Privacy Policy
Last updated: February 17, 2026
At LuxTax Optimizer ("we," "us," "our," or "Company"), we are committed to protecting your privacy. This Privacy Policy explains how we collect, use, process, disclose, and safeguard your information in accordance with the General Data Protection Regulation (GDPR) and Luxembourg data protection laws.
Controller: LuxTax Optimizer acts as the Data Controller for your personal information. If you have privacy concerns, you can contact our Data Protection Officer (DPO) at support@luxtaxop.com.
Information You Provide Directly
When you create an account and use our services:
- Email address and password
- Full name and contact details
- Financial data (salary, income sources, investments, deductions)
- Tax-related documents and receipts you upload
- Family status, marital status, and dependent information
- Bank details (for subscription payments via Stripe)
- Support requests and communication history
Information Collected Automatically
When you access our application:
- IP address and geolocation data
- Device type, operating system, and browser information
- Session logs and usage analytics
- Cookies and similar tracking technologies (only with consent)
- Error logs and performance data
Note: We only collect the minimum necessary information to provide our service. Financial data is treated as special category data under GDPR and handled with enhanced protection.
Under GDPR Article 6, we process your data based on the following lawful bases:
Contract (Article 6.1(b))
To provide tax calculation, deduction tracking, portfolio management, and other subscription services
Consent (Article 6.1(a))
For marketing emails, analytics, and cookies (you can withdraw consent anytime)
Legal Obligation (Article 6.1(c))
To comply with Luxembourg tax law, AML/KYC requirements, and payment processing regulations
Legitimate Interests (Article 6.1(f))
To improve services, prevent fraud, and maintain platform security
We use your data for the following purposes:
- Providing tax calculations, deduction tracking, and investment analysis
- Generating personalized tax optimization recommendations
- Processing payments and managing subscriptions via Stripe
- Sending service updates, tax alerts, and renewal notifications
- Responding to support requests and feedback
- Improving platform features and user experience
- Detecting, preventing, and addressing fraud and security issues
- Complying with legal obligations (tax authorities, AML regulations)
We implement appropriate technical and organizational security measures (Article 32 GDPR) to protect your personal information:
- AES-256 encryption for data at rest on secure servers
- TLS 1.3 encryption for data in transit
- Secure authentication with encrypted password storage
- Regular security audits and penetration testing
- Access controls limiting data access to authorized personnel only
- Automatic backup systems with encryption
- GDPR-compliant data processing agreements with all service providers
While we implement industry-standard security, no method is 100% secure. In case of a data breach, we will notify you without undue delay (within 72 hours where required by law).
We do not sell your personal information. We only share data with:
Service Providers (Data Processors)
Third-party providers with GDPR Data Processing Agreements:
- Stripe (payment processing)
- Base44 (cloud hosting & infrastructure)
- Resend (email delivery)
Legal Authorities
To Luxembourg tax authorities, government agencies, and courts when legally required
Business Transfers
In case of merger, acquisition, or asset sale, your data may be transferred (you'll be notified)
No international transfers: Your data is stored in the EU only. Any processing outside the EU is prohibited unless you provide explicit consent.
We only retain your personal data for as long as necessary (data minimization principle):
Active Accounts
Retained for the duration of your subscription + 30 days after cancellation
Tax Data (Legal Requirement)
Minimum 7 years per Luxembourg tax law (Law of 10 August 1927)
Payment Records
6 years for accounting compliance (EU VAT & Anti-Money Laundering)
Log Data & Analytics
Automatically deleted after 12 months
You may request account deletion at any time through Settings → Account → Delete Account. We will delete all non-legally-required data within 30 days.
Under Articles 12-22 of the GDPR and Luxembourg law, you have the following rights:
1. Right of Access (Article 15)
Request a copy of all personal data we hold about you in a structured, commonly-used format
2. Right of Rectification (Article 16)
Request correction of inaccurate or incomplete personal data
3. Right to Erasure (Article 17 - "Right to be Forgotten")
Request deletion of your data (except where legal retention obligations apply)
4. Right to Data Portability (Article 20)
Receive your data in a machine-readable format and transfer it to another provider
5. Right to Restrict Processing (Article 18)
Limit how we use your data while we investigate disputes
6. Right to Object (Article 21)
Object to marketing, profiling, and processing based on legitimate interests
7. Right to Automated Decision-Making (Article 22)
Not be subject to automated decisions that produce legal effects without human review
How to exercise your rights: Contact us at support@luxtaxop.com or through Settings → Privacy Controls. We'll respond within 30 days (extendable to 60 days for complex requests).
We use cookies only with your explicit consent (GDPR ePrivacy Directive):
Essential Cookies
Session authentication, CSRF protection, security - used without consent
Analytics Cookies
Understand how users interact with our platform - requires consent
Marketing Cookies
Personalized content and retargeting - requires consent
You can manage cookie preferences anytime through Settings → Cookie Preferences or your browser settings. Disabling non-essential cookies will not affect core functionality.
Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us immediately.
You have the right to access, rectify, or permanently erase your personal data at any time. We are fully committed to GDPR compliance.
Document Scanning & AI Processing
When you use document scanning features (payslip scanning, portfolio statement scanning, or receipt scanning), your documents are processed by AI solely to extract financial figures. Documents are not permanently stored — only the extracted numerical data is saved to your profile.
You will be asked for explicit GDPR consent before any document upload proceeds. You may withdraw consent at any time by not using these features.
Account Deletion
You can permanently delete your account at any time via Settings → Delete Account. When you do:
- All personal profile data, tax calculations, and stored preferences are permanently removed
- All documents you have uploaded (payslips, portfolio statements, receipts) and any data extracted from them are automatically and permanently purged
- Your investment portfolio, deduction history, and calculation history are fully deleted
- This process is irreversible — we retain no copies after deletion
- Legally required records (e.g. payment receipts for tax compliance) may be retained for the minimum statutory period only
To request deletion or exercise any GDPR right, go to Settings → Delete Account or contact us at support@luxtaxop.com.
We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.
For privacy questions or to exercise your GDPR rights:
- 📧 Email: support@luxtaxop.com
- ⚙️ Settings: Navigate to Settings → Privacy Controls in the app
- 📝 Data Subject Request Form: Available in Settings → Download DSR Form
If unsatisfied: You have the right to lodge a complaint with the Luxembourg National Commission for Data Protection (CNPD) at www.cnpd.lu
This Privacy Policy complies with:
- Regulation (EU) 2016/679 (GDPR)
- Law of 1 August 2018 on the Protection of Individuals with Regard to the Processing of Personal Data (Luxembourg)
- ePrivacy Directive (2002/58/EC) - Cookies & Tracking
- Payment Card Industry Data Security Standard (PCI DSS)
- Anti-Money Laundering Directives (5th AMLD)