← Back to TaxiBridge

Privacy Policy

1. Controller

TaxiBridge (Greece) is the data controller for your account data. Contact our privacy point of contact at privacy@taxibridge.app.

2. What we collect

• Account data — email, password hash (we never store your plaintext password), your chosen language, and optional profile fields you provide (name, country, business name, VAT ID, use case).
• Billing data — handled by Stripe; we store your Stripe customer/subscription IDs and subscription status, not your card number.
• Usage metadata — anonymised translation metrics (timestamps, token counts, detected language, a one-way hash of the chat identifier, model used, cost). We do not store the content of messages.

3. Message content & the AI translator

An AI translates your message content. To translate, message text is transmitted to our processor OpenAI and returned as a translation. Message content is processed transiently to provide the translation and is not stored by TaxiBridge — we keep only the anonymised metadata above. We operate OpenAI under a Data Processing Agreement with zero data retention configured on our production project, and (where available) EU data residency.

4. People who message you (your customers)

Customers do not create an account and we store no profile for them. We do not retain their message content or phone number (chat identifiers are one-way hashed in metrics only). On the first message in a conversation, an automatic in-chat notice informs them that translation is active.

5. Lawful bases (GDPR Art. 6)

• Contract — providing the service you signed up for (account, billing, translation).
• Legal obligation — tax/invoicing records (Greek/EU law).
• Legitimate interests — security, fraud prevention, service improvement (anonymised).
• Consent — optional marketing emails (separate opt-in; withdraw anytime).

6. Sub-processors

• OpenAI — AI translation (DPA, zero retention).
• Stripe — payments & invoicing.
• WhatsApp gateway (Evolution API) — message transport with your WhatsApp account.
• Hosting provider — runs the service (to be named before launch).

7. Retention

Account data is kept while your account is active and deleted (or anonymised) on request or a reasonable period after closure. Billing/invoice records are kept as required by Greek tax law. Anonymised metrics may be kept indefinitely. Message content is not retained.

8. Your rights

You have the rights of access, rectification, erasure, restriction, portability, and objection. To exercise any of them — including data export or account deletion — email privacy@taxibridge.app. We action verified requests within 30 days. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA, www.dpa.gr), the supervisory authority for Greece.

9. Cookies

We use a single essential session cookie to keep you logged in. We do not use advertising or third-party tracking cookies. If analytics are added later, this section and a consent banner will be updated accordingly.

10. Changes

We may update this policy; the version string above changes on material updates.

---