Privacy Policy

This Privacy Policy explains how TASXIO collects, uses, and protects personal data. For UK GDPR purposes TASXIO acts as the data controller for account and website data, and as data processor for the customer data you upload into the Service. You can contact us at any time at contact@tasxio.com.

1. Data we collect

Account data

• Name, email address, phone number (optional).
• Business name, address, VAT number (if provided).
• Login credentials (managed by Clerk, our authentication provider).

Billing data

• Billing address and VAT number.
• Card details are handled by Stripe; we never see or store full card numbers.

Customer data (data you upload)

• Details of your own customers: names, contact details, addresses, quote and invoice values, job notes, photos.
• Emails ingested via connected inboxes (Gmail, Outlook) when you enable those integrations.
• When an email or website inquiry becomes a lead, we may send that person a short confirmation that you received it, in your business name.

Usage data

• IP address, browser type, pages visited, timestamps, referrer.
• Product analytics events (PostHog) and error reports (Sentry).

2. How we use your data

We process your personal data for the following purposes:

• To provide the Service — lawful basis: performance of a contract.
• To bill and take payment — lawful basis: performance of a contract.
• To improve the Service (analytics, error monitoring) — lawful basis: legitimate interests.
• To send transactional emails (verification, receipts, reminders) — lawful basis: performance of a contract.
• To send marketing emails — lawful basis: consent. You can unsubscribe at any time.
• To comply with legal obligations — lawful basis: legal obligation (accounting records, HMRC).

3. Sub-processors

We use the following sub-processors to run the Service. Each is contractually required to protect your data:

• Vercel — hosting (USA / EU regions)
• Neon — database (EU region)
• Clerk — authentication
• Stripe — payments and card processing
• Resend — transactional email
• Anthropic — AI extraction of lead details from emails you choose to connect
• Google (Gmail API) / Microsoft (Graph API) — only for inboxes you explicitly connect
• Xero / QuickBooks / Sage — only if you enable those integrations
• Sentry — error monitoring
• PostHog — product analytics (EU region)
• Klaviyo — marketing email (only if you subscribe)

4. International transfers

Some sub-processors are based outside the UK/EEA. Where personal data is transferred internationally, we rely on UK GDPR-approved safeguards such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.

5. How long we keep your data

• Account and customer data: while your account is active, plus 60 days after cancellation (read-only). After that, deleted.
• Billing records: 6 years, to comply with UK tax law.
• Support emails: 2 years.
• Marketing consent records: until you unsubscribe, plus a short retention for suppression list purposes.

6. Your rights under UK GDPR

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data (subject to lawful retention above).
• Restrict or object to processing.
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time (for marketing).
• Lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk).

To exercise any of these rights, email contact@tasxio.com.

7. Cookies

We use essential cookies for authentication and session management, and optional cookies for analytics. A cookie banner lets you accept or reject non-essential cookies on your first visit; you can change your preferences at any time.

8. Security

We use industry-standard measures to protect your data, including encryption in transit (HTTPS/TLS), encryption at rest, access controls, and regular security reviews. No system is 100% secure; if we discover a breach affecting your data, we will notify you and the ICO where legally required.

9. Children

The Service is intended for adults operating a business. We do not knowingly collect data from anyone under 18.

10. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email or in-app.

11. Contact

Questions or requests? Email contact@tasxio.com.