Privacy policy
In force from (to be confirmed).
Loophole is an online international tax practice. This page explains what we keep about you, why, where it is stored, who helps us process it, how long we keep it, and what you can ask of us.
Who we are
Loophole is run by (to be confirmed), (to be confirmed), registered with the Dutch Chamber of Commerce (KvK) under number (to be confirmed). We are responsible for your personal data (the “controller” under the GDPR). For anything about your data, email (to be confirmed). We have not appointed a data protection officer; this address reaches the person responsible for privacy.
What we keep and why
Your account
Your email address and name, and the one-time sign-in links we send you.
- Why
- To give you an account and sign you in.
- Legal basis
- Needed to give you the service you asked for (contract, GDPR art. 6(1)(b)).
- How long
- Until you delete your account. After that your profile is anonymised: no name, no email address.
Your question and intake
Your question, the topics you picked, the countries involved and what your business does.
- Why
- To prepare your intro call and your answer.
- Legal basis
- Needed to give you the service you asked for (contract, GDPR art. 6(1)(b)).
- How long
- Until you delete your account; then the text is erased.
A spoken question
The audio when you record your question on the Ask page.
- Why
- To turn your voice into text that you check before sending it.
- Legal basis
- Needed to give you the service you asked for (contract, GDPR art. 6(1)(b)).
- How long
- We don't store it. It goes to OpenAI to be turned into text, the text goes to Anthropic to be tidied up, and we then discard the audio.
Spoken-question limit
A salted one-way code made from your IP address. It cannot be turned back into your address and is not linked to your account.
- Why
- To allow at most three spoken questions per hour from one connection, so the service is not abused.
- Legal basis
- Our legitimate interest in keeping the service secure and free of abuse (GDPR art. 6(1)(f)).
- How long
- It counts for one hour. An expired count is removed the next time the same code is used, so it can stay in our database for longer, but it cannot be turned back into your IP address.
Documents
The files you upload, such as annual accounts or a residency certificate.
- Why
- So your advisor can prepare the call and answer your question. They are also given to Anthropic for the call preparation (see "AI in our service").
- Legal basis
- Needed to give you the service you asked for (contract, GDPR art. 6(1)(b)).
- How long
- Until you delete your account; then the files and their records are deleted.
Your booking
The time of your intro call and the name and email address you book with.
- Why
- To schedule the call and send you a confirmation.
- Legal basis
- Needed to give you the service you asked for (contract, GDPR art. 6(1)(b)).
- How long
- Until you delete your account; we then delete the booking from our calendar by hand.
The live call
The sound and picture of the call while it happens, and the name shown in the call.
- Why
- To hold the video call.
- Legal basis
- Needed to give you the service you asked for (contract, GDPR art. 6(1)(b)).
- How long
- Our video provider, Daily, does not record our calls. Daily keeps technical call logs (such as the name shown and join and leave times) under its own policy.
Call recordings and transcripts
The sound of the call (both voices, no video), recorded by your browser and by your advisor's browser, and the transcript made from it.
- Why
- So your advisor can write your answer from what was said, and check it or make the transcript again if needed.
- Legal basis
- Your consent (GDPR art. 6(1)(a)). You can withdraw it at any time.
- How long
- Until you delete your account or withdraw your consent, whichever comes first.
Call preparation and your answer
The preparation for your call, your written answer, the to-dos, the watch-outs, the diagram and earlier versions of it.
- Why
- To deliver your answer.
- Legal basis
- Needed to give you the service you asked for (contract, GDPR art. 6(1)(b)).
- How long
- Until you delete your account; then the content is erased.
Notes by your advisor
Short internal notes your advisor keeps about your case. Only our advisors can see them.
- Why
- To keep track of your case.
- Legal basis
- Needed to give you the service you asked for (contract, GDPR art. 6(1)(b)).
- How long
- Until you delete your account; then they are deleted.
Orders and payments
What you bought, the prices and dates, and Stripe's payment and customer references. We never see your card details.
- Why
- To take payment and keep our accounts.
- Legal basis
- Legal obligation: Dutch tax law requires us to keep financial records (GDPR art. 6(1)(c)).
- How long
- Seven years, as Dutch tax law requires, also after you delete your account. After deletion our copy no longer shows your name or email address.
How you found us
The code of the QR code or partner link you came through, and the time you asked your first question with it. A visit to the link on its own is only counted by code and time, without anything about you.
- Why
- To pay the partner who introduced you a commission on your first payment.
- Legal basis
- Our legitimate interest in rewarding the partner who introduced you (GDPR art. 6(1)(f)).
- How long
- As long as your account exists. After you delete your account the profile is anonymised, so the code is no longer linked to you.
Emails
Your email address, name and the content of the emails we send you: sign-in links, booking confirmations, the message that your answer is ready, and payment confirmations.
- Why
- To keep you informed about your question.
- Legal basis
- Needed to give you the service you asked for (contract, GDPR art. 6(1)(b)).
- How long
- Our email provider, Resend, keeps delivery logs for a limited time under its own policy.
Server logs
Your IP address, the pages you request and the time.
- Why
- To keep the service secure and to fix faults.
- Legal basis
- Our legitimate interest in keeping the service secure and free of abuse (GDPR art. 6(1)(f)).
- How long
- Up to 14 days.
Call recordings
Before an intro call starts, we ask your permission to record it. Only if you agree:
- Your browser and your advisor's browser each record the sound of the call (both voices, no video). Your advisor may wait in the call room before you agree; nothing is recorded until you do.
- When the call ends, each browser uploads its recording straight to our private storage in the EU (Supabase, Ireland). If an upload fails, the recording stays only in that browser tab until it is sent again or the tab is closed. Nothing is saved on your device unless you choose to download it.
- We send a recording to OpenAI's Whisper to make a transcript. Your advisor writes your answer from it, with help from AI (see below).
- We keep both recordings and the transcript with your account, so your advisor can check what was said or make the transcript again. Only our advisors can open them. You can ask us for a copy.
- They are deleted when you delete your account. To have them deleted earlier, withdraw your consent by emailing (to be confirmed): we then delete the recordings and the transcript. The answer we already wrote for you stays available to you.
AI in our service
We use AI to work faster, not to replace your advisor. Anthropic's Claude prepares your advisor for the call (from your question, intake answers and documents), drafts the written answer and the diagram from the call transcript, suggests follow-up work, and tidies up a spoken question. OpenAI's Whisper turns speech into text. Nothing an AI writes reaches you until your advisor has checked, edited and published it. We do not make decisions about you by automated means alone. Our AI providers may not use your data to train their models.
Who processes your data for us
These companies process personal data on our behalf, under a processing agreement with each of them. Some are US companies or work in the US. For those we rely on the EU–US Data Privacy Framework (for companies certified under it) and/or the EU Standard Contractual Clauses.
Supabase
Our database, sign-in and file storage, including documents and call recordings.
- Where
- EU: Ireland (AWS eu-west-1). Supabase, Inc. is a US company.
- Safeguard
- Your data is stored in the EU. Access from outside the EU, for example for support, is covered by the EU Standard Contractual Clauses.
Hetzner
The server that runs this website and our booking calendar.
- Where
- EU: Germany.
- Safeguard
- Your data stays in the EU.
Daily
The live video call. Daily does not record our calls.
- Where
- USA (Daily.co, Inc.). Call audio and video run through Daily's servers closest to the participants.
- Safeguard
- EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses, under our processing agreement.
OpenAI
Turns speech into text (Whisper): spoken questions, call recordings and your advisor's voice notes.
- Where
- USA.
- Safeguard
- EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses, under our processing agreement. Under its API terms OpenAI does not use this data to train its models and normally deletes it within 30 days.
Anthropic
Drafts material for your advisor (Claude): the call preparation, the draft answer and diagram, suggested follow-up work, and a tidy version of a spoken question.
- Where
- USA.
- Safeguard
- EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses, under our processing agreement. Under its API terms Anthropic does not use this data to train its models and normally deletes it within 30 days.
Resend
Sends our emails, including the booking emails of our calendar.
- Where
- EU: sent from Resend's Ireland region. Resend, Inc. is a US company.
- Safeguard
- Emails are sent from the EU. Access from outside the EU is covered by the EU Standard Contractual Clauses.
Stripe
Takes payments and sends payment receipts. For part of the payment data (fraud prevention and its own legal duties) Stripe is itself responsible; see Stripe's privacy policy.
- Where
- Ireland (Stripe Payments Europe) and USA (Stripe, Inc.).
- Safeguard
- EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses, under our processing agreement.
Our booking calendar is Cal.com software that we run ourselves on our own server (Hetzner, above); the company Cal.com does not receive your data. The people who build and maintain Loophole for us work under a confidentiality and processing agreement.
Cookies and browser storage
We use no analytics, advertising or tracking cookies, which is why you see no cookie banner. We only store what the site needs to work:
- sb-…-auth-token (Cookie) — Keeps you signed in. It can be split into parts ending in .0, .1 and so on. Until you sign out; your browser deletes it after 400 days at most.
- sb-…-auth-token-code-verifier (Cookie) — Protects the sign-in link while you sign in. Only used during sign-in.
- pending-intake (Local storage) — Keeps the question you typed while you sign in, so you don't lose it. Removed as soon as it is read; ignored after 30 minutes.
- loophole:magic-link-sent (Local storage) — Remembers the email address and time of your last sign-in link, so we can ask you to wait a minute before sending another. Until you clear your browser's data for this site.
- Booking calendar and video call (Set by an embedded service) — Our booking calendar (Cal.com, on our own server) and the video call (Daily) may store technical items they need to work. As long as those services need them.
How we protect it
Everything travels encrypted (HTTPS). Documents and recordings are kept in private storage and can only be opened by authorised people, through links that expire after ten minutes. The database itself enforces who may see what: a client only ever sees their own data. We back up our database and files every night. Backups are kept for at most five weeks, so data you have deleted disappears from them within five weeks.
Your rights
You can ask us to:
- show you the personal data we have about you and give you a copy, also in a format you can take elsewhere;
- correct it;
- delete it. You can delete your account yourself on your account page; we keep only what the law requires (see “Orders and payments”);
- limit how we use it, or object to a use based on our legitimate interest;
- stop using your call recordings, by withdrawing your consent. This does not undo what we did with your consent before.
Email (to be confirmed). We reply within one month and may ask you to confirm the request from the email address on your account. If you are not happy with how we handle your data, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the data protection authority in the EU country where you live.
Changes
When we change this policy we publish the new version here with its date. If a change affects what we do with data we already hold, we tell you by email first. Our terms of service set out the rest of our agreement with you.