TaxLayer
Sign InGet Started Free

Privacy Policy

As of: July 2026

1. Data Controller

Responsible for data processing on this website and platform within the meaning of Art. 4 No. 7 GDPR is:

Jerome Landauer Berliner Str. 74 A, 13189 Berlin Email: info@landauer.de

2. Hosting and Infrastructure

This website and all backend services are operated on the Google Cloud Platform in the region europe-west3 (Frankfurt am Main, Germany). Provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Cloud is certified under the EU-US Data Privacy Framework and has concluded Standard Contractual Clauses (SCC) pursuant to Art. 46 GDPR. Transfer of personal data to third countries outside the EEA does not generally take place; processing occurs exclusively in Frankfurt.

Legal basis: Art. 6(1)(b) GDPR (contract performance), Art. 6(1)(f) GDPR (legitimate interest in reliable infrastructure).

3. Firebase Services (Google)

We use the following Firebase services from Google Ireland Limited:

3.1 Firebase Authentication

For user account management. Stored data includes: email address, hashed password (email/password login only), name and profile picture (Google OAuth login only), UID, account creation and last login timestamps.

Legal basis: Art. 6(1)(b) GDPR.

3.2 Cloud Firestore

For storing usage metadata: number of conversions, timestamps, invoice numbers, seller and buyer names, invoice amount and currency. Invoice contents (PDF, extracted JSON data, generated XML files) are not permanently stored and remain exclusively in memory during processing.

Legal basis: Art. 6(1)(b) GDPR (quota checking) and Art. 6(1)(f) GDPR (usage statistics).

3.3 Cloud Functions (Serverless)

For executing conversion logic. Processing is stateless; after completing a request, all temporary data is deleted from memory. No writing to persistent storage (no Cloud Storage, no logging of invoice contents).

3.4 Retention Periods

4. Web Analytics (Google Analytics 4 / Firebase Analytics)

We use Google Analytics 4 (operated as Firebase Analytics) from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyze usage of our website and app.

4.1 Collected Data

Google Analytics collects, among others:

4.2 Cookies

Google Analytics sets the following cookies:

4.3 IP Anonymization

Google Analytics 4 anonymizes IP addresses by default. No complete IP address is stored or transmitted to Google servers outside the EU.

4.4 No Data Transfer to Third Countries

Data processing takes place on Google’s EU servers. Google is certified under the EU-US Data Privacy Framework and has concluded Standard Contractual Clauses (SCC) pursuant to Art. 46 GDPR.

4.5 Opt-Out

You can prevent collection by Google Analytics by:

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in analyzing and improving our Service).

5. AI Processing (Google Vertex AI / Gemini)

For extracting invoice data, we use Google Vertex AI (Gemini 2.5 Flash) in the region europe-west3 (Frankfurt). The uploaded PDF is transmitted as a Base64-encoded data stream to the Vertex AI API. Google processes this data pursuant to the Google Cloud Data Processing Addendum (DPA) and does not use transmitted customer data for training AI models.

Insofar as the uploaded PDF contains personal data of third parties (e.g., invoice recipients), the user is the data controller; TaxLayer acts as data processor. A separate data processing agreement (DPA) can be concluded upon request.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

6. Payment Processing (Stripe)

Payment processing for paid subscriptions is handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin D02 H210, Ireland (“Stripe”).

When concluding a subscription, the following data is transmitted to and processed by Stripe: name, email address, payment data (credit card or SEPA direct debit), billing address. TaxLayer does not store complete payment data; only a Stripe-internal customer ID is stored in Firestore.

Stripe is certified under the EU-US Data Privacy Framework and has concluded Standard Contractual Clauses. Stripe’s privacy policy is available at stripe.com/privacy.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

7. Email Communication (Welcome Email)

After registration, we send a one-time welcome email to the email address provided during registration. Sending is performed via Gmail SMTP (Google Ireland Limited) with app password authentication. The email address is not used for advertising, newsletters, or marketing and is not shared with third parties.

You can unsubscribe from emails at any time by contacting info@landauer.de.

Legal basis: Art. 6(1)(b) GDPR (contract performance — advance information about the Service) and Art. 6(1)(f) GDPR (legitimate interest in user information).

8. Google reCAPTCHA v3

We use Google reCAPTCHA v3 for protection against automated abuse (bots, script attacks). Usage data (IP address, mouse movements, session duration, browser information) is transmitted to Google Ireland Limited.

Since reCAPTCHA v3 requires no visible interaction and runs entirely in the background, separate consent is not required.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protection against bot attacks).

9. Partner Program (Affiliate System)

Users participating in the partner program voluntarily create a partner link (slug). The following data is stored: partner slug, email address, payout destination (IBAN or PayPal address, only if manually entered), registration date, number of referred users and active customers.

When a new user registers via a partner link, their account is linked to the affiliate’s slug (field referred_by in Firestore). This link is permanent and serves correct commission attribution.

Legal basis: Art. 6(1)(b) GDPR (contract performance within the partner agreement).

10. Cookies and Local Storage

This website uses no marketing or advertising cookies. No data is transmitted to advertising networks or social media platforms.

The following storage mechanisms are used:

Analytics Cookies (Google Analytics 4)

These cookies serve statistical evaluation of website usage. You can prevent collection at any time (see section 4.5).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in analyzing and improving the Service).

Technically Necessary Local Storage

Legal basis for technically necessary storage: Art. 6(1)(f) GDPR.

11. Your Rights Under GDPR

You have the following rights against the data controller:

To exercise your rights, contact: info@landauer.de

You also have the right to complain to the competent data protection supervisory authority. The competent authority is the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI), Friedrichstr. 219, 10969 Berlin, mailbox@datenschutz-berlin.de.

12. Order Processing (Art. 28 GDPR)

Insofar as TaxLayer processes personal data of third parties on behalf of the user (in particular customer data in uploaded invoices), TaxLayer acts as data processor. A written data processing agreement (DPA) can be concluded upon request at info@landauer.de. Without a DPA, the Service may not be used to process special categories of personal data under Art. 9 GDPR.

13. Data Security

All connections to the platform are TLS 1.2/1.3 encrypted (HTTPS). Firebase and Google Cloud Platform are ISO/IEC 27001, SOC 1, and SOC 2 Type II certified. All personal data is processed exclusively in the EU (Frankfurt am Main).

In the event of a data breach that poses a risk to affected persons, we will notify the competent supervisory authority within 72 hours of becoming aware (Art. 33 GDPR).

14. Complete List of Services Used

For transparency: TaxLayer uses exclusively the following services and providers. No additional third-party services are used.

No social media plugins, advertising networks, third-party CDNs, external font services, or other tracking services are used.

15. Changes to this Privacy Policy

We reserve the right to update this privacy policy in the event of changes to the platform or legal requirements. The current version is always available on this page. For material changes, we will notify registered users by email.