Privacy Policy
OnePercent helps individual entrepreneurs in Georgia work out and file their 1% Small Business Status turnover tax. Doing that means handling bank statement data, which is about as sensitive as personal data gets. This page says exactly what we hold, where it sits, who else sees it, and how to get rid of it.
It is written to be read, not to be survived. If anything here is unclear, ask us.
What we hold
- Your account: email address, chosen language, and the sign-in records Supabase keeps for us.
- Your tax profile: name, personal or taxpayer number, IE registration details, VAT status, and the answers you give in onboarding. These are what the declaration is built from.
- Income data extracted from statements you import: transaction dates, amounts, currencies, descriptions, counterparty names, account identifiers (IBAN, and the last digits of a card where the statement prints them), and running balances.
- Documents you choose to store with us, in a private storage bucket.
- Operational records: reminders sent, rule evaluations, import failures, and application errors.
Statement files are not kept
When you import a bank statement, the file is read in memory, and only the extracted rows are saved. The file itself is never written to disk or storage. We keep a SHA-256 fingerprint of the bytes so that re-uploading the same file is recognised as the same file rather than counted twice — a fingerprint cannot be turned back into the document.
Documents you upload deliberately, in the Documents section, are different: those are stored, because storing them is the point. They live in a private bucket that only your account can read, and you can delete any of them at any time.
When a file goes to an AI service
Most statements are read by parsers written specifically for the bank that produced them. When no parser recognises a file — a bank changed its export, or it is a scanned PDF with no text layer — the text of that file is sent to Google's Gemini API to be read, and the result is checked against the statement's own running balance before it is used.
This means the contents of that statement leave our systems and are processed by Google. It happens only for files we cannot read ourselves, and only for the text of the file. If you would rather this never happened to your data, tell us and we will disable it for your account.
We do not send your name, email address or account identifiers to any AI service, and we do not use your data to train any model of our own.
Where it is stored
Your data is held in a Supabase Postgres database hosted in the European Union (Frankfurt, Germany), and the application runs on Vercel in the same region. Access is enforced at the database level with row-level security, so a query for someone else's rows returns nothing rather than relying on the application to remember to filter.
Who else is involved
- Supabase — database, authentication and file storage (EU).
- Vercel — application hosting (EU).
- Google (Gemini API) — reads statement text only in the fallback case described above.
- Resend — sends the emails you receive from us.
- Telegram — only if you connect it, and only to deliver reminders you asked for.
- National Bank of Georgia — we fetch published exchange rates. No personal data is sent; we are just reading a public rate table.
We do not sell your data and we do not share it for advertising.
How you use the product
We record how OnePercent is used — which screens are opened and which actions are taken — and link that to your account. We use it to see where the product is confusing or slow, and to decide what to build next.
This is our own record, kept in our own database. It is never sold, never shared for advertising, and never sent to an outside analytics company. It holds no statement content: no counterparty names, no amounts, no account numbers. Usage records are deleted after 180 days.
Errors and diagnostics
When something breaks we record what broke so it can be fixed. Before anything is stored, the text is scrubbed of IBANs, email addresses, card and personal numbers, access tokens and URL query strings. These records are readable only by us, never by other users, and are kept for 90 days.
How long we keep it
Tax data is kept while your account is open, because a filing you made two years ago is something you may need to show. Georgian tax law generally expects records to be available for six years, and we keep yours available to you for at least that long unless you ask us to delete them sooner.
Delete your account and we remove your profile, entity, income data, documents and stored files. Diagnostic records that no longer identify you may remain in aggregate form.
Your rights
You can ask for a copy of everything we hold about you, ask us to correct it, or ask us to delete it. Georgian law (the Law on Personal Data Protection) and, where it applies to you, the GDPR give you these rights, and we honour them regardless of which applies.
Write to privacy@onepercent.ge. We will respond within 30 days, and usually much faster.
There is not yet a "delete my account" button in the interface — ask us and we will do it, and confirm when it is done.
Security
Connections are encrypted in transit and data is encrypted at rest by our hosting providers. Access between accounts is separated in the database itself rather than in application code. Statement files are never persisted. Administrative access is limited to what is needed to run the service.
No system is perfect. If we ever discover a breach affecting your data, we will tell you what happened and what it means for you.
Changes
If this policy changes in a way that affects you, we will say so in the application rather than quietly updating the date at the top.
Questions: privacy@onepercent.ge.