Privacy Policy

We collect the following categories of personal data:

Information you provide:

• Account Information (if you sign up): email address. We do not require a name, phone, or address.
• User Content: the questions, prompts, and other text you submit to Ask Cyprus, and the responses generated for you. Note: all Ask Cyprus conversations are published at unique public URLs (for example, taxrebase.com/ask-cyprus/[topic]) and indexed by search engines, alongside the AI's response. Do not include personal data in your questions if you do not want them publicly visible.
• Communications: if you email or message us, we keep the contents of those messages and your contact details.

Information collected automatically:

• Browser session identifier: a random identifier stored locally in your browser, used to associate your anonymous Ask Cyprus conversations with your device. This is not linked to your real identity unless you create an account.
• Log data: IP address, browser type, device type, date and time of requests, pages viewed.
• Usage data: which features you use, how long, and approximate location derived from IP address.
• Cookies and similar technologies: see Section 6.

We use personal data to:

• Provide and operate the Services, including answering your Ask Cyprus questions.
• Maintain account security and prevent fraud, abuse, or other misuse.
• Improve the Services, debug problems, and analyse aggregated usage.
• Respond to enquiries and connect you, on your request, with our licensed operating partners for regulated services.
• Comply with legal obligations.

We do not sell your personal data. We do not use your Ask Cyprus conversations for advertising.

Public publication of conversations. As described in Section 1, all Ask Cyprus conversations are published at unique public URLs and indexed by search engines. Anything you write in those conversations may be seen by anyone who visits the URL or finds it via a search engine.

We also share personal data as described below:

• Service providers: hosting, AI processing (OpenAI), email delivery, analytics, and similar processors acting under contract on our behalf. These parties only process data on our instructions.
• Operating partners: if you ask us to introduce you to a licensed partner (for example, for tax, immigration, or property advice), we share only the information needed to make that introduction and only with your consent.
• Legal and safety: where required by law, regulator, or to protect the rights, safety, or property of users, Tax Rebase, or third parties.
• Business transfers: if Tax Rebase is involved in a merger, acquisition, or asset transfer, personal data may transfer to a successor under this Policy.

Ask Cyprus draws on publicly available community discussions about life in Cyprus, accessed via third-party data archives. We do not train AI models on this content; the underlying AI model is provided by OpenAI. Every answer cites the original source URL so you can verify it and read the full context.

Removal requests. If you are the original author of public content that appears in our citations and would like it removed, email info@taxrebase.com. We honour verified removal requests within 30 days.

We keep personal data only for as long as we need it to provide the Services or to meet legal obligations:

• Account email: until you delete the account, then up to 30 days for removal across systems.
• Ask Cyprus conversations: kept while your account exists, or for up to 12 months from the last interaction for anonymous sessions. You can request earlier deletion.
• Log and security data: typically up to 12 months for security and abuse-prevention purposes.
• Records of legal requests or violations: retained as long as necessary to meet our obligations or defend claims.

We use a small number of cookies and similar technologies to operate the Services and to understand how they are used. Categories include:

• Strictly necessary: required for sign-in, session continuity, and basic site functionality. Cannot be switched off.
• Analytics: Google Analytics 4 and Microsoft Clarity. Help us understand traffic and improve the Services.

Where required, we ask for your consent before setting non-essential cookies. You can change your browser settings to refuse cookies; some features may not work as a result.

You have the following rights under the GDPR:

• Access: a copy of the personal data we hold about you.
• Rectification: correction of inaccurate data.
• Erasure: deletion of your data (the "right to be forgotten").
• Restriction: limit how we process your data in certain cases.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on our legitimate interests, and to direct marketing at any time.
• Withdraw consent: where we process data based on consent, you can withdraw it at any time without affecting prior processing.
• Lodge a complaint: with the Cyprus Office of the Commissioner for Personal Data Protection (dataprotection.gov.cy), or with the supervisory authority in your country of residence.

To exercise these rights, contact us at info@taxrebase.com. We respond within 30 days.

Data controls in the product. You can also exercise some controls directly: delete an individual Ask Cyprus conversation from your account sidebar, sign out at any time, or close your account and request full data deletion by emailing us.

A note on AI-generated content: Ask Cyprus produces answers by predicting plausible responses based on community discussions and public sources. In some cases, those answers may be factually inaccurate, including about real people. If Ask Cyprus has generated factually inaccurate information about you and you would like a correction or removal, contact us at info@taxrebase.com. We will consider your request based on applicable law and the technical capabilities of the system.

The Services are not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided personal data to us, contact us and we will delete it.

We use commercially reasonable technical and organisational measures to protect personal data, including transport encryption (HTTPS), access controls, and vendor due diligence. No system is perfectly secure, so we cannot guarantee absolute protection.

We rely on the following GDPR legal bases:

• Contract (Art. 6(1)(b)): to provide the Services you request.
• Legitimate interests (Art. 6(1)(f)): to secure the Services, prevent abuse, debug, and improve product quality. We balance these interests against your rights.
• Consent (Art. 6(1)(a)): for non-essential cookies and any direct marketing.
• Legal obligation (Art. 6(1)(c)): where required to comply with applicable law.

Some of our service providers, including OpenAI which powers parts of Ask Cyprus, are established outside the European Economic Area, primarily in the United States. When personal data is transferred internationally, we rely on appropriate safeguards under GDPR Article 46, including the European Commission's Standard Contractual Clauses and, where applicable, adequacy decisions. To request information about the safeguards in place, contact us at info@taxrebase.com.

The Services may include links to third-party websites or content from third-party services. Their privacy practices are governed by their own policies, not by this one.

The data controller responsible for your personal data is Tax Rebase, operating from Cyprus. Contact: info@taxrebase.com.

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest version. If we make material changes that adversely affect you, we will provide reasonable advance notice.

For questions about this Privacy Policy or our privacy practices, or to exercise your rights, email us at info@taxrebase.com.