Privacy and your choices

Effective 9 November 2026. taxpress is operated by Oba Labs B.V., KvK 98154710, Eerste Van Swindenstraat 373 A, 1093 GB Amsterdam, Netherlands. We decide how your data is used for this service. Contact [email protected] about privacy or your account.

What we use to help you

We use your sign-in details, documents, the details read from them, your answers and corrections to help you prepare your tax information and save your progress. Documents can contain names, addresses, account details and financial information. Only add information needed for your return and documents you are entitled to share. We keep useful source and page references so you can check a suggested figure.

Choosing files or taking a photo lets you preview them first. Upload starts when you choose Read or Save. You can enter figures yourself instead. Unsaved manual details stay in this tab and clear when it closes or reloads. Saved returns belong to your account. We do not sell your documents, send them to advertisers or use them to train AI.

Account emails and messages to us

Supabase manages sign-in. Cloudflare delivers our account confirmation, password-reset and security emails. For delivery, it processes your email address and the account link or code needed for that message. Our account emails contain no tax documents or figures. Messages you send to [email protected] or [email protected] are forwarded through Cloudflare to our support inbox. Keep tax documents, passwords and codes out of email.

Return emails, reminders and news

We send service emails when your account is ready, document reading finishes or needs another try, your checked return changes, your 2025 summary is downloaded, or your account is deleted. We may ask one question about how easy the preparation was. These emails help provide and improve the service you requested. They contain no figures, answers, document names or other people's names.

Reminders to continue your return and news about next year's return are two separate choices. Both start off. We send reminders only after you turn them on, and news only after you choose it. Save or change these choices in Account → Email choices. Each optional email also has its own unsubscribe link; turning off reminders does not turn off news, or account and security emails.

To avoid sending an unhelpful reminder, we keep your email choices, recent app activity time, general progress counts, and a delivery record. Our EU service calculates the progress counts; Cloudflare receives only the information needed for the email. We do not use tracking pixels or track ordinary email links. Unsubscribe and feedback links carry a random code to save your explicit choice. We keep consent history while your account is active and delivery records for up to 400 days to prevent repeat seasonal emails. A deletion receipt keeps your email address only until delivery or for at most 7 days. Deleting your account removes your choices and other email records. A reminder comparison leaves about one in ten opted-in accounts without reminders; outcome analysis uses only accounts that also allow optional usage records. No extra financial details go to advertising or ordinary analytics.

Where documents are read and saved

Cloudflare delivers this website and taxpress.co and handles connection information to load and protect their pages. When you allow usage records on taxpress.co, our site forwards them to Supabase in Ireland without your IP address. Account and document requests go directly to the services described below.

Supabase stores saved returns and original files in Ireland. Our Google Cloud service in the Netherlands checks files for harmful content and reads documents. Google Document AI reads scanned pages in its EU location; Gemini proposes details through its EU endpoint. We do not fall back to a Global processing endpoint. Check the proposed details against your originals: automatic reading can make mistakes.

Google says online Document AI processing uses memory rather than saving document contents to disk. Gemini caching is disabled for this project. Google may retain flagged prompts and responses for abuse prevention for up to 90 days in the selected EU area, with authorised review. That is separate from our normal document storage and deletion. Provider account, security and service metadata may have different international processing arrangements under their data-protection terms; EU document routing does not mean every provider operation is EU-only.

You can sign in with Google instead of creating a password. Google shares your email address and basic profile with our sign-in service, Supabase. This does not give taxpress access to your Gmail or Google Drive. We do not use that profile as the details on your tax return. Your account works across supported tax years. To bring you back to the return you chose after signing in, we briefly keep that choice in this browser; it expires after a day.

Your choices are separate

• Providing the service: we use the information needed to read and save the return you request. This is to perform our agreement with you. We use limited security and error information to protect accounts and keep the service working, based on our legitimate interest in a safe service.
• Optional usage records: only with your permission, we record steps, button actions, broad timing and whether an action succeeded in the app. On our website, taxpress.co, we record the pages and sections you view, the buttons and links you click, how far you scroll, the questions you open, time on the page, your device type and how you arrived (for example search, social media or a numeric ad campaign code). A random visit code links your website visit to your app steps so we can see which pages help people start. One choice covers the website and the app and lasts 6 months. We do not include document contents, figures, filenames, typed answers, web addresses you came from or recordings of your screens. Declining does not stop you using the service. Change this in Cookie settings on the website or in the app, or in your saved-account choices; withdrawing in the app also deletes the linked website visit. Cookies and browser storage lists everything we store in your browser.
• Advertising measurement: Meta advertising tracking is currently off. If enabled later, it requires a separate choice and would be limited to the public landing page and account-registration measurement. Your financial documents and tax details are excluded.
• Future financial assistant: you can separately allow it to use saved documents, extracted details, sources and corrections to help you. The assistant is not available yet. Permission lasts 6 months, can be withdrawn in your account and does not extend document storage. No model training is allowed.

How long we keep information

We keep your saved returns and original documents until you delete the return or your account. We keep up to ten saved versions of each return. Document-reading jobs, results and temporary reading records follow the return’s retention and deletion. Temporary worker files are removed after each attempt. Optional usage records from the website and the app expire after 30 days; cookie choices last 6 months. Our Google operational logs are limited to 30 days and exclude document contents. Account sign-in records remain while your account is active, subject to the provider’s security and backup arrangements.

You can delete a return or your account. Access stops immediately and file removal runs in the background, normally starting within 5 minutes. Failed removals retry. Provider security records, the Google abuse-prevention records described above and backups may expire later; deletion cannot recall files you already downloaded or a request already in progress. Contact us for the applicable backup expiry for your request. We do not promise immediate deletion from provider backups.

Who can receive information

Cloudflare, Supabase and Google Cloud act as service providers under their applicable processing terms. Access is limited to running, protecting and supporting the service. We may disclose information when legally required. Where provider operations involve international transfers, their applicable contractual safeguards apply. We do not make a final tax assessment or submit your return automatically.

Access, corrections and deletion

Use your saved-return controls to reopen or correct information, download your data and original files, change optional permissions or request deletion. You can also email us to request access, correction, deletion, restriction, portability or to object to processing based on legitimate interests. Withdrawing consent stops future optional use; it does not change processing already lawfully completed. We may need to verify that you own the account. You can complain to the Dutch Data Protection Authority.

If we change how your documents are used or introduce a new optional purpose, we will update this notice and ask for any new permission needed.