Privacy policy

1. Who we are

TaxLatitude is an AI assistant for cross-border tax situations, used both by individuals — expatriates, digital nomads and owners of businesses operating across borders — and by the professionals who advise them. The site is available at taxlatitude.ai.

The data controller is:

Chuang Heng Investment Consultant Ltd, established 2017
1009, 10/F, Front Block, Ming Sang Industrial Building
19 Hing Yip Street, Kwun Tong
Hong Kong
Business Registration No. 68060800

Contact: contact@taxlatitude.ai

2. Data collected

TaxLatitude only collects strictly necessary data:

• Email address — to create and manage your account
• Google account identifier — for authentication; TaxLatitude never stores a password
• Chat messages and the documents you attach — to generate the AI's answers (text is extracted from documents; photos and scans are read by text recognition on our own servers)
• Anonymous browsing data — via Vercel Analytics (cookie-free)

TaxLatitude does not collect sensitive data (health, ethnicity, political opinions, etc.).

3. Use of data

Your data is used only to:

• Allow access to your account (authentication)
• Generate the AI assistant's answers
• Improve the service (anonymous analytics)

Your data is never sold or shared with third parties for commercial purposes.

4. Cookies

TaxLatitude only uses session cookies necessary for authentication (NextAuth). These cookies expire at the end of your session or upon logout.

No advertising, tracking or profiling cookies are used.

Browsing data is collected anonymously via Vercel Analytics, without cookies, in compliance with GDPR.

5. Hosting and subprocessors

Your data is hosted and processed by the following providers:

• Vercel Inc. (application hosting) — San Francisco, USA
• Neon Inc. (database) — hosted on AWS US East 1, N. Virginia, United States 🇺🇸
• Anthropic PBC (Claude AI engine) — San Francisco, USA
• OpenAI LLC (GPT-4o AI engine) — San Francisco, USA
• Mistral AI (embeddings used to search legal sources) — Paris, France 🇪🇺
• French State API platform PISTE (Légifrance and Judilibre legal databases) — France 🇪🇺

The user database (accounts, emails, conversations) is hosted by Neon on Amazon Web Services in the United States (US East, N. Virginia). Text sent to the AI APIs (Anthropic, OpenAI) is also processed on servers located in the United States. Only text in which identifiers have already been replaced (see below) is sent to the AI, embedding and legal-database providers listed above.

Protection of identifiers. Before your question, your documents or their file names reach any of these providers, names, e-mail addresses, phone numbers, IBANs and card numbers, tax and national ID numbers, dates of birth, postal addresses and company names are automatically replaced by placeholders such as [PERSON_1] (pseudonymisation). The correspondence between placeholders and real values stays on our servers, encrypted, is used only to show you your answers, and is deleted with the conversation. Photos and scanned PDFs are read by text recognition on our own servers and are never sent as images. Amounts, years, countries, cities, tax authorities and legal references are not masked, because the analysis needs them. Pseudonymised data remains personal data under GDPR. Detection is automatic and can miss an item — for example a misspelled name or a low-quality scan: you can preview what will be sent with your message and add anything you want masked.

Important: automatic masking is not perfect. Avoid entering identifying data about third parties unless it is necessary, and check the preview before sending.

6. Retention period

Your data is kept for the duration of your use of the service, then deleted within 12 months following your last login.

You can request immediate deletion of your account at any time at contact@taxlatitude.ai.

7. Your rights (GDPR)

In accordance with GDPR, you have the following rights:

• Right of access — obtain a copy of your data
• Right of rectification — correct your data
• Right to erasure — delete your account and your data
• Right to portability — receive your data in a readable format
• Right to object — object to the processing of your data

To exercise these rights: contact@taxlatitude.ai. We will respond within 30 days.

You can also delete your account directly online — deletion is immediate and permanent.

8. Security

TaxLatitude implements appropriate technical measures to protect your data: authentication delegated to Google (TaxLatitude never manages a password), HTTPS connections, and restricted database access, and encryption of the table that links placeholders to real values.