Privacy Policy

1. Who we are

TaxID ("we", "us", "our") provides an EU VAT number validation API service. We operate under EU data protection law (GDPR) and take the privacy of our users and their customers' data seriously.

Data controller: TaxID
Contact: team@heysopa.com

2. Data we collect

Account data

When you sign up, we collect: name, email address, and authentication provider (Google or email/password). This data is stored in Firebase Authentication and Firestore.

During onboarding we also ask, optionally, which website or domain you are integrating TaxID into. Answering is entirely voluntary and skipping it does not limit your account in any way. We store it on your account record and use it only to understand which platforms our users build on, so we can prioritise SDKs and integrations. It is never published, sold, or shared with third parties, and you can have it removed at any time by emailing us.

Usage data

We collect aggregate usage statistics: number of API requests per month, requests by endpoint, requests by country code. We do not log individual VAT numbers you validate beyond what is necessary for caching and rate limiting.

VAT validation data

VAT validation requests are hashed (SHA-256) before caching in Redis. The plaintext VAT number is transmitted to the EU VIES system (operated by the European Commission) for validation, but is not stored permanently in our database.

Payment data

Payment processing is handled by Stripe. We store only your Stripe Customer ID and subscription status. We never store card numbers or full payment details.

Analytics

We use Microsoft Clarity for product analytics and session replay (aggregated interaction data such as clicks, scrolls, and page views) to understand how the product is used and improve it. Clarity only loads, and only sets its first-party cookies (_clck, _clsk), if you click "Accept" in our cookie banner. For signed-in users we send Clarity a one-way hash of your account ID and your plan, never your email address or name. We also record our own aggregated product events (for example sign-ups and first API call) tied to your account.

We use Google Analytics 4 to measure traffic and conversions (page views, sign-ups, API key creation, checks run with our free tools, and plan selection on the pricing page). Google Analytics only sets cookies (_ga, _ga_*) if you click "Accept" in our cookie banner; until then it runs in Consent Mode with analytics and advertising storage denied, which sends cookieless signals without identifiers. We never send VAT numbers, email addresses or other account details to Google Analytics, we strip query strings from the URLs it receives, and we do not use it for advertising. If you accepted cookies before signing up, we keep the anonymous Google Analytics client ID on your account so that your first API call can be attributed to the visit you came from. You can change your choice at any time with "Cookie settings" in the site footer.

3. Legal basis for processing

• Contract performance: Processing your account data to provide the API service
• Legitimate interests: Aggregate usage analytics, and the optional integration details you choose to share, to improve and prioritise the service
• Consent: Google Analytics and Microsoft Clarity cookies, only if you accept them in the cookie banner. You can withdraw consent at any time from "Cookie settings" in the footer
• Legal obligation: Retaining billing records as required by tax law

4. Data retention

• Account data: Retained while your account is active, deleted within 30 days of account deletion
• Redis cache (VAT hashes): 24–hour TTL, auto-expired
• Usage stats: Retained for 12 months in Firestore
• Google Analytics user- and event-level data: 2 months. Aggregated, non-identifying reports are kept by Google Analytics beyond that
• Cookie banner choice: 12 months, after which we ask again
• Billing records: 7 years as required by EU accounting law

5. Your GDPR rights

Under GDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Delete your account and associated data
• Portability: Receive your data in a machine-readable format
• Objection: Object to processing based on legitimate interests

To exercise any right, email team@heysopa.com. We will respond within 30 days.

6. Third-party processors

7. Cookies

We use a single HttpOnly session cookie (__session) to maintain your login state. It is a signed Firebase session token and does not contain your API keys. Microsoft Clarity sets the first-party cookies _clck and _clsk only after you accept them.

Google Analytics sets the first-party cookies _ga and _ga_* only after you accept them. Your choice is stored in a first-party cookie, taxid_consent, for 12 months. Rejecting, including after having accepted, turns Google Analytics and Clarity storage off and deletes those cookies.

8. Changes to this policy

We will notify active users of material changes to this policy by email. Continued use of the service after changes constitutes acceptance of the updated policy.

9. Contact

For privacy questions or to exercise your rights:
team@heysopa.com