Privacy policy

This is a translation of the German Datenschutzerklärung. If the two differ, the German version applies. As of 5 November 2026.

This page says which personal data TaxMaxi processes, for what purpose, on which legal basis, who it goes to and how long we keep it. In short: we process your email address, the wallet addresses you add, their public transactions and your answers in order to calculate your tax report. We use no advertising trackers and no third-party analytics services, count visits ourselves and without a cookie (see 2.), and sell no data.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

TaxMaxi UG (haftungsbeschränkt)
c/o Ast/Onward2
Belforter Str. 9
10405 Berlin
Germany

Email: [email protected]. We have not appointed a data protection officer because we are not obliged to; please send questions about data protection to this address.

2. When you visit the pages

Our pages run on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in a data centre in Nuremberg. Every request reaches it through the network of Cloudflare (Cloudflare, Inc., USA), which encrypts the connection, protects the pages against attacks and passes the request on to our server. In doing so, Cloudflare and our server process, as is technically necessary, your IP address, the address requested, the date and time and details of your browser in order to deliver the page.

Our program writes an error and operations log. It can contain wallet addresses, transaction signatures and, in individual cases, your email address, for example when an error occurs while a sign-in email is being sent. We analyse it to find errors and to safeguard operations. For this we transfer it to Datadog, Inc., New York, USA; the data is stored in Datadog's EU region.

Our server also writes an access log: your IP address, the address requested without sign-in and confirmation codes, the date and time, the server's response, details of your browser and the page you came from. We analyse it to detect errors and misuse, for example when someone gets around the limit on the free reads. It goes to Datadog in the same way.

So that we can count how many people really look at our pages, and not only how often they are loaded, a small script on the home page, the demo, the sign-in page and our other public pages sends a single message to our own server as soon as the page has been visible for about two seconds or you scroll, tap or type. It contains the page requested, the name of the website you came from and the campaign details of a link (utm_source, utm_medium, utm_campaign). For this the server forms a daily identifier: a truncated checksum of your IP address, the details of your browser, the name of our site and a random value that only the server's working memory knows and that it replaces with a new one every night at midnight. We do not write down your IP address for this. After midnight our server no longer knows the old random value either, so that the identifier can be attributed neither to you nor to your later visits. The same identifier is recorded with the steps on the home page (reading a wallet, opening the report, a reminder, the waitlist), never your wallet address or email address. The script sets no cookie and stores nothing in your browser. The messages are in the operations log and go to Datadog with it; we analyse them only in aggregate.

We deliver fonts and scripts ourselves; apart from Cloudflare, no data is transferred to third parties such as Google Fonts when a page is requested.

Some posts in our blog show a video from YouTube. As long as you do not play it, the page loads nothing from YouTube: you see only a preview image that we deliver ourselves and, below it, the note that playing loads the video from YouTube. Only when you click the preview image does your browser load the player from youtube-nocookie.com, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In doing so Google receives your IP address, the address of the page the video is on and details of your browser; during playback YouTube can set cookies or similar storage in your browser and also transmit data to Google LLC in the USA. Google processes this data under its own responsibility in accordance with its privacy policy. The legal basis is your consent, which you give with the click (Art. 6(1)(a) GDPR, § 25 (1) of the Telecommunications Digital Services Data Protection Act (TDDDG)); without a click nothing is transferred to YouTube.

The legal basis is our legitimate interest in a secure and functioning service (Art. 6(1)(f) GDPR).

3. Sign-in and account

You sign in with your email address, without a password: we send you a link and a six-digit code. For this we store your email address, the time of the sign-in and, of the link and the code, only a hash value. Anyone who enters an address for the first time creates an account by doing so.

We send the emails through Resend (Resend, Inc., USA), as well as the emails about an order, renewal, cancellation and refund. For this Resend receives your email address and the content of the email.

After the sign-in we set a cookie that keeps you signed in (__Host-taxmaxi_session, 30 days). During a sign-in we set a second one that matches the code to the right sign-in (taxmaxi_login, 15 minutes). When you open the demo, we set a cookie with a random identifier that keeps your visit to the demo apart from others (taxmaxi_demo, 30 days). What you do in the demo, such as answering a question, we store under this identifier in a temporary database on the server, which we delete as soon as the server restarts; it is not attributed to any person. All three cookies are strictly necessary for the service you have requested and need no consent (§ 25 (2) Nr. 2 TDDDG). Your choice between the light and the dark design is stored by your browser itself (localStorage, key theme), and in the demo also the step of the guide, until you close the tab (sessionStorage); neither leaves your device.

The legal basis is the performance of the contract of use (Art. 6(1)(b) GDPR).

4. Wallets and transactions

When you add a Solana wallet, we store its address in your account and read its transactions through Helius (Helius Labs, Inc., USA). For this Helius receives the wallet address and the signatures of the transactions. We store the responses on our server so that a wallet does not have to be read again on every request; a wallet address that several users add is read once for all of them.

We read an Ethereum wallet in the same way, through Etherscan (etherscan.io), on Ethereum and the chains that share the same addresses with it (Base, Arbitrum, Optimism, Polygon, BNB Chain). For this Etherscan receives the wallet address.

Transactions on Solana and Ethereum are public. They become personal data because you connect an address to your account. Only your account sees this connection.

When you connect your Coinbase account, you sign in at Coinbase (coinbase.com) and allow TaxMaxi there to read your accounts and their transactions. The connection allows nothing more: it can neither trade nor move money, and we do not receive your email address at Coinbase. For this Coinbase sends us the identifier of your Coinbase user and an access authorisation, which we store encrypted on our server. With it we read your accounts at Coinbase (currency, name, balance) and all their transactions with type, amount, value, time and the details Coinbase sends with them, such as addresses and transaction hashes of a blockchain, and store them in your account. Unlike transactions on a blockchain, this data is not public; only your account sees it. If you disconnect, we revoke the authorisation at Coinbase and delete it together with everything we have read from Coinbase. You can also end the connection in your settings at Coinbase.

We store your answers to the questions of the review, and prices, dates and costs you have entered, in your account, together with what the rules would have read without your answer.

The legal basis is the performance of the contract of use (Art. 6(1)(b) GDPR).

5. Home page: reading a wallet, reminders, waitlist

On the home page you can enter a Solana address without signing in. We read its transactions through Helius as under 4., unless we have already read them, and store the responses on our server in the same way; we do not connect the address to you. So that the free reads and reminders are not misused, we count them per IP address and day in the server's working memory; we forget the count at the end of the day, at the latest when the server restarts. The legal basis is our legitimate interest in keeping the site available to everyone (Art. 6(1)(f) GDPR).

If you ask to be reminded on the home page, we store your email address, the day chosen, the language of the page and, if you have just looked at your own wallet, its address, so that the link in the email leads to its year. First we send an email with a confirmation link; the reminder applies only once you open it (double opt-in). On that day we send a single email. Every email contains a link with which you end the reminder. We send the emails through Resend (see 3.). We delete an unconfirmed reminder after seven days, and one that has been sent or ended 30 days after that. The calendar file that you can download instead is created when it is requested, without anything being stored. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time through the link in the email.

For countries and languages that TaxMaxi does not yet offer, you can put your name down on our pages ("Notify me"). We then store your email address, the country or language you are waiting for and the language we should write in. First we send an email with a confirmation link; the entry applies only once you open it (double opt-in). After that we send a single email as soon as the country or language is ready, and no newsletter. Through the link on the page after the confirmation you take your name off again, or you write to [email protected]. We count the entries per IP address like the reminders, and we send the emails through Resend (see 3.). We delete an unconfirmed entry after seven days, a confirmed one when the email has been sent, and one that has been taken off 30 days after that. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

6. Prices

For the valuation in euros we request prices from CoinGecko (Gecko Labs Pte. Ltd., Singapore), including the price data of decentralised exchanges, and the reference rate of the euro to the US dollar from the European Central Bank. These requests contain only token addresses, trading pairs and points in time, no wallet addresses and nothing that points to you.

7. Analysis with language models

We have transactions that the rules cannot classify read by a language model so that it explains to you what probably happened; the model proposes an answer, the decision is yours. This happens when an open question is displayed and when you have a transaction investigated or ask the model a question. For this we transmit the transaction concerned with wallet address, counterparties and amounts, transactions of the wallet from the same period and, where applicable, your question to Gemini via Vertex AI by Google Cloud (Google Cloud EMEA Limited, Ireland).

After a wallet has been read, an assistant can itself prepare the open questions that can change your tax. It reads them twice: Gemini via Vertex AI by Google Cloud reads them, and Claude by Anthropic (Anthropic Ireland, Limited, Ireland) reads them once more as a check; where both come to the same result, we put it to you for confirmation, otherwise it remains your question. For this both receive the wallet address, the transactions of the open questions with counterparties, tokens, amounts, points in time and their value in euros and, when the model looks something up, public data of the blockchain on the addresses, tokens and programs involved. They do not receive your email address. What the models propose we store in your account until a later run replaces it or you confirm it, and their responses on our server so that the same question is not asked again.

When you choose "Ask AI" in the transaction list, we transmit your input, the filters currently set and the values the filters offer, such as the names of your tokens and the titles of your questions, to the model Jev by TypeSafe (TypeSafe AI, Inc., USA). It runs in the USA and replies only with the matching filters. It does not receive your email address. Under its terms TypeSafe does not use this data to train its models and keeps it for as long as is necessary for the service; it does not name a fixed period. We store neither your input nor the response.

Under their terms for business customers, Google and Anthropic do not use this data to train their models. Anthropic deletes inputs and outputs after 30 days; only what its check for misuse identifies as a violation of its usage policies is kept for up to two years. The processing can also take place outside the EU, at Anthropic in the USA (see 10.).

The legal basis is the performance of the contract of use (Art. 6(1)(b) GDPR): the models help to classify your transactions and to ask you fewer questions. The calculation of your report is not an automated decision within the meaning of Art. 22 GDPR: a model's proposal counts only once you confirm it, you see every classification, and each one can be changed by an answer.

8. Payment

If you pay TaxMaxi, this is done through Stripe (Stripe Payments Europe, Ltd., Ireland). For this Stripe receives your email address, the payment details you enter on the payment page and the amount; we do not see card details. Stripe processes part of the data under its own responsibility, for example to prevent fraud, in accordance with its privacy policy. We keep invoices and payment receipts for as long as commercial and tax law requires.

The legal bases are the performance of the contract (Art. 6(1)(b) GDPR) and our statutory retention obligations (Art. 6(1)(c) GDPR).

9. Backup

So that your account, your wallets, your answers and the billing survive a failure of our server, we continuously copy the databases they are held in to storage at Cloudflare (Cloudflare, Inc., USA) that is restricted to data centres in the EU. The copy is transferred and stored encrypted. We keep one complete copy per day and the changes in between for 14 days, so that we can also restore an earlier state, for example after an error. We do not back up the transactions we have read; we can read them again at any time. Nor do we back up a connection to Coinbase and what we have read there; after a failure you connect Coinbase again.

The legal basis is our legitimate interest in protecting your data against loss (Art. 6(1)(f) GDPR), as Art. 32 GDPR requires.

10. Recipients and third countries

The service providers named above process data on our behalf (Art. 28 GDPR), except Stripe, in so far as it acts under its own responsibility, YouTube, which loads a video only on your click and under its own responsibility, and Coinbase, of which you yourself are a customer and which sends us your data at your request. Some are based in the USA or in Singapore. In so far as data goes there, we base the transfer on an adequacy decision of the EU Commission, for the USA on the EU-US Data Privacy Framework if the recipient is certified under it, and otherwise on the standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR).

Beyond this we pass data on only if we are obliged to by law.

11. Storage period

We keep your account, your wallets and your answers for as long as you use TaxMaxi. If you want to delete your account, write to [email protected]; we delete it, with your wallets, your answers and a connection to Coinbase together with everything we have read there, within one month. They disappear from the backup at the latest 15 days after the deletion. The transactions we have read of a wallet that nobody else has added are then deleted as well. Sign-in links and codes expire after 15 minutes, sessions after 30 days. We delete reminders, as described under 5., seven days after you signed up for them if you have not confirmed them, otherwise 30 days after they were sent or ended; entries in the waitlist likewise, as described there. We delete the operations log and the access log after 30 days at the latest. We keep invoices and accounting records for as long as § 147 of the Fiscal Code (AO) and § 257 of the Commercial Code (HGB) require, up to ten years.

12. Your rights

You have the right of access (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To do so, write to [email protected].

You can lodge a complaint with a data protection supervisory authority. The one responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin.

If what we process changes, we change this policy. The version shown here applies.