1. Who we are
TAXCLARA is operated by CYBER MIND Unipessoal LDA, a company registered in Portugal (“we”, “us”, “our”). We are the data controller for the personal data described in this policy. You can reach us at support@taxclara.pt.
A plain-language summary of how we handle your data is at taxclara.pt/trust. This page is the full legal version.
2. Data we collect
- Account data — your name and email address, provided when you sign in with Google or Apple, or when you register directly.
- Financial data you add — receipts you photograph, transactions, bills, budgets, invoices, loans, and documents you upload or connect (for example an email inbox you choose to scan for bills).
- Household data you add — if you use the tax estimate features: household member names, salary details, marital status, number of dependents, and tax regime. You choose whether to enter this.
- Bank data — where bank connections are available: account names, IBANs, balances, and transaction history retrieved via a PSD2-regulated open banking provider. We never see or store your bank login credentials.
- Technical data — session cookies needed to keep you signed in, and error reports (crash diagnostics) so we can fix problems.
3. AI processing of your documents
TAXCLARA’s core feature is understanding financial documents with AI. When you scan a receipt, import a bank statement, use AI categorization, or ask the in-app assistant a question, the relevant content (the document image or the financial records involved) is sent to Anthropic, the provider of the Claude AI models, for processing. This happens only to deliver the feature you invoked — the legal basis is performance of our contract with you (GDPR Art. 6(1)(b)).
- Never used for training. Anthropic does not use data sent through its API to train its AI models.
- Processed under a data processing agreement with Standard Contractual Clauses covering the transfer of data outside the EEA.
- Short retention. Anthropic retains API inputs and outputs only temporarily (up to 30 days, for abuse prevention), after which they are deleted. Your data lives in TAXCLARA, not at Anthropic.
- No identity attached. We send the document content itself — not your name, email, or account identity. The AI sees a receipt, not a person.
4. How we use your data
Your data is used exclusively to provide the service:
- Reading and organizing the documents you submit.
- Displaying your balances, transactions, budgets, and reports, and sharing them with the workspace members you invite.
- Computing estimates such as your IRS withholding and deduction picture from the data you entered.
- Sending you the emails you asked for (such as bill reminders or the tax update digest, each with its own unsubscribe).
We do not sell your data, share it with advertisers, or use it for any purpose other than running TAXCLARA for you.
5. Who processes your data
We use a small number of service providers (processors), each bound by a data processing agreement:
- Anthropic — AI document understanding (see section 3).
- Enable Banking — PSD2-regulated Account Information Service Provider for bank connections. It passes data through from your bank and does not store your financial data.
- Vercel — application hosting and private file storage for your uploaded documents.
- Neon — managed PostgreSQL database where your data is stored, encrypted at rest.
- Resend — transactional email delivery.
- Sentry — error and crash reporting.
- Apple / Google — sign-in and (on iOS) push notification delivery.
Where a provider processes data outside the EEA, the transfer is safeguarded by Standard Contractual Clauses under GDPR Chapter V.
6. Storage and security
All data is encrypted in transit (TLS) and at rest. Uploaded documents are stored in private storage accessible only through your authenticated account. Bank connections use PSD2 open banking with time-limited consents (up to 180 days) that you re-authorize explicitly and can revoke at any time from Settings.
7. Retention and deletion
Your data is retained while your account is active. You can delete individual items at any time, disconnect banks (which deletes the connection), and delete your entire account from Settings — deletion is permanent and removes your data from our systems. You can export everything first from the same screen.
8. Your rights
Under the GDPR and Portuguese data protection law you have the right to access, correct, delete, export, and restrict the processing of your personal data, and to object to processing. Most of these you can exercise directly in the app; for anything else, email support@taxclara.pt. You also have the right to lodge a complaint with the Portuguese supervisory authority, the CNPD (cnpd.pt).
9. Changes and contact
If we make material changes to this policy we will notify you in the app or by email. Questions about this policy: support@taxclara.pt.