# What getax collects, why, and for how long.

getax builds a knowledge system and a report for professional firms. This policy covers data collected on this website, professional business contacts considered for getax email outreach, and client data a firm entrusts to the service.

Last updated 27 September 2026.

## Scope

Visitors and prospects: for data collected on www.getax.io, getax is the controller. A firm's clients: the firm is the controller and getax is the processor — direct requests to the firm first.

## This website

Demo requests, contact-form messages and job applications, with what each collects and where it is stored (encrypted where marked); cookieless PostHog analytics on the booking flow only; and server audit entries holding a reference id, time and IP, never content.

## Professional outreach

getax may contact professional business contacts about its service, keeping only business contact details, source references and recorded permission evidence — encrypted, with a lawful basis that depends on country, recipient and relationship, and no send without one. Estimate requests also record the calculator inputs, agency details and the wording and timestamp of any marketing consent; you may use the calculator without submitting, and consent can be withdrawn via privacy@getax.io.

## Inside the service

A firm's client answers a consent-gated questionnaire; drafts, profiles, report chats and review notes are stored encrypted in Postgres. One step leaves the getax host — the report-drafting model call through OpenRouter with zero data retention — and its trace stays on getax infrastructure, operator-only.

## Subprocessors

OpenRouter and the model provider (currently Anthropic, zero data retention), Resend, Google Workspace, Cal.com, PostHog, Grafana Cloud, Cloudflare (DNS only) and GitHub (operator sign-in); the database, trace store, error store and session replays run on infrastructure getax controls in the European Union.

## Retention

Reports ten years from delivery; questionnaire drafts thirty days after last activity; outreach contact and source details up to 180 days and outreach content and consent evidence up to 90 days, with a decision-and-outcome record without message text for up to three years; live conversations in the mailbox as long as they need, unsuccessful applications deleted within six months.

## Your rights

Under the GDPR and UK GDPR: access, correction, erasure, portability, restriction, objection and complaint to a supervisory authority. For anything given through this website, write to benjamin@getax.io or use the contact form; we answer within one month.

## Transfers

The service and its database are hosted in the European Union; transfers to the US subprocessors rest on standard contractual clauses and, for the model call, zero data retention.

## Contact

Questions, data-processing agreements and requests go to benjamin@getax.io; material changes are announced to firms by email. Postal address for Getax: R. das Escolas, Damaia, Amadora, Portugal 2720-223.

Full details: https://www.getax.io/privacy