Last updated: 26 September 2026
1. Who we are
Justaxit (“we”, “us”) is an online service for checking tax identification numbers in bulk: EU VAT numbers (via the European Commission’s VIES system), UK VAT numbers (via HM Revenue & Customs), UK EORI numbers (via HMRC) and South African VAT numbers (via SARS). The service is available at app.justaxit.com and justaxit.com.
The data controller is:
Anhelina Martinovych, trading as Justaxit, a sole trader established in Ukraine
Correspondence address: ul. Kosiby 5/12, 32-020 Wieliczka, Poland
Email: dev@justaxit.com
We have not appointed a Data Protection Officer; we are not required to. Use the email address above for anything in this policy.
2. Who this policy covers
- Visitors who use the free checker without an account.
- Account holders (free, Premium subscribers and one-time pass buyers).
- People whose data appears in what our users check: the tax numbers, and the business names and addresses the tax authorities return for them. These are business identifiers; where they identify a sole trader they are personal data and this policy applies to them too (see section 5).
3. What we collect, why, and on what legal basis
| What | Why | Legal basis |
|---|---|---|
| Account details: email address, first and last name, password (stored as a hash, never in clear), whether you signed up with Google, email-verification status | To create and secure your account, sign you in, send service emails | Contract (UK/EU GDPR art. 6(1)(b)) |
| Google sign-in: your Google account email, name and Google user ID | To let you sign in with Google | Contract |
| Plan and billing status: your plan, subscription status, billing period dates, number of checks used this cycle, one-time pass dates, our payment provider’s customer and subscription identifiers | To provide what you paid for, enforce plan limits, and keep accounting records. We never see or store your card details; Stripe does | Contract; legal obligation (accounting and tax records) |
| Tax numbers you submit and the results (validity, business name and address as returned by VIES/HMRC/SARS, consultation numbers, timestamps) | To run the checks you ask for; for account holders, to keep your validation history and saved lists so you can evidence the checks later | Contract (account holders); legitimate interest in providing the service (visitors, who leave no stored results) |
| Your own VAT number (EU “requester” VAT number, UK VRN) if you add it in Settings | So VIES/HMRC issue a consultation number naming your business for each check | Contract (you choose to add it) |
| Files you upload (CSV, Excel, ODS, JSON, PDF, Word) | To find the column of tax numbers and run the check | Contract; see section 4 for how files are handled |
Usage counters: how many numbers a visitor or free account checked in the current cycle and when a cooldown ends; identified by a random guest_id cookie for visitors | To apply fair-use limits and protect the tax authorities’ systems from abuse | Legitimate interest (fair use, abuse prevention) |
| Referral records: your referral code, and whether people you invited signed up or subscribed | To run the referral programme | Contract (the programme terms) |
| Emails we sent you (recipient, subject, delivery status, kept 30 days) | To deliver and, if needed, retry account emails | Contract; legitimate interest (reliable delivery) |
| Sign-up attribution: which page and language you arrived on, which button you clicked to sign up, and the referring site | To understand which of our pages bring users | Legitimate interest (improving the service). No profiling, no advertising |
| Technical logs: IP address, request timing, errors | To keep the service running, rate-limit logins and imports, and investigate abuse | Legitimate interest (security) |
| Analytics and behaviour data through Google Analytics and Hotjar (pages viewed, clicks, approximate location, device, and, for Hotjar, anonymised session recordings and heatmaps) | To see how the app is used and where people get stuck | Consent — only after you accept in the cookie banner. You can withdraw at any time (section 6) |
We do not sell personal data, do not use it for advertising, and do not make automated decisions with legal or similarly significant effects about you.
4. Tax number validation and uploaded files
Tax number lookups. Every number you check is sent to the relevant authority: VIES (European Commission) for EU and Northern Ireland VAT numbers, HMRC for UK VAT and EORI numbers, and SARS for South African VAT numbers. Those authorities process the request under their own rules and privacy notices. Our UK VAT and EORI checks reach HMRC through a small relay server in the United States (see section 8). Where you have added your own VAT number in Settings, it is included in the request so the authority issues a consultation number in your name; otherwise the request is anonymous.
Results. For visitors, results are shown on screen and not stored. For account holders, each run (the numbers, the results returned by the authority, and a tamper-evident seal) is saved to your validation history for the retention period in section 7, and you can delete any entry at any time.
Uploaded files. Files are processed in memory and are not stored: we read the file, extract the rows, return them to your browser, and discard the file. PDFs are written to a temporary file only for the duration of text extraction and deleted immediately afterwards. When our column-detection cannot work out which column holds the tax numbers, a sample of at most 20 rows of the sheet is sent to Anthropic (the provider of the Claude AI model) to identify the layout. Before it is sent, email addresses, IBANs and any column whose header indicates contact or bank details are masked. Anthropic processes this sample under its commercial terms and does not use it to train its models. The sample is not stored by us.
5. If your data appears in a check someone else ran
Our users are businesses checking their customers’ and suppliers’ tax numbers, which tax law requires them to do. If you are a sole trader, your VAT number and the name and address your tax authority publishes for it may appear in a user’s history. We hold it on behalf of that user for the retention period in section 7. If you want to know whether a specific number appears in our records, or want it removed, contact dev@justaxit.com; note that the tax authority, not us, is the source of the published details.
6. Cookies and local storage
We use no advertising cookies. We only set what is needed to run the service unless you accept analytics in the cookie banner.
| Name | Set by | Purpose | Type | Lifetime |
|---|---|---|---|---|
guest_id | Justaxit (server) | Random identifier so fair-use limits work for visitors without an account | Strictly necessary cookie | 7 days |
token | Justaxit (browser storage) | Keeps you signed in | Strictly necessary | Until you sign out or 24 hours |
jx_consent | Justaxit (browser storage) | Remembers your cookie choice | Strictly necessary | Until you change it |
jx_landing_lang, sign-up attribution keys, post_login_redirect, active-job and cooldown state | Justaxit (browser storage) | Remembers the language you arrived in, where to send you after login, and a batch job in progress | Strictly necessary / functional | Up to 30 days |
_ga, _ga_* | Google Analytics | Usage statistics | Analytics — consent | Up to 2 years |
_hj* | Hotjar | Usage statistics, heatmaps, anonymised session recordings | Analytics — consent | Up to 1 year |
Google Analytics runs in consent mode: it is not loaded and sets no cookies until you accept. You can change your choice at any time from Settings → Your data → Change cookie settings or the “Cookie settings” link in the page footer. Rejecting removes the analytics scripts from the page.
7. How long we keep data
| Data | Kept for |
|---|---|
| Account details, settings, saved lists | Until you delete your account |
| Validation history — free accounts | 30 days from each run, then deleted automatically |
| Validation history — Premium and pass holders | 365 days from each run, then deleted automatically |
| Batch-job working copies | Same as the history retention for your plan |
| Run metadata (counts and timestamps only) | 12 months |
Visitor usage counters (guest_id) | 30 days after the cycle started |
| Emails we sent you (delivery record) | 30 days after delivery |
| Billing records | Kept by Stripe for the period tax and accounting law requires (typically 6–10 years); locally we keep only Stripe’s identifiers after account deletion |
| Account-deletion audit record (an opaque account ID, date, and counts — no name or email) | 6 years |
| Server logs | Up to 30 days (hosting platform defaults) |
Expired history is deleted by an automatic job that runs at start-up and daily.
8. Who we share data with (sub-processors) and international transfers
We use these providers to run the service. Each processes data only on our instructions.
| Provider | What for | Where |
|---|---|---|
| Vercel Inc. | Hosts the web app (static files, global CDN) | United States, with edge servers worldwide |
| Railway Corp. | Runs our API server | EU West (Amsterdam, Netherlands) |
| Railway Corp. (validator relay) | Relays UK VAT and EORI lookups to HMRC | US East (Virginia, United States) |
| MongoDB Inc. (Atlas) | Database | AWS, Frankfurt (eu-central-1), Germany |
| Stripe, Inc. | Payments, invoices, subscription management | United States / Ireland (Stripe Payments Europe Ltd for EU customers) |
| Resend, Inc. | Sends account emails | United States |
| Google LLC | Google sign-in (if you use it); Google Analytics (with consent) | United States |
| Hotjar Ltd (Contentsquare) | Usage analytics (with consent) | Malta / EU, with some processing in the United States |
| Anthropic PBC | Column detection for uploaded files (masked ≤20-row sample, only when needed) | United States |
| European Commission (VIES), HM Revenue & Customs, South African Revenue Service | The authorities that answer the tax-number lookups; independent controllers | EU, UK, South Africa |
International transfers. We are established in Ukraine; our servers are in the EU and the United States. Where personal data of people in the UK or EEA is transferred outside those areas, we rely on the UK International Data Transfer Agreement / Addendum or the EU Standard Contractual Clauses built into our providers’ data-processing terms, and, for US providers certified under it, the EU–US / UK–US Data Privacy Framework. Copies of the relevant terms are available from each provider or on request.
9. Your rights
Under the UK GDPR and the EU GDPR you can:
- Access your data and get a copy — Settings → Your data → Download my data gives you everything we hold about your account as a ZIP (JSON and CSV), instantly.
- Correct your name and email address in Settings (a new email address must be confirmed from that address before it takes effect).
- Delete your account and its data — Settings → Delete my account. This erases your account, history, lists, settings and referral records and signs you out. Any paid subscription is cancelled at the end of its current billing period and not renewed. Invoices already issued remain with Stripe as required by accounting law.
- Port your data: the export above is in machine-readable JSON and CSV.
- Object to processing based on our legitimate interests, and restrict processing while a dispute is resolved — email us.
- Withdraw consent for analytics at any time via the cookie settings; this does not affect what was done before you withdrew.
- Complain to a supervisory authority: in the UK, the Information Commissioner’s Office (ico.org.uk, 0303 123 1113); in the EU, the data protection authority of the country where you live or work. We would appreciate the chance to resolve it first — dev@justaxit.com.
For anything not covered by the self-service options, email dev@justaxit.com. We answer within one month; we may ask you to confirm your identity (normally by writing from the account’s email address).
10. Security
Passwords are stored as bcrypt hashes. All traffic uses HTTPS. Access to production systems is restricted to the controller and protected by credentials. Validation records are sealed with a server-side key so they can be shown to be unaltered. If we become aware of a personal-data breach that is likely to risk your rights, we will notify the ICO or the relevant EU authority within 72 hours and tell affected users without undue delay.
11. Children
Justaxit is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.
12. Changes to this policy
We will post any change here with a new “last updated” date. For material changes (new purposes, new categories of data, new sub-processors that receive your account data) we will also email account holders before the change takes effect.