Privacy Policy

ChainTax is a UK-based tax calculation tool for crypto and DeFi transactions. For the purposes of UK data protection law, the data controller is ChainTax Ltd (company number NI739302, registered in Northern Ireland), contactable at hello@chaintax.co.uk.

Governing jurisdiction: Northern Ireland.

• •Email address: Used for account creation, authentication, and transactional emails (welcome, purchase confirmation).
• •Wallet addresses: Public blockchain addresses you provide, along with chain (e.g. Ethereum, Arbitrum) and optional label. Used to fetch your on-chain transaction history.
• •On-chain transaction data: Transaction hashes, timestamps, and decoded event logs fetched from public blockchains. This data is already publicly available on-chain.
• •Tax calculations: Gains, losses, income, and cost basis figures derived from your transaction data. These are computed by ChainTax, not provided by you.
• •Payment information: Processed by Stripe. ChainTax stores the Stripe customer/session references, tax year, tier, amount, and purchase/refund dates needed to provide access and receipts. We never see or store your card details.
• •Tax preferences: Your selected tax band (basic/higher) and optional salary figure, used to refine income tax estimates.
• •Cookies & first-party storage: Essential session cookies keep you signed in, and small first-party preferences remember UI choices and whether you allow anonymous analytics. PostHog analytics are off by default; if you enable them, events use memory-only identifiers and are never tied to your ChainTax account ID or email. Vercel Analytics and Speed Insights are cookieless.
• •IP address: Used for ephemeral rate limiting (via Upstash) and not associated with your account. When a shared report link is opened, a salted, irreversible hash of the visitor’s IP (never the raw IP) is stored so we can detect abuse and show the report owner access counts.

• •Contract performance (Art. 6(1)(b)): Processing your wallet data, sorting transactions, calculating tax, and generating reports, which is the core service you signed up for.
• •Legitimate interest (Art. 6(1)(f)): Rate limiting, fraud prevention, and maintaining service security and availability.
• •Consent (Art. 6(1)(a)): Optional anonymous PostHog analytics. They remain off unless you allow them, and you can switch them off again at any time.

We do not currently send marketing emails. If we do in future, we will obtain your explicit consent first.

• •Fetching on-chain transaction history for wallets you provide
• •Classifying transactions (on-chain DeFi and exchange CSV imports) using deterministic protocol-specific rules
• •Calculating UK capital gains tax, income tax, and HMRC matching (Section 104, same-day, bed-and-breakfast)
• •Generating tax reports (PDF and CSV) and SA108 box mappings
• •Processing payments via Stripe
• •Sending transactional emails (welcome email, purchase confirmation)
• •Rate limiting to protect service availability
• •Running Concierge syncs on your behalf when you request one via hello@chaintax.co.uk

Concierge sync: if you request a manual sync via hello@chaintax.co.uk, you authorise ChainTax to access on-chain transaction history for the public wallet addresses you supply, in order to generate your HMRC report. We never request private keys, seed phrases, or exchange API keys you have not explicitly granted. Concierge data is stored on a dedicated internal service account and can be deleted on request once the report has been delivered and the 14-day support window has closed. If the service account is separate from your self-serve account, request its deletion separately so we can verify the relevant portfolio before removing it.

Some of our processors are based in the United States. Where personal data is transferred outside the UK, transfers are protected by Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA) as applicable.

Blockchain data (wallet addresses and transaction hashes) is inherently public and available globally on-chain. Providing a wallet address to ChainTax does not create a new data transfer, because we are reading data that is already publicly accessible.

Your data is retained for as long as you maintain an active account.

Deleting your account permanently removes your ChainTax login and application data (wallets, transactions, tax events, tax year summaries, report shares, and in-app purchase/refund records). This deletion is irreversible. There is no recovery period. Start deletion from Settings or email hello@chaintax.co.uk. ChainTax records a detached retry job while deletion is in progress so temporary Supabase or Stripe failures cannot be silently treated as success. Identifiers required for retries are erased on completion; the anonymous completion record is purged after 30 days.

Stripe may independently retain payment and transaction records under its own legal and regulatory obligations. Those processor records are not ChainTax application purchase history and are governed by Stripe's privacy terms. Shared technical caches (such as price and token metadata) may be retained where they are not linked to your ChainTax account. Public wallet addresses and transaction hashes can still be personal data when they are linkable to an individual, so we do not describe them as anonymous merely because they are public.

• •Access: Request a copy of the personal data we hold about you.
• •Rectification: Correct any inaccurate personal data.
• •Erasure: Delete your account and all associated data.
• •Portability: Export your data. CSV export is available in-app for tax reports.
• •Objection: Object to processing based on legitimate interest.
• •Restriction: Restrict processing in certain circumstances.
• •Withdraw consent: Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email hello@chaintax.co.uk. We will respond within 30 days.

ChainTax uses strictly necessary cookies for authentication (maintaining your signed-in session) and first-party storage for service/UI preferences. Optional PostHog analytics are off by default. If you allow them, ChainTax sends only explicitly defined aggregate actions using memory-only identifiers, with no account identification, autocapture, advertising, session replay, or cross-site tracking. Our web and performance analytics (Vercel Analytics and Speed Insights) are cookieless.

We also use Sentry for error monitoring. Session Replay and performance tracing are disabled, and error events are scrubbed of user, request, cookie, email, wallet, transaction, and session identifiers before sending.

We keep this footprint deliberately minimal and limited to first-party, privacy-respecting purposes. We do not sell or share this data, and it is never used for advertising. We keep our use of cookies and similar technologies under review under UK PECR (Privacy and Electronic Communications Regulations).

ChainTax is not directed at anyone under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a child, we will delete it promptly.

We take the security of your data seriously. Measures include:

• •All data encrypted in transit (TLS) and at rest
• •Authentication via Supabase Auth with PKCE flow, and no passwords stored by ChainTax
• •Every API route enforces authentication, rate limiting, and input validation
• •Content Security Policy (CSP) headers on all responses
• •No raw SQL, as all database access goes via Prisma ORM with parameterised queries
• •Service credentials never exposed to the client

We may update this privacy policy from time to time. The “Last updated” date at the top of this page will reflect any changes. We will communicate material changes where appropriate. Optional analytics will remain governed by your saved choice and will not be enabled merely because this policy changes.

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113