The company number and registered address are provisional until Taxion s.r.o. is entered in the commercial register. A lawyer still needs to review this text.
Privacy policy
Effective from 20 September 2026
Taxion helps Bolt and Uber drivers calculate and pay the VAT on the platform commission. To do that it needs your tax identifiers and the invoices you upload. This document describes what we do with them, and what we do not do.
This is a courtesy translation. The binding version is the Czech one.
1.Who the controller is
The controller of your personal data is Taxion s.r.o., company number 57392041, registered at Praha, Česká republika.
Write to ahoj@taxion.cz with any question about data protection. We have not appointed a data protection officer, because the law does not require one from us.
2.What data we process
| Category | Specifically |
|---|---|
| Account | email, password stored as an irreversible hash, name |
| Tax identifiers | IČO, DIČ, your regional tax office |
| Uploaded documents | Bolt and Uber invoices you upload or photograph, including what is printed on them: name, address, DIČ, amounts, invoice numbers |
| Calculated data | monthly commission, tax base, VAT amount, payment order |
| Subscription | Stripe customer identifier, subscription status |
| Technical data | sign-in time, IP address, error logs |
We are not interested in your trips or your passengers. We work only with the platform commission invoice, because that is the only thing the VAT is calculated from.
Your card number never reaches us, Stripe handles the subscription payment. You pay the tax directly to the tax office from your own bank, and that money never passes through us.
3.Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Reading the invoice, calculating the VAT, building the payment order and QR code | performance of a contract, Art. 6(1)(b) GDPR |
| Keeping tax documents | legal obligation, Art. 6(1)(c) GDPR |
| Securing the service and preventing abuse | legitimate interest, Art. 6(1)(f) GDPR |
| Operational emails about your account and deadlines | performance of a contract, Art. 6(1)(b) GDPR |
We do not send marketing email. If we ever start, we will ask for your consent separately and you will be able to withdraw it at any time.
4.Who else sees your data
Nobody who would use it for their own purposes. We work with suppliers who process it solely on our instructions:
| Processor | For what | Where |
|---|---|---|
| Supabase | database, authentication, file storage | EU |
| Vercel | running the web application | EU and USA |
| Stripe | subscription payment | EU and USA |
| Anthropic | machine reading of a document that could not be read from its text | USA |
- Artificial intelligence: if an invoice cannot be read from its text layer, we send its image to a model that reads the amounts from it. We always show you the result for confirmation, and without your confirmation it is not counted towards your tax base.
- Our accountant: she can see uploaded documents and calculated amounts in order to verify that the calculation is correct.
- The ARES register: when you enter your IČO we query the public ARES register for the name, address, DIČ and tax office. We send only the IČO itself, which is public information.
- Public authorities: only where the law requires it.
5.Transfers outside the European Union
Some of the suppliers listed above have servers or a parent company in the United States. Such transfers are covered by the European Commission's standard contractual clauses, or by an adequacy decision.
6.How long we keep it
| Data | Period |
|---|---|
| Uploaded invoices and calculated amounts | 10 years, tax records |
| Subscription payment records | 10 years |
| Account data | while the account exists, plus 30 days |
| Sign-in and error logs | 12 months |
We delete data once the period ends. Tax documents are deleted only after the statutory period, even if you close your account sooner, because the law requires us to keep them.
7.Your rights
In relation to your data you have the right to:
- know what we process about you, and get a copy
- have incorrect data corrected
- have data erased, where we have no legal reason to keep it
- restrict processing, or object to it
- receive your data in a machine-readable form and move it elsewhere
- lodge a complaint with the supervisory authority
Write to ahoj@taxion.cz. We answer within one month at the latest, and we charge nothing for it.
If you are not satisfied with how we handled it, you can contact the Czech supervisory authority: Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.
8.Cookies
We use only the cookies the application needs to work. We use no analytics, advertising or tracking tools, which is why there is no consent banner to click away.
| Cookie | What it does |
|---|---|
| Supabase session cookie | keeps you signed in |
| NEXT_LOCALE | remembers the language you chose |
| theme | remembers light or dark mode |
9.Security
The connection to the application is encrypted. Passwords are never stored in readable form. Your documents are accessible to your account and to our accountant, and to nobody else.
If a breach did happen and it posed a risk to you, we would report it to the supervisory authority within 72 hours and tell you without undue delay.
10.Changes to this policy
If we change this policy we will publish the new version on this page and update the date at the top. We will tell you by email in advance about any substantial change.