Privacy Policy

Who we are

Taxocat (“we”, “us”) runs the service and is responsible for your personal data. You can reach us at any time using the contacts at the end of this page.

What we collect

• Account: your email address, preferred language and how you sign in. If you use a password, we keep only a one-way hash of it, never the password itself. If you sign in with Google, we keep only your email address and Google account ID. If you sign in with Telegram, we keep only your Telegram user ID; to connect it the first time, we email you a code and our Telegram bot may send you another in a private chat. Pending codes are stored only in scrambled form and expire after 15 minutes. To stop code guessing, we also count the codes sent and tried for each email address and Telegram account over a day.
• Income and declarations: the amounts, currencies and dates you enter, the exchange rates used, your monthly and yearly totals, the tax due, the filing status of each month and the reference numbers rs.ge gives your declarations.
• rs.ge connection (optional): your rs.ge username and password, the session details rs.ge returns, and the SMS codes you enter to confirm a filing.
• Assistant: the questions you ask it, on the website or in our Telegram bot.
• Technical data: your IP address, used to protect sign-in from bots and to limit abuse; our server logs, which record requests and errors and identify you by your Taxocat account ID, not your email or rs.ge details; and usage data collected by our analytics tools (see below). In our Telegram bot we also keep, with your Telegram user ID, how many questions you asked in the last minute and day, to apply the assistant's limits, and the IDs of recent bot updates, so that no message is answered twice.

How we use it

• to run your account and show you your income, totals and tax;
• to convert income to lari and calculate your tax;
• to prepare declarations and, when you ask, sign in to rs.ge and file them for you;
• to answer your questions in the assistant and, when you ask, change your data through it;
• to send emails you need, such as confirming registration, sign-in codes or resetting your password;
• to keep the service secure and prevent abuse;
• to understand how Taxocat is used and improve it.

We process your data to provide the service you signed up for, to keep it secure, and — for analytics — in our legitimate interest in improving Taxocat.

Your rs.ge details

Your rs.ge username, password and session details are encrypted (AES-256) before they are saved, and they are used only to sign in to rs.ge and carry out the actions you ask for. The SMS codes you type are passed straight to rs.ge.

You can disconnect rs.ge at any time on the Account page; this deletes the stored details.

The assistant

When you ask the assistant a question on the website, your question and the last few messages of the conversation are sent to Google's AI services (Gemini and Vertex AI) to find relevant articles and write an answer. We do not save these conversations; the history stays in your browser tab and disappears when you close it or sign out.

When you write to our Telegram bot, your message is sent to the same Google services in the same way. If you reply to one of the bot's messages, the text of that message is sent too, as context — including your own figures if you reply to a message that shows them, such as the answer to /status. We do not save bot conversations; your chat stays in Telegram under Telegram's terms.

When you are signed in, the assistant can also read and change your Taxocat data to answer you: your income, declarations, yearly totals and account settings. What it reads for an answer is sent to the same Google services together with your question. It never sees your rs.ge login, password or session. When you ask, it can add or edit income, prepare declarations and change your language; deleting income and changing a filing mark or the income you declared before Taxocat happen only after you press Confirm. A change waiting for your confirmation is kept on our servers for at most 15 minutes and then deleted. If you connect Taxocat to another AI app, such as Claude or ChatGPT, and press Allow on Taxocat's page, that app can do the same: what it reads goes to that app and its AI provider under their own terms. You can disconnect it at any time in Account → Connected apps.

Please do not share personal details, such as ID numbers or passwords, with the assistant.

Who we share it with

We share data only with the services that help us run Taxocat, and only what each of them needs:

• Google Cloud — hosts our servers and database;
• Cloudflare — delivers the website;
• Google — sign-in with Google, reCAPTCHA bot protection, sending emails, and the AI behind the assistant (the Gemini API and Vertex AI);
• Telegram — sign-in with Telegram, the Taxocat Mini App and our bot: its sign-in codes, its messages and the assistant's answers;
• Google Analytics and Yandex Metrica — usage statistics;
• the Revenue Service of Georgia (rs.ge) — your rs.ge details and declarations, when you connect rs.ge and ask us to file;
• the National Bank of Georgia — we fetch exchange rates from it; no personal data is sent.

Our servers and database are in the European Union. Some providers process data in other countries too, including the United States and — for Yandex Metrica — Russia. Each of them handles the data under its own terms and privacy policy. We may also disclose data when the law requires it.

Cookies and storage on your device

• Sign-in cookies keep you signed in: one lasts 15 minutes and is renewed automatically; the other is renewed while you use Taxocat and expires after 7 days without use.
• Your device's local storage remembers your preferences: theme, language, last used currency, layout and when you first visited.
• The assistant's conversation is kept in the browser tab's session storage until you close the tab or sign out.
• Google Analytics and Yandex Metrica set their own cookies to count visits and see how pages are used. Once you sign in, Google Analytics also receives your Taxocat account ID (a random code, not your email). Yandex Metrica's session recording (Webvisor) records how you use pages — clicks, scrolling, mouse movement — and what they showed, with personal content such as your email, amounts, rs.ge details and assistant messages hidden.

You can block or delete analytics cookies in your browser settings; Taxocat keeps working without them.

How long we keep it

We keep your account data for as long as you have an account. Your rs.ge details are kept until you disconnect rs.ge or delete your account. A password reset code works for one hour and is deleted once used. A change the assistant is waiting for you to confirm expires after 15 minutes and is then deleted. A connected AI app's access is deleted when you disconnect it or delete your account, and stops working after 30 days without use. A Telegram sign-in code works for 15 minutes and is deleted, with the email address it was sent to, once used or after it expires; the counters of sign-in codes for each email address and Telegram account are deleted after their day ends. The bot keeps only the latest question counters for each Telegram user ID and deletes them after their day ends; the IDs of bot updates are deleted after two days. Server logs are kept for a limited time and then deleted automatically. When you delete your account, we delete your data, except where the law requires us to keep it; analytics statistics are kept under Google's and Yandex's retention settings.

Security

All connections to Taxocat and to the services it works with use HTTPS. Passwords are stored as hashes, and rs.ge details are encrypted in our database. Only the people who run Taxocat can access the data, and only to operate the service. No system is completely secure, so please use a strong password and sign out on shared devices.

Your rights

You can ask to see the personal data we hold about you, correct it, delete it, receive a copy of it, or object to or restrict how we use it. Some of this you can do in the app: edit income in months not yet filed, delete income, disconnect rs.ge, unlink Google or Telegram, and delete your account on the Account page. For anything else, email us from the address you registered with. We will reply within the time limits set by law.

If you think we have handled your data wrongly, you can complain to the Personal Data Protection Service of Georgia or to the data protection authority where you live.

Children

Taxocat is not meant for anyone under 18, and we do not knowingly collect their data.

Changes to this policy

We will update this policy when the way we handle data changes. The date at the top shows when it last changed. If a change is significant, we will tell you by email or in the app.

Contact

Questions about your data or this policy? Write to us:

taxocatcom@gmail.com Telegram @taxocat