Privacy Policy
Version 2026-05-19 · Last updated
1. Who we are
Controller: Fiscaliq (controller details supplied at commercial registration; contact privacy@fiscaliq.co).
Contact / privacy: privacy@fiscaliq.co
2. What we process & legal bases (GDPR Art. 6 / 9)
We do not intentionally collect special-category data (Art. 9). Declared categories: none.
Sensitivity tiers (internal classification)
- High: Exchange API keys (AES-256-GCM at rest in app layer)
- High: UTR, NI number, SSN, TIN if ever typed into forms or PDFs
- High: Bank account / sort code if extracted from uploads
- High: Email + password handled by Supabase Auth
- Medium: Full name, email, phone, professional ID
- Medium: Income figures, tax calculation outputs
- Medium: Transaction history, wallet addresses, reconciliation
- Medium: Residency / DTA scenario inputs
- Medium: AI advisor prompts and structured responses (when logging enabled)
- Low: Primary jurisdiction and tax year preference
- Low: Individual vs service provider
- Low: Client-side workspace keys, cookie consent flags
Legal bases
| Processing | Basis | Article |
|---|---|---|
| Email, password (Auth) | Contract, providing the account | Art. 6(1)(b) |
| Profile & tax inputs | Contract, performing calculations you request | Art. 6(1)(b) |
| Tax calculation results | Contract + legal obligation (record-keeping) | Art. 6(1)(b), 6(1)(c) |
| Exchange API keys | Consent + contract (import you requested) | Art. 6(1)(a), 6(1)(b) |
| AI conversation logs (if enabled) | Legitimate interest / consent where toggled | Art. 6(1)(f), 6(1)(a) |
| PDF text processing | Consent + legitimate interest (tax advice workflow) | Art. 6(1)(a), 6(1)(f) |
| Security / audit log metadata | Legitimate interest, security | Art. 6(1)(f) |
3. Processors & international transfers
We use Supabase (database & auth), Anthropic (AI), and hosting (e.g. Vercel). Processors may be in the United States or other jurisdictions. Where required we rely on Standard Contractual Clauses (SCCs), the UK IDTA / Addendum, and UK adequacy regulations as applicable. We do not sell personal data.
| Processor | Purpose | Location |
|---|---|---|
| Supabase | Auth, database, storage | US / EU (project-dependent) |
| Anthropic | AI advisor messages & redacted PDF text | US |
| Vercel | Application hosting & logs | Global |
| Exchange APIs | Read-only import when you connect | Various |
4. Retention
- Account profile: Until erasure requested or account deleted, Contract
- Transactions / calculations / overrides: 7 years from tax year end (HMRC defence / legal obligation), Legal obligation / legitimate interest (defence of legal claims)
- AI conversations: 12 months unless user opts to retain, Legitimate interest / consent
- Exchange API credentials: Until disconnected or 90 days unused (recommended cleanup), Consent + contract
- PDF raw text: Not stored, process then discard; structured fields follow transaction rules, Consent + contract + minimisation
- Security / audit metadata (security_log): 7 years for tax-adjacent disputes (configure per org policy), Legitimate interest
- Auth session cookies: Session / refresh TTL (provider default, typically ≤ 30 days active use), Contract
5. Your rights
Access, rectification, erasure, restriction, portability, objection, and rights related to automated decision-making (where applicable). Use Settings → Privacy & data rights when signed in, or email privacy@fiscaliq.co.
UK: you may complain to the ICO at ico.org.uk.
6. US privacy (CCPA/CPRA & similar)
We do not sell personal information as defined under the CCPA/CPRA. You may exercise access, deletion, and correction rights through the same controls as above. We will not discriminate against you for exercising privacy rights.
7. Cookies
Essential cookies support authentication and security. Analytics cookies are off unless you opt in via the cookie banner. You can reopen preferences from the site footer.
8. Security & breaches
Transport uses HTTPS. Exchange keys are encrypted in the application layer. A breach response checklist for staff is documented in code at src/lib/privacy/breach-protocol.ts.
This policy is informational and does not constitute legal advice for your organisation.