Privacy policy

1. Data controller

Taxania is a service operated by BlancPac Technologies S.L. (Spain). For any data protection question, contact us at info@taxania.com.

2. Data we process

• Account data: name, email address and password (stored using irreversible hashing) of users, and identification data of the companies they register (legal name, tax ID).
• Bank data: when a user connects a bank account, we obtain, through the account information service provider Enable Banking Oy (Finland, an entity registered under the PSD2 Directive), the account identifier (IBAN), balances and transactions (date, amount, description, counterparty). Taxania never receives or stores bank login credentials; consent is granted on the bank's own website and can be revoked at any time from Taxania or from the bank. We may also process bank statements that the user uploads manually (Norma 43 or similar formats).
• Invoices and documents: the files the user uploads, forwards by email to their company's Taxania address or syncs from their cloud storage, and the data extracted from them (issuer, recipient, tax IDs, dates, amounts, taxes).
• Technical data: IP address, user agent and access logs, for security purposes.

3. Purposes and legal basis

We process data to provide the contracted service: displaying bank transactions, extracting invoice data, reconciling transactions with invoices and producing the user company's accounting information (performance of a contract). We also process data to keep the service secure and to comply with legal obligations (legitimate interest and legal obligation).

4. Processors and international transfers

• Enable Banking Oy: access to bank account information under PSD2 (European Union).
• Anthropic: automated extraction of invoice data using artificial intelligence models. Documents are sent to be read and are not used to train models.
• Inbound email provider (receipt of invoices forwarded by email) and hosting provider in the European Union.

Where a provider is located outside the European Economic Area, processing relies on standard contractual clauses or another mechanism recognised by the GDPR.

5. Retention

Data is kept while the account is active and, afterwards, for the periods required by the commercial and tax regulations applicable to accounting records (generally six years), unless the user requests earlier deletion and there is no legal obligation to keep it.

6. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to info@taxania.com. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

7. Security

Communications are encrypted with TLS, passwords are stored using strong key derivation functions, and access to each organisation's data is restricted to its own users.

8. Changes

We will publish any change to this policy on this page, together with the date of the update.

This is a translation of the Spanish version, which prevails in case of discrepancy.