Privacy Policy

1. Who we are

Xtaxx ("we", "us", "our") provides a financial technology platform that helps you manage property, trade, tax, and business finances. This policy explains how we handle personal data when you use xtaxx.app and related services.

For data protection queries, contact support@xtaxx.app.

2. What we collect

We may collect and process the following categories of information:

• Account details — name, email address, password hash, and security preferences (including two-factor authentication settings).
• Financial records you create or import — transactions, invoices, properties, projects, tax profiles, and uploaded documents.
• Bank connection metadata — account names, balances, and transaction data received through regulated open-banking partners (for example Plaid or Mono). We do not store your bank login credentials.
• Usage and technical data — device type, browser, IP address, and error logs needed to operate and secure the service.
• Communications — messages you send to our support team.

3. How we use your data

We use personal data to:

• Provide, maintain, and improve the Xtaxx platform.
• Authenticate you and protect your account.
• Generate reports, tax summaries, and compliance views you request.
• Respond to support requests and send important service notices.
• Meet legal, regulatory, and accounting obligations.

We do not sell, rent, or lease your personal data to third parties for their marketing purposes.

4. Legal basis (UK & EEA)

Where UK GDPR or EU GDPR applies, we rely on: performance of our contract with you; legitimate interests in running a secure financial platform (balanced against your rights); compliance with legal obligations; and, where required, your consent (for example optional analytics or marketing).

5. Sharing with third parties

We share data only when necessary to deliver the service:

• Open-banking and payment partners to link accounts or process subscriptions.
• Cloud hosting and infrastructure providers under data-processing agreements.
• Professional advisers or authorities when required by law.

All processors are required to protect your data and use it only for the purposes we specify.

6. International transfers

Some providers may process data outside the UK. Where this occurs, we use appropriate safeguards such as UK International Data Transfer Agreements or equivalent mechanisms.

7. Retention

We keep personal data for as long as your account is active and as needed to provide the service, resolve disputes, and meet legal retention requirements. You may request deletion of your account data — see section 9.

8. Security

We protect data in transit with TLS encryption, apply access controls, and never store plaintext bank or application passwords. Enable two-factor authentication in Security settings for additional protection.

9. Your rights

Depending on your location, you may have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. You may also withdraw consent where processing is consent-based.

To exercise these rights, email support@xtaxx.app. You may lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

10. Cookies

We use essential cookies and session storage to keep you signed in and to protect against cross-site request forgery. Optional analytics, if enabled, will be disclosed separately and collected only with your consent.

11. Changes

We may update this policy from time to time. Material changes will be communicated through the app or by email. The effective date at the top of this page will be revised accordingly.