Legal · Privacy
Privacy Notice
Last updated: 20 July 2026
Who we are
Eitoo is operated by Itay Kahan, a natural person. There is no registered legal entity. Contact: privacy@eitoo.eu.
A sole operator is still a controller under the GDPR: the obligations in Articles 5, 6, 32 and 33 — lawful basis, security of processing, and breach notification within 72 hours — apply in full and identically, and are enforceable against a natural person by the supervisory authority. A data processing agreement is available on request and is signed in that capacity.
Eitoo is software that analyzes your company's purchase invoices and identifies foreign VAT that may be recoverable under the EU cross-border VAT refund rules (Council Directive 2008/9/EC, the 8th Directive).
What Eitoo does, and does not do
Eitoo provides analysis only. Eitoo does not file your VAT reclaim with any tax authority. Filing remains your responsibility, done by you or through your own advisor. Eitoo does not handle your money at any point; no funds are received, held, or transferred by Eitoo on your behalf. Eitoo does not provide tax, legal, or accounting advice. This section describes how we handle the data behind that analysis.
What data we collect and why
| Data | Purpose | Lawful basis |
|---|---|---|
| Email address | Account authentication (magic link) | Art. 6(1)(b), contract |
| Company name, country, VAT ID | VIES validation & VAT refund eligibility | Art. 6(1)(b), contract |
| NACE code (auto-derived) | Business activity classification for deductibility rules | Art. 6(1)(b), contract |
| Exact Online connection: company identity (name, country, VAT number) | Confirming your business identity for VAT recovery analysis | Art. 6(1)(b), contract |
| Exact Online connection: purchase invoice data (vendor, supplier VAT number and country, invoice date, line amounts, VAT amount), read only | Identifying foreign VAT that may be recoverable under the 8th Directive | Art. 6(1)(b), contract |
| Invoice / receipt content, authenticated /scan (vendor, amounts, dates) | AI-assisted extraction, VAT calculation, compliance audit | Art. 6(1)(b), contract |
| Invoice / receipt content, public /recover demo (vendor, amounts, dates) | AI-assisted extraction and VAT recovery estimate | Art. 6(1)(a), consent (collected at the dropzone before upload) |
| Invoice / receipt content, public /analyze tool (vendor, amounts, dates, your selected country, optional VAT ID) | AI-assisted compliance analysis and refund eligibility check | Art. 6(1)(a), consent (collected via checkbox before upload) |
The Exact Online connection is read only. Eitoo cannot create, edit, submit, or delete anything in your Exact Online administration. We only read the purchase invoice and relation data needed to identify recoverable foreign VAT.
We do not process special-category data (Art. 9) and do not make decisions based solely on automated processing that produce legal effects on you (Art. 22).
Who processes your data
| Sub-processor | Role | Data location |
|---|---|---|
| Supabase Inc. | Authentication, database hosting | EU (Frankfurt), see Supabase DPA |
| Anthropic PBC | AI-assisted extraction of invoice data for VAT recovery analysis. Vendor name, country, invoice date, VAT amount, total amount, refundable amount, and expense category are sent to Anthropic's Claude API. | United States (Anthropic's default region) |
| Google LLC (Document AI) | OCR / document extraction | EU / US, see Google DPA |
| Render Services Inc. | Backend API hosting | EU (Frankfurt) |
| Vercel Inc. | Frontend hosting | EU (Frankfurt), edge network |
| Functional Software (Sentry) | Error tracking & telemetry | US |
| Upstash Inc. | Rate limiting (Redis) | EU region |
Where data is transferred outside the EU/EEA, transfers are covered by Standard Contractual Clauses (SCCs) or an EU adequacy decision. A Data Processing Agreement (DPA) covering all sub-processors is available on request; email privacy@eitoo.eu.
For the public /recover demo and /analyze tool: Eitoo's Vercel proxy processes your upload in memory and does not persist the invoice. The invoice content is forwarded to the processing backend (Google Document AI for OCR, Anthropic Claude for classification) and may be retained by Anthropic for up to 30 days under their standard API tier (see sub-processors above). Eitoo retains nothing beyond the request lifecycle.
Anthropic data retention. Eitoo currently uses Anthropic's standard API tier and does not have a Zero Data Retention agreement in place. Under Anthropic's standard policy, API inputs and outputs may be retained by Anthropic for up to 30 days for trust & safety and abuse-monitoring purposes. This means the invoice fields listed in the Anthropic row above may be retained by Anthropic for up to 30 days, after which they are deleted by Anthropic per their policy. We do not control this retention window.
How long we keep your data
We retain your account data, connected Exact Online data, and processed invoice results for as long as your account is active. If you delete your account, we erase your personal data within 30 days, except where retention is required by law (for example, tax or accounting obligations).
If you disconnect your Exact Online connection without closing your account, we stop reading new data immediately and revoke the OAuth token with Exact. Previously synced invoice and analysis data is retained under the same 30 day schedule unless you request earlier deletion.
Raw invoice images sent for AI extraction are not persistently stored beyond the processing session.
Your rights
Under the GDPR you have the right to:
- Access your personal data (Art. 15)
- Rectify inaccurate data (Art. 16)
- Erase your data (the "right to be forgotten", Art. 17)
- Restrict processing (Art. 18)
- Data portability, receive your data in a structured, machine-readable format (Art. 20)
- Object to processing (Art. 21)
To exercise any right, or to request our DPA, email privacy@eitoo.eu. We will respond within 30 days.
You also have the right to lodge a complaint with your local supervisory authority, or with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), or with any EDPB member authority.
The public /recover demo & /analyze tool
Withdrawing consent. If you provided consent at the public /recover demo or /analyze tool, you may withdraw at any time by emailing privacy@eitoo.eu. Because the demo does not retain a persistent identifier linked to your upload, withdrawal after processing is largely informational. We will confirm in writing that no data linked to you remains.
Voluntariness. Providing an invoice at /recover or /analyze is entirely voluntary. The only consequence of not providing one is that no estimate can be generated.
How the estimate is computed. The estimate is generated by sending the invoice image to a large language model (Anthropic Claude), which extracts the vendor, invoice date, line items, VAT amount, and total. Those fields are then run through compliance checks derived from EU Council Directive 2008/9/EC to determine whether the VAT is likely refundable. The output is an estimate, not a guaranteed refund amount, and no refund is filed on your behalf.
Cookies & tracking
We use only strictly necessary cookies for authentication session management. We do not use advertising or analytics cookies. Sentry collects anonymous error telemetry to improve service reliability.
Disclaimer
Eitoo is an analysis tool, not a tax filing service. Estimates may be inaccurate or incomplete. Nothing on this site constitutes tax, legal, or financial advice. Consult a qualified professional before acting on any output. See our Terms of Use for full disclaimers.
Changes to this notice
We may update this notice to reflect changes in our processing. We will notify you by email of any material changes before they take effect.