Privacy Policy

• Account information: your email address and the name you provide when signing up.
• Business profile: business name, TIN, industry, registration date, annual sales figures, employee count and VAT registration status — only what you enter yourself.
• Compliance data: VAT transactions and annexures, payroll and RSSB declaration data, employee records you add, generated declaration files and official acknowledgements you upload or we retrieve on your instruction.
• Documents: files you upload to your Document Vault and proof-of-payment files.
• Contact details for notifications: phone number and notification email, if you enable WhatsApp, SMS or email reminders.
• Billing records: plan chosen, amounts, payment dates, payment references and status. Card details are never seen or stored by TaxMate — they are handled entirely by Stripe.
• Operational logs: notification delivery status, automation session logs and audit records of billing decisions.

We use your information only to operate the service you asked for: computing your statutory deadlines, preparing VAT and RSSB declarations from your own data, storing your documents, sending the reminders you enable, answering your questions in TaxMate AI using your own records, managing your subscription, and providing support.

• Deterministic tax and payroll calculations are performed in code from your data.
• TaxMate AI receives a summary of your own authorised records so it can explain your situation. It never receives another business's data, and it does not invent figures.
• We do not sell your data, and we do not use your business or tax data for advertising.

Uploaded files are stored in a private storage bucket on our managed cloud infrastructure. They are not publicly listable, and access is issued through short-lived signed links to your own account. Files are transmitted over HTTPS.

Sales, purchase, payroll and declaration figures are stored in your own database records, isolated per account by row-level security rules enforced by the database — a request authenticated as one account cannot read another account's rows.

• You, through your authenticated account.
• The TaxMate administrator, for the specific operational purposes of verifying manual bank payments, investigating notification delivery failures and providing support you have requested.
• A tax advisor you explicitly send a booking request to. They receive only the details you put in the request (service needed, budget, your description and your business name) — not your documents or declarations.

• All traffic is served over HTTPS/TLS.
• Authentication and session management are handled by our managed auth provider.
• Database row-level security policies scope every record to its owning account.
• Administrator privileges are resolved server-side from a role table, never from the browser.
• Provider API keys are held as server-side secrets and never shipped to the browser.
• Private files are served only via expiring signed URLs.

We do not claim ISO, SOC 2, PCI or similar certification, and no online service can guarantee absolute security.

• Stripe — card payment processing. Stripe receives your email and the amount; it handles card data directly.
• Email, SMS and WhatsApp providers — used only when you enable those notification channels, and only to deliver the message content and your chosen recipient address or number.
• AI model provider — TaxMate AI sends your question and a summary of your own authorised records to a hosted model to generate the answer. It is not used to train public models by us.
• Cloud hosting and database — our managed infrastructure provider stores your account data and documents.
• RRA, RSSB and RDB portals — when you authorise an automated declaration run, we interact with the official portal on your behalf using the credentials or session you supply for that run.

We keep your records for as long as your account exists, because tax records generally need to be retained for several years. Notification and billing audit logs are kept for operational and dispute-resolution purposes. When you delete your account we remove your account and its associated records and uploaded files; anonymised billing audit entries may be retained where needed for financial record-keeping.

• Access and correct your business profile and records at any time in the app.
• Export or download the documents and declaration files you generated.
• Turn off any notification channel, or all of them.
• Cancel your subscription.
• Delete your account permanently.

You can permanently delete your account from Business Profile → Delete account. Deletion requires re-entering your password and typing a confirmation phrase. It cancels your subscription, removes your uploaded files and deletes your account records. Deletion is permanent and cannot be undone — download anything you need first.

For any privacy question, correction or deletion request, contact us on WhatsApp or by phone at 0793050070.