Privacy Policy

Controller

What we process now (waitlist)

While the public site is waitlist-only, we process: (1) the email address you submit to join the waiting list; (2) UI locale / language preference needed to show the site; (3) a record of your cookie consent choices (Necessary Cookies / Analytics Cookies / Marketing Cookies) stored in your browser so we can honour them. Joining uses double opt-in: after you submit the form we send a confirmation email; your address is added to the active waitlist only after you confirm the link. Confirmed subscribers may receive a success email and later launch-related updates; every waitlist email includes an unsubscribe link. We do not collect passwords or tax transaction data at this stage.

Support, contact, and security checks

When you use Contact, a continue-thread reply link from our email, Tax Reports FAQ own-question, or article helpfulness (yes/no), we process: the message, vote, or feedback you send; optional name and email; ticket id; locale; and topic or page metadata needed to route the request. Guest article ratings do not require an account and do not collect name or email unless you are signed in. For abuse prevention we also store request context taken only from server HTTP headers (not from the form body): IP address, browser User-Agent, and Accept-Language, kept on the support case for ops review and export. Lawful bases: steps at your request / responding to you (Art. 6(1)(b) where applicable) or legitimate interests in customer support (Art. 6(1)(f)); and for Turnstile and request context, legitimate interests in security and fraud prevention (Art. 6(1)(f)), together with the ePrivacy strictly necessary exemption for security measures required to deliver the form safely. We use Cloudflare Turnstile (including invisible mode) to protect our forms against automated spam and abuse: your browser may complete a check in the background; our servers verify a short-lived token with Cloudflare (security/fraud — not a Marketing Cookie). Cloudflare’s processing is described in the Cloudflare Turnstile Privacy Addendum. Tickets live in our EU-region database; we may email you a receipt or staff reply via Resend. To alert our support team of new cases we may also send a short ops awareness ping (ticket id, surface, locale, optional name and email, and a short message preview) by email and/or Telegram to a private staff channel — not used for marketing. Telegram may process that ping outside the EEA under applicable transfer safeguards (for example EU Standard Contractual Clauses where required). After a case is closed, we retain support tickets for up to 24 months, after which they are hard-deleted or anonymised. If you request account deletion, we immediately anonymise associated ticket personal data (including message bodies replaced with a redacted placeholder where required), retaining only an unidentifiable operational ticket shell until the standard retention period ends. Signed-in feedback may also store your user id so we can reply in context.

Lawful bases

Waitlist email: consent (GDPR Art. 6(1)(a)) — you submit your email and agree to this Privacy Policy (together with Terms of use and Disclaimer) by continuing on the waitlist form. Necessary Cookies and local storage required to run the site and remember consent: legitimate interests in operating a secure, functional website (Art. 6(1)(f)), and/or necessity for the service you request. Optional Analytics Cookies and Marketing Cookies: consent only (Art. 6(1)(a)) via our cookie banner — never assumed from joining the waitlist. When the product launches, processing needed to provide your account and tax-reporting service will rely primarily on performance of a contract (Art. 6(1)(b)), with other bases where required by law.

What we will process when the product launches

When accounts are enabled, we expect to process: account email for authentication; imported transaction history (for example CSV exports); wallet settings; TaxProfile preferences (one profile per country); and calculation snapshots and related notifications — solely to provide crypto tax reporting for your chosen country module (Italy first). After you sign in, we may send a security login notice to your account email including your IP address, approximate location derived from that IP (country and, where available, city from our hosting edge — not GPS), device type, and time of sign-in, so you can spot unauthorised access; we do not log those notice details in application logs. We do not use imported history to custody assets, execute trades, or file returns with tax authorities on your behalf. Material changes to this policy will be highlighted on this page.

Cookies and similar technologies

We use one strict cookie consent experience for all regions (no geo-softening). Optional categories are off by default. Non-essential scripts and cookies are not loaded until you opt in. We use Google Consent Mode v2 in Basic mode: Google Analytics and Google Ads tags are not loaded before the matching consent, and we do not send cookieless analytics or advertising pings before consent.

• •Necessary Cookies (always on): session/locale preferences and storage of your cookie consent choice so the site and (later) your signed-in session can work. These cannot be switched off in Manage Cookies.
• •Analytics Cookies (optional): Google Analytics 4, only if Analytics Cookies is enabled on our side and you grant Analytics Cookies consent. Used to understand aggregate site usage. Consent mapping: Analytics Cookies ON → analytics_storage granted.
• •Marketing Cookies (optional): Google Ads (conversion / remarketing tag), only if Marketing Cookies is enabled on our side and you grant Marketing Cookies consent. Used to measure ad campaigns and, where applicable, show more relevant ads. Consent mapping: Marketing Cookies ON → ad_storage, ad_user_data, and ad_personalization granted.
• •You can change or withdraw optional consent at any time via Manage Cookies. Reject All turns off Analytics Cookies and Marketing Cookies only; Necessary Cookies remain. Manage Cookies is a preference control — not part of the waitlist contractual “agree to” covering Privacy Policy, Terms of use, and Disclaimer.

Where data is stored

Waitlist and (when enabled) product cloud data are hosted with EU-region providers where we control the choice of region (see sub-processors). Preferences and consent may also be stored in your browser (local storage). Application logs are designed to avoid personal data where practicable.

Transfers outside the EU/EEA

Some providers may process data in the United States or other countries. In particular, if you grant Analytics Cookies and/or Marketing Cookies consent, Google Analytics and/or Google Ads may involve transfers to Google in the US under Google’s applicable transfer mechanisms. We do not enable those tags without the matching consent. Where EU Standard Contractual Clauses or equivalent safeguards apply to our contracts with providers, we rely on those.

Retention

Waitlist email retention (storage limitation): (1) Pending (not confirmed): we keep the address only while the confirmation link is valid (7 days from the last confirmation email). After the link expires we delete the pending record — we do not keep unconfirmed emails indefinitely. (2) Confirmed: kept until you unsubscribe, ask us to delete, we close the waitlist, or we migrate you to a product account with notice. (3) Unsubscribed: we retain the record for up to 30 days after unsubscribe for operational consistency, then hard-delete the email from the waitlist database. Cookie consent records in the browser: until you clear site data or change preferences; we may keep minimal records needed to demonstrate compliance. Product account data (when available): while the account is active; deleted from our cloud after account deletion (cascade), subject to short technical backups and any legal retention we must observe. Closed support tickets: retained for up to 24 months after closure, then deleted or anonymised. Account deletion anonymises ticket personal data immediately, as described under Support above. To stop waitlist emails use the unsubscribe link in any waitlist message, or contact the controller email once published on this page to request earlier deletion.

Your rights (GDPR)

Where applicable you have rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent without affecting prior lawful processing. Waitlist: use the unsubscribe link in waitlist emails and/or email the controller contact to exercise rights (including deletion). Product accounts: Settings → delete account (cascade). You may lodge a complaint with your supervisory authority.

Sub-processors

We use: Cloudflare Turnstile (bot/fraud checks on public forms); Vercel (web hosting and edge delivery); Supabase in an EU region (waitlist subscriber database now; authentication and product database when accounts are enabled); Resend (transactional email from addresses such as no-reply@rixto.co: waitlist confirmation and success; and, when product sign-in is enabled, authentication OTP codes and related login notices — delivered via our Send Email Hook to Resend); Telegram (ops awareness pings for new support cases to a private staff channel: ticket id, surface, locale, optional name/email, short message preview — not marketing); Railway or an equivalent EU-hosted API (when the API is enabled); Google Analytics (only if Analytics Cookies is enabled and you consent); Google Ads (only if Marketing Cookies is enabled and you consent). We do not sell personal data. We do not claim certifications (for example SOC 2) or third-party products (Clarity, Mixpanel) that are not actually in use on the waitlist.