is specific.

Billing. Stripe collects your name, billing address and payment details, and optionally a VAT identification number. We never see or store card numbers. We store your subscription status, plan, period dates, Stripe customer and subscription identifiers, and the consents you gave at checkout (which version of the terms you accepted, and your express request to start the service inside the withdrawal period). We also store the raw event payloads Stripe sends us, which contain the billing details Stripe includes in them.

Messages and lead capture. If you use the contact form: your name, email, subject and message. If you ask for a refund estimate by email from the landing page: your email address, whether you consented to marketing, and a snapshot of that estimate (country pair, amount, deadline, form).

Technical. Your IP address, used for rate limiting. Request logs recording method, path, status, duration and a request id, with no request bodies, query strings or headers. Error reports (see below). Analytics, only after you accept them.

Broker statement import

The file you select is uploaded to our server and parsed there. It is not parsed in your browser, and this is also true of the public preview you can run without an account.

The file is held in memory for the duration of the request and is never written to disk. Its name and contents are deliberately kept out of our logs. Nothing from a preview is saved to your account. Rows become stored data only at the separate, signed-in confirmation step where you review them and save them as claims.

One qualification: if the parser hits an unexpected error, the resulting error report can carry part of the file content to our error-monitoring provider. See Error reports below.

Generated forms

PDFs are built for a single request and streamed to your browser. We do not keep a copy. We record that a form of a given type was generated, against your user id.

Why we are allowed to use it

• To perform our contract with you: running calculations, generating forms, keeping your saved claims, running your account and taking payment.
• Legal obligation: billing and accounting records.
• Consent: analytics and advertising cookies, marketing email, and the estimate email you request from the landing page. You can withdraw consent at any time.
• Legitimate interests: keeping the service secure and available (rate limiting, error monitoring), counting server-side product events such as “a form was generated” against a user id, and counting anonymous page views in the browser without cookies or any stored identifier. Neither is governed by the cookie banner, because neither is read from or written to your device.

Cookies, analytics and what actually loads

The behaviour below was measured against the live build rather than described from intent.

Before you answer the cookie banner: no cookies of any kind are set, and no request is made to any Google host. Local storage holds only your interface language and a counter used to decide when to offer the install-as-app prompt. Our product analytics provider (PostHog, EU) counts page views in a memory-only state: it records which pages were viewed, but writes nothing to your device and keeps no identifier that outlives the browser tab, so those views cannot be linked to you, to your other visits or to each other across tabs. Clicks and form input are not recorded at this stage. Cloudflare Web Analytics counts page views the same way: its script sets no cookie and writes nothing to your device, and Cloudflare receives the page address, the referring page, your browser type and your IP address.

We count this way because the alternative understates how many people use the site: most visitors never answer a cookie banner at all, so consent-gated analytics measures a self-selected minority rather than our audience.

If you accept: Google Analytics loads and sets the cookies _ga, _ga_EWQJ6J6T72, AMP_4805a74ea1 and AMP_MKTG_4805a74ea1; PostHog begins capturing events, identified by your user id but not your email or your name; and Amplitude (EU region) begins capturing interactions. Session replay is off. Your choice is stored in local storage as cookie_consent_v1.

If you reject: nothing is loaded from Google, no cookie is set, and the anonymous page-view counting described above stops for you on this device, including on later visits. Cloudflare Web Analytics stops from your next page load, because its script cannot be switched off once it is running in the open tab.

You can change your mind using Cookie settings in the footer, which brings the banner back. If you withdraw consent after having accepted, we stop sending data to these providers, expire the Google Analytics cookies _ga and _ga_EWQJ6J6T72, and clear the flag PostHog stores for your choice. The Amplitude cookies AMP_4805a74ea1 and AMP_MKTG_4805a74ea1, together with the AMP_ entries Amplitude keeps in local storage, are not removed and still hold the device identifier it generated, so delete them in your browser settings if you want them gone.

Besides analytics, the site stores a small number of items on your device: your sign-in session, your cookie choice, your language, an unsaved calculation from the landing-page calculator (kept until it is saved to an account), dismissal flags for prompts and the onboarding checklist, and, inside the signed-in app, a cookie recording whether the sidebar is open.

Error reports

We use Sentry to be told when something breaks. Before an error report leaves our backend we drop the request body on form-generation requests and redact a fixed list of payment and identity fields (including name, tax identification number, address and card data) from the request data and extra context.

That redaction is narrow, and we would rather say so than overstate it. It does not cover variables captured from the stack of the failing function, breadcrumbs, or the query string, and the email address is not on the redaction list. In the browser, error reports are tagged with your user id only, never your email, and no scrubbing beyond that is applied. Treat error reports as a place where fragments of what you submitted can appear.

Who processes your data

We also call external data sources to identify securities and convert currencies: Financial Modeling Prep, EODHD, Yahoo Finance, OpenFIGI, GLEIF, logo.dev, OpenRouter, the ECB and FRED. These receive a ticker, ISIN, company name or currency pair and a date. They receive no name, no email, no user id, no tax identification number and no amount.

Where your data is processed

PostHog and Amplitude are configured to their EU regions, which we have verified in our own code.

For our other providers we are not in a position to publish a verified processing region, and we will not make a blanket claim that everything stays in the EEA. Some of them may process personal data outside the EEA. Where that happens, transfers rely on the safeguards in Article 46 GDPR, principally the European Commission's standard contractual clauses in the provider's data processing agreement. Write to privacy@taxreclaim.eu for information about the safeguards that apply to a specific provider.

How long we keep it

Your claims, holdings and account data are kept for as long as your account exists. We do not delete them on a timer, because they are the record you came here to build: a reclaim deadline can be years after the payment date.

Billing records, including invoices and the raw events Stripe sends us, are kept for as long as accounting and tax law requires us to keep them, and Stripe keeps its own copy under its own retention rules.

Contact messages, lead-capture rows and email bounce records are kept until you ask us to erase them.

We do not currently publish a fixed retention period for logs, analytics events or error reports. If you need to know what is held about you in any of these, ask us.

Getting a copy of your data

There is a self-service export on the Settings and Billing pages. It returns a JSON file containing your saved claims, your subscription and billing status, usage counters, holdings and dividend inputs, and the log of emails we sent you.

The export is not complete, and we would rather tell you than let you assume otherwise. It does not include the identity data held in the sign-in system (your name, tax identification number and address), and it does not include several other records that mention you, such as analytics events, promotional code assignments, filing packages, contact messages and lead-capture rows. For a complete copy under Article 15 GDPR, email privacy@taxreclaim.eu and we will assemble it by hand.

Deleting your account

Two buttons exist, and they do different things.

Settings → delete account deactivates the account. Sign-in is blocked, the account is flagged as deleted, your subscription is set to cancel at the end of the paid period, and you are given a single-use link that restores the account within 14 days. Restoring does not undo the subscription cancellation. Your data rows are not deleted at this point. A scheduled job is meant to erase the account once the 14 days pass; we cannot currently confirm that it runs in production, so we do not claim your data is permanently deleted by it. If you want erasure to be certain, use the second button or email privacy@taxreclaim.eu.

Billing → delete my data is immediate and irreversible. It deletes your sign-in identity, which cascades to your claims, holdings, dividend inputs, subscription and usage records, email log, profile, filing packages, promotional records and restore tokens. There is no grace period and no restore.

Some records survive either route:

• analytics events, which are kept with the link to your user id removed but with their event properties intact;
• lead-capture rows, contact messages and email bounce records, which are keyed by email address rather than by account;
• any data export file you generated, which is stored in our export bucket and is not removed by account deletion;
• billing records at Stripe and the Stripe events stored on our side, which are retained for legal and accounting reasons.

To have any of these erased as well, email privacy@taxreclaim.eu.

Your other rights

You can ask us to correct data that is wrong, to restrict or object to processing, and to receive your data in a portable form. Where we rely on consent, you can withdraw it without affecting what we did before you withdrew it. Requests go to privacy@taxreclaim.eu.

You also have the right to complain to the data protection supervisory authority in the EU country where you live, where you work, or where you think the problem happened.

Security

How access is isolated, what our providers are certified for, and how to report a vulnerability are set out on the Security page.

Changes to this notice

When we change this notice we update the date at the top. Material changes to how we use data you have already given us will be described here rather than made quietly.

Contact

privacy@taxreclaim.eu for data protection. support@taxreclaim.eu for anything else.