Privacy Policy
Your business information belongs to you. Tax Steps does not own it, never sells it, and never shares it with anyone for their own purposes. The only companies that handle it are the service providers that run Tax Steps for us, and they may use it for that job alone.
Who we are
Tax Steps is run by Blyntic Ltd, a company in New Zealand. We are responsible for the personal information described here. For anything about your privacy or your data, email jude@blyntic.co.nz.
What we collect
Only what Tax Steps needs to work:
- Your account: name, email address, and either a password (stored by Supabase in scrambled, one-way form; we never see it) or your Google sign-in.
- Your business details, if you add them: business name, tax or GST number, country, currency, time zone and tax year.
- The expense records you save: merchant, dates, amounts, tax, categories, notes and payment method.
- If you connect Google Sheets: your Google account email and an encrypted access key, so exports can reach your sheet.
- Technical basics: a sign-in cookie to keep you signed in, and short-lived security logs kept by our providers.
Receipt photos are never stored
Receipt photos are never stored. We extract the details, then discard the image — no copies in our database, storage or logs.
Images are sent to our AI provider (OpenAI) for extraction with storage disabled; the provider may retain API inputs for up to 30 days for abuse monitoring.
How we use it
To run Tax Steps for you, and nothing else: showing your records, building reports and exports, keeping your devices in sync, keeping your account secure, and contacting you about your account or changes to these documents.
We do not use your information for advertising, we do not build profiles of you, and we do not let anyone train AI models on it.
Who handles your information
We never sell, rent or share your business information with anyone for their own purposes: not advertisers, not data brokers, not other businesses. These service providers run parts of Tax Steps for us and may use your information only to do that:
We would only disclose information beyond this if the law requires it, and we would tell you unless the law prevents us. If Tax Steps is ever sold, we will tell you first, the new owner must keep these promises, and you can delete your account before anything moves.
Where it is stored
Your records are stored in Sydney, Australia. The website and receipt reading run in the United States. We only use providers that protect information to a standard comparable to New Zealand’s Privacy Act 2020.
Cookies
Tax Steps uses a cookie only to keep you signed in, and your device remembers your chosen theme. There are no advertising or analytics trackers.
How long we keep it
Until you delete it. Deleting a record removes it straight away, and deleting your account removes your profile, categories, records and Google connection from every device. Backups held by our database provider expire on their normal schedule.
Your rights
You can see, correct, export and delete your information yourself in Settings, including “Export all my data” and “Delete account”. You can also ask us for a copy or a correction by email.
If you are unhappy with how we handle your information, tell us first. In New Zealand you can also complain to the Office of the Privacy Commissioner (privacy.org.nz). In the EU or UK you also have rights under the GDPR, including complaining to your local data protection authority.
Security
Information is encrypted in transit, each account can only ever read its own records, Google access keys are encrypted, and receipt photos are never kept. No system is perfectly secure, so if something goes wrong we will tell affected users and the Privacy Commissioner as the law requires.
Children
Tax Steps is for people aged 16 and over.
Changes
If we change this policy in a meaningful way, we will update the date below and ask you to agree again. Questions: email jude@blyntic.co.nz.