Yelnitax · Country context: Poland
Privacy notice
Version:
Operator and contact
İsmail AkarKolna 4A, 30-381 Kraków, Poland
info@yelnitax.com
+48 780 519 716
Who is responsible?
İsmail Akar, at the contact address below in Poland, is controller for invitations, accounts, support and service security. For a business customer's document processing, the customer normally determines the purpose and Yelnitax acts on its instructions as processor. The roles depend on the actual processing, not on the selected website language.
Information and its source
An administrator supplies your invitation email. You provide account and support information; authentication supplies identifiers, verification status and session details. Access requests generate IP, browser and security-event data. Optional Google login supplies the account identifier and verified email. Documents may contain names, addresses, tax numbers, IBANs, amounts and line items. If a business supplied your data, contact that business about its document use; we assist within our role.
Purposes and legal grounds
Under GDPR Article 6, account access and requested support rely on contract steps or performance where applicable; security logs rely on legitimate interests in preventing abuse, balanced against your rights. Records required by law rely on legal obligation; necessary dispute records protect legal claims. Optional processing requiring consent starts only after a separate valid choice. A privacy notice is not consent. Without the required account details we cannot provide secure access.
Recipients and connected services
AWS supports authentication, invitation delivery, application hosting, document storage and backups; the production database is in Frankfurt. Cloudflare serves and protects the public site. Google receives information when you choose its login service. Anthropic may receive document content for requested AI extraction. A connected Telegram channel and email forwarding/inbox providers process the communications you send through them. Lawful authority requests may require disclosure. This list does not mean every optional channel is enabled.
Processing outside your country
The operator is in Poland. Frankfurt database hosting is not a promise that every provider processes only in Germany or the EEA. EEA transfers to third countries require an applicable GDPR Chapter V mechanism and any necessary supplementary measures. Before real business documents are used, the actual recipients, locations, processing terms and safeguards must be settled. Contact us for information or an available copy of the relevant safeguard. Uploading a file alone is not transfer consent. These requirements also apply now to account, invitation, security and support data, even when uploaded documents are synthetic. The provider-by-provider verification of actual transfer mechanisms is not yet complete; this notice does not certify that verification.
Retention and deletion
Account data is kept while needed to provide access and handle closure; security and support records while needed to investigate incidents or resolve the request. Legally required records or necessary claims evidence may be retained separately. The recorded production database backup cycle is 30 days; this does not describe all document copies, logs or provider retention. Deletion requests cover those systems separately. We explain any lawful exception rather than promise instant deletion everywhere.
Your GDPR rights
Where applicable, you may request access, correction, erasure, restriction and portability, object to legitimate-interest processing, and withdraw consent without affecting earlier lawful processing. Send requests to info@yelnitax.com or the address below. We may proportionately verify identity; never send login secrets. GDPR requests are answered within one month, extendable by two months for complexity or volume with reasons given within the first month. You can complain to a supervisory authority, including where you live, work or where the alleged breach occurred. Contacting us first is not required for a GDPR complaint.
Automated analysis and security
Document analysis prepares information for review; it does not itself issue a legally binding tax, payment or accounting decision about you. Access controls, authentication and protected storage reduce risk but cannot eliminate it. Report suspected misuse to the contact below. Do not send real sensitive documents merely to demonstrate a problem.
Provider agreements
The standard DPA provisions for AWS, Cloudflare and the Anthropic API were verified as incorporated into the relevant service terms. This does not confirm every account’s coverage or approve all transfers. Checks of contracting parties, locations and additional safeguards remain open.
Support email
Messages to info@yelnitax.com reach our dedicated mailbox hosted by Hostinger. Automatic forwarding to personal Gmail was disabled on 8 November 2026; earlier messages were not deleted by this change. Hostinger states that mailboxes and backups are in France or Germany; this does not mean all support access is EU-only. Do not email unnecessary invoices, identity copies or sign-in secrets. You may submit rights requests with the minimum necessary information; if documents are needed, we will agree a suitable delivery method.
AI document reading
No account-specific EU-only processing or zero-retention agreement has been verified for the Anthropic API. Its general location notice permits US storage and processing across several regions. Standard API input/output retention is up to 30 days; file services, special agreements, safety and legal obligations may differ. This is not a promise that every copy is deleted within 30 days.
Local rights and rules
GDPR applies together with relevant Polish law. You may complain to Prezes Urzędu Ochrony Danych Osobowych (UODO). The Polish contact address does not remove your right to use another competent EEA supervisory authority or the courts.