Privacy and Data Protection.

Controller

Fiscal.ia SAS is the data controller for personal data collected through the IFG platform, as defined in Article 4(7) of the GDPR. For data processing questions, right requests, or incident reporting, contact privacy@ifg.tax.

Where a professional user submits personal data relating to their own clients through the platform (for example, within a tax matter brief), the professional user acts as data controller in respect of that client data, and Fiscal.ia SAS acts as data processor within the meaning of Article 4(8) of the GDPR. A Data Processing Agreement aligned with Article 28 GDPR is available on request and is executed by default for Team engagements.

Data We Collect

We collect only what is strictly necessary to provide the service, operate the platform securely, and meet our legal obligations.

• Account dataEmail address (required), name, firm name, professional qualification, and phone number where provided.
• Matter contentTax questions submitted by the user, the memo and citations returned by the engine, and attachments. May include personal data relating to the user’s clients where the user chooses to submit it.
• Technical dataIP address, user agent, timestamps, request identifiers, latency and token metrics, audit and security logs.
• Billing dataSubscription history, invoices, VAT number where supplied. Card details are captured and processed by Stripe and are never stored by Fiscal.ia.
• CommunicationsMessages exchanged with support, feedback submissions, and sales correspondence.

Purposes and Legal Bases

Each processing activity has a defined purpose, a lawful basis under Article 6 of the GDPR, and a retention period. The following summary applies to personal data processed by Fiscal.ia as controller:

Where we rely on legitimate interests, we have conducted a documented balancing test and made the opt out available. Where we rely on consent, it can be withdrawn at any time without affecting prior lawful processing.

Recipients and Sub-processors

Access to personal data is restricted to Fiscal.ia personnel who need it to carry out their duties, and to the sub-processors listed below. Each sub-processor is bound by a written agreement meeting the requirements of Article 28 GDPR, including confidentiality, security, audit rights and assistance with data subject requests.

• SupabaseManaged Postgres database and authentication. Hosting in the European Union (eu-west-3, Paris).
• HetznerPrimary application hosting. Nuremberg, Germany.
• OpenAIAI inference provider. API processing with zero retention for Enterprise endpoints and no training by default.
• StripePayments and subscription billing. PCI DSS certified. EU and US entities as documented by Stripe.
• Email providerTransactional email delivery for authentication, invoices, and matter deliveries.

An updated list of sub-processors is available on request and is disclosed in advance to Team customers before onboarding a new sub-processor.

International Transfers

Personal data is primarily processed within the European Union. Certain AI inference operations may involve transfer to the United States when OpenAI US endpoints are used. Such transfers rely on one or more of the following safeguards under Chapter V of the GDPR:

• SCCsStandard Contractual Clauses adopted by the European Commission under Decision 2021/914, executed with each AI provider.
• DPFReliance on the EU US Data Privacy Framework where the receiving entity is certified.
• SupplementaryTechnical and contractual measures including encryption in transit, data minimisation, prompt scrubbing where feasible, and contractual prohibition on training.
• TIAA Transfer Impact Assessment has been conducted and is reviewed periodically.

If these safeguards cannot be maintained for a particular module, the module is either discontinued or reconfigured to run on an EU endpoint.

Security

We implement technical and organisational measures aligned with Article 32 GDPR and the state of the art.

• EncryptionTLS 1.3 in transit. AES 256 at rest for database storage. Encrypted backups.
• AuthenticationSession tokens with short lifetime, hashed passwords (bcrypt), optional multi factor authentication.
• IsolationRow level security, tenant isolation for Team deployments, least privilege access control.
• MonitoringAudit logging, intrusion detection, rate limiting, and DDoS protection at the edge.
• StandardsProcessors selected against ISO/IEC 27001, SOC 2, and PCI DSS where applicable.
• Incident responseDocumented breach procedure. Notification to the CNIL within 72 hours and to affected individuals without undue delay, where required under Articles 33 and 34 GDPR.

Matter Confidentiality

The IFG platform is used by tax counsel, accountants, and corporate tax teams. We recognise that information submitted in a matter may be covered by professional secrecy or legal privilege under the applicable bar or professional rules.

Accordingly: matter content is not used to train AI models; access within Fiscal.ia is restricted to personnel bound by confidentiality; matter content is not disclosed to any third party without the user’s instruction or a binding legal order; and where a binding legal order is received, we will where lawful notify the user before disclosure so counsel may assert applicable privilege.

Users retain full responsibility for whether, and how much, client information is submitted to the platform. We recommend redaction of client identifiers where not necessary to the research question.

Automated Processing and AI

IFG uses large language models to generate research memos, source rankings and risk flags. The memo is a first pass research document intended for counsel review. It is not a legal opinion, not a regulated decision, and does not produce automatic legal effect on the user or on any third party within the meaning of Article 22 GDPR.

All substantive professional decisions remain with the human counsel using the tool. The user is responsible for reviewing the output, verifying sources, and exercising independent professional judgement before any advice is rendered to a client.

Your Rights

Subject to the conditions set out in the GDPR, you may exercise the following rights over personal data that Fiscal.ia processes as controller:

• AccessObtain a copy of your personal data (Art. 15).
• RectificationCorrect inaccurate or incomplete data (Art. 16).
• ErasureRequest deletion of your data subject to legal retention obligations (Art. 17).
• RestrictionRequest restriction of processing in the cases listed in Art. 18.
• PortabilityReceive your data in a structured, machine readable format and transmit it to another controller (Art. 20).
• ObjectionObject to processing based on legitimate interests, including direct marketing (Art. 21).
• Consent withdrawalWithdraw consent at any time, without affecting prior lawful processing (Art. 7).
• Post mortem instructionsProvide instructions on the treatment of your data after your death, pursuant to Article 85 of the French Data Protection Act.

To exercise these rights, contact privacy@ifg.tax. We respond within one month of a valid request. We may request reasonable verification of your identity before processing.

Cookies and Trackers

IFG uses only strictly necessary cookies to operate the platform. Analytics and audience measurement cookies, where used, are activated only after explicit consent and may be declined without affecting access to the service.

• AuthenticationSession cookie required for sign in. Lifetime: session.
• SecurityCSRF and rate limiting tokens. Lifetime: session.
• PreferencesLanguage and interface settings. Lifetime: up to 12 months.
• AnalyticsOnly on consent. Configured to anonymise IP and to respect the Do Not Track signal.

Children

The platform is restricted to tax professionals acting in a business capacity. We do not knowingly collect personal data from individuals under 18. If we become aware of such collection, we delete the data without delay.

Supervisory Authority

You may lodge a complaint with the competent data protection authority if you believe that processing of your personal data infringes the GDPR. In France, the supervisory authority is the CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr. Residents of other EU member states may also lodge a complaint with their local supervisory authority.

Changes to this Policy

We may update this Privacy Policy to reflect changes in law, service, or data protection practice. Material changes are communicated by email and through an in platform notice at least fifteen days before they take effect. The current version is always available at ifg.tax/privacy-policy.