One account, both countries Resources
Privacy

Privacy Policy

Information on the processing of personal data under Art. 13 GDPR.

Last updated: April 2026
A German version of this Privacy Policy is available via the language toggle above.

1. Privacy at a glance

The following provides an overview of what happens to your personal data when you visit vaytax.com or use the Vaytax service. Vaytax is an online VAT-compliance service for businesses with German tax obligations. As such, tax and financial data are also processed.

2. Controller

FRADECO GmbH
Deutsch-Französische Steuerberatungsgesellschaft
Simrockstraße 92
53619 Rheinbreitbach
Germany

E-mail: contact@vaytax.com
Website: vaytax.com

The controller is the natural or legal person who alone or jointly determines the purposes and means of processing personal data.

3. Data Protection Officer

FRADECO GmbH is currently not required to appoint a Data Protection Officer under Art. 37 GDPR in conjunction with § 38 BDSG. For data-protection enquiries, please contact us at the address above or by e-mail at contact@vaytax.com.

4. Categories of data processed

In the course of using Vaytax, we process the following categories of personal data:

a) Account data

E-mail address, password (stored solely as a cryptographic hash), authentication tokens.

b) Company data

Company name, legal form, address, country, sector.

c) Tax data

Tax number (Steuernummer), VAT identification number (USt-IdNr.), competent tax office (Finanzamt), VAT preliminary return values (Kennzahlen / KZ values), VAT amounts, filing periods.

d) Financial data

IBAN, SEPA direct debit mandate, payment references.

e) Representative data

Name, date of birth, e-mail address of the legal representative or authorized agent.

f) Document data

Uploaded PDF documents, generated XLSX and CSV files, tax returns and preliminary returns.

g) Usage data

Page views, session identifiers (via sessionStorage only, not cookies), timestamps, browser and operating system, IP address (in server logs).

5. Legal basis for processing

We process your personal data on the following legal bases:

6. Recipients and processors

We engage the following service providers, with whom data-processing agreements (DPAs) under Art. 28 GDPR have been concluded where applicable:

In addition, as part of the tax-advisory work, data is transmitted to:

7. Transfer to third countries

The database and primary data processing take place in the EU (Supabase eu-central-1, Frankfurt; Cloudflare EU).

Resend Inc. is based in the USA. Data transfer is on the basis of Standard Contractual Clauses (SCCs) under Art. 46 (2) (c) GDPR. Only e-mail addresses and the contents of transactional e-mails are processed via Resend.

Anthropic, PBC is based in the USA. Letters uploaded on /finanzamt-letter are processed transiently via the Anthropic API to produce the instant summary. The legal basis is consent (Art. 6 (1) (a) GDPR), given via the upload checkbox; the transfer is on the basis of Standard Contractual Clauses under Art. 46 (2) (c) GDPR. Contents are not used to train AI models; permanent storage of the documents takes place exclusively in the EU (Supabase, Frankfurt).

Stripe processes payment data primarily in the EU (Stripe Payments Europe, Ltd., Ireland) but may transfer it to Stripe, Inc. (USA) for processing and fraud-prevention purposes. The transfer is on the basis of Standard Contractual Clauses and Stripe’s certification under the EU-U.S. Data Privacy Framework.

Google Fonts and Google Analytics 4 are delivered from servers of Google Ireland Limited (EU) and Google LLC (USA). Google is certified under the EU-U.S. Data Privacy Framework; Standard Contractual Clauses additionally apply under Art. 46 (2) (c) GDPR.

8. Storage period

9. Cookies, tracking and consent

We distinguish between technically necessary storage mechanisms and consent-based tracking technologies:

a) Technically necessary storage (no consent needed)

For login and session management in the authenticated area we use the browser’s localStorage / sessionStorage APIs (e.g. storing the authentication token after successful login). Under § 25 (2) No. 2 TTDSG this storage is permitted without consent because it is strictly necessary to provide the service the user has expressly requested. Cookies in the classical sense are not used for this purpose.

b) Audience measurement with Google Analytics 4 (consent-based in the EEA, UK and Switzerland)

On the public pages of vaytax.com we use Google Analytics 4 (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) for statistical evaluation of usage. IP anonymisation is enabled (anonymize_ip: true); no linkage with other Google services or accounts.

On first visit to our website, Google Analytics is initialised in “Consent Mode v2” with the default state “denied”. At that point no cookies are set and no personal data is transmitted to Google. This applies to visitors from the European Economic Area, the United Kingdom and Switzerland. For visitors from other countries Google Analytics is active by default; they too can switch it off at any time in the consent dialog (“Essential only”). Via our consent banner you can equally accept (“Accept all”) or reject (“Essential only”). Only after active consent are the following cookies set:

c) Conversion measurement via Google Ads

In addition to audience measurement, the publicly accessible pages of vaytax.com use Google Ads conversion tracking (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). This lets us measure how many visitors who arrived via a paid Google ad subsequently complete an action relevant to us (for example creating an account, requesting a Finanzamt letter quote, or completing a purchase).

When you click one of our Google ads, Google automatically appends a Google click identifier (URL parameter ?gclid=...) to the destination URL. This identifier is stored locally in your browser (localStorage, key vd_gclid) for a maximum of 90 days. It does not identify a person and contains no plain-text personal data; it serves solely to associate a later conversion with the original ad click.

Transmission of the identifier to Google Ads happens in one of two ways: (a) from your browser via the Google Ads tag, but only after you consent in our consent banner (Art. 6 (1) (a) GDPR); (b) from our backend via the Google Ads API when an ad click leads to an inquiry to us (contact form, VAT check, Finanzamt letter, account creation) or to a purchase. We base this server-side transmission on our legitimate interest in measuring the effectiveness of our advertising (Art. 6 (1) (f) GDPR); it happens regardless of your choice in the consent banner, except when you chose “Essential only”: in that case the locally stored click identifier is deleted immediately and nothing is transmitted. In both cases we transmit only the click identifier, the conversion event, the conversion value in euros and an internal order reference. We do not transmit your name, email address or any other profile information as part of this measurement.

You may object to the server-side transmission at any time with future effect, and withdraw any consent given, by choosing “Essential only” in the consent banner (link “Change cookie settings” under e). Click identifiers stored in your browser are deleted at that point; conversion events already transmitted to Google can additionally be managed via the privacy settings of your Google account.

Retention period: the click identifier stored locally in your browser is automatically deleted after 90 days. Conversion events transmitted to Google Ads are retained in accordance with Google Ads retention policies; for details and objection options see the Google privacy policy.

d) Legal basis

For consent-based processing in audience measurement and Google Ads conversion measurement: Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TTDSG (consent). For technically necessary storage: Art. 6 (1) (b) GDPR in conjunction with § 25 (2) No. 2 TTDSG. For the server-side transmission of the Google click identifier on inquiries and purchases: Art. 6 (1) (f) GDPR (legitimate interest in measuring our advertising), with the right to object described in section c).

e) Withdrawal of consent

You may withdraw your consent at any time with future effect. The lawfulness of processing carried out before the withdrawal is unaffected. To withdraw, click here: Change cookie settings. Alternatively, delete the cookies via your browser settings.

f) Supplementary cookie-free audience measurement

Independent of consent, we collect aggregated, non-personal usage data (page views, time-on-page, anonymised session id) on the basis of our legitimate interest (Art. 6 (1) (f) GDPR). This data is stored exclusively on our servers (Supabase, EU), contains no IP addresses, and is deleted after 90 days.

g) Referral and partner identifiers

If you reach our website through a referral link or a partner link, the address carries a short code (URL parameter ?ref=... or ?via=...). That code is stored locally in your browser (localStorage, keys vd_ref and vd_via) and is deleted automatically after 90 days.

The code identifies the person or partner who referred you, not you. It holds no information about you, is never transmitted to any third party, and does not leave our own systems. It is read only if you go on to register or submit an enquiry, so that we can credit the referral correctly. The legal basis is our legitimate interest in attributing referrals (Art. 6 (1) (f) GDPR).

You can remove these entries yourself at any time by clearing site data for vaytax.com in your browser. If you visit our website without such a link, nothing is stored.

h) Where your first visit came from

If you reach us from an identifiable source (a search engine or an AI assistant, for example), we record where that first visit came from locally in your browser (localStorage, key vd_ft) and delete it automatically after 90 days.

Only the domain of the referring site is stored (for example https://chatgpt.com, not the full address of the page or of a conversation), any ?utm_source=... campaign parameter, the first page of ours you opened, and the time. The entry contains no information about you and is never transmitted to any third party.

Its only purpose is to answer which channel brings people to us. That information is otherwise lost the moment you close the browser tab, even though several weeks typically pass between a first visit and an enquiry. The first identifiable visit is kept and is not overwritten by later ones. The legal basis is our legitimate interest in measuring reach (Art. 6 (1) (f) GDPR).

You can remove the entry yourself at any time by clearing site data for vaytax.com in your browser. If you come to us directly, with no identifiable source, nothing is stored.

10. SSL/TLS encryption

This website uses SSL/TLS encryption for security and to protect the transmission of all content. You can recognise an encrypted connection by the change in the browser’s address bar from “http://” to “https://” and by the lock icon.

11. Your rights as a data subject

You have the following rights regarding your personal data:

To exercise your rights, please contact: contact@vaytax.com

12. Right to lodge a complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data-protection supervisory authority (Art. 77 GDPR). Our competent authority is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
Postfach 30 40
55020 Mainz, Germany
www.datenschutz.rlp.de

13. Hosting

This website is hosted via Cloudflare Pages. When the website is accessed, technical information is automatically stored in server log files (IP address, date and time of access, page accessed, browser type, operating system).

Cloudflare Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare processes data in the EU. More information: Cloudflare privacy policy.

14. Google Fonts

This site uses Google Fonts for consistent typography. When a page is loaded, your browser fetches the required fonts into its cache. To do so, your browser connects to Google’s servers; Google thereby learns that the website was accessed from your IP address.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. More information: Google privacy policy.

15. Changes to this Privacy Notice

We reserve the right to amend this Privacy Notice to keep it in line with current legal requirements or to reflect changes to our services. The new Privacy Notice will apply on your next visit.

Effective April 2026.