Privacy Policy

The services are provided by Q T X ACCOUNTING L.L.C S.O.C, a limited liability company registered in Dubai under commercial licence No. 1603171, Office R20-216, Danube Building, Al Safa 2, Dubai, United Arab Emirates. The same company provides the services to clients in the Kingdom of Saudi Arabia.

For any question about your personal data, write to client@quicktax.ac with “Privacy” in the subject. Our management team handles these requests.

What this policy covers

• the website quicktax.ac, including the lead forms, the newsletter and the free bank statement converter;
• the client app app.quicktax.ac;
• our accounting, bookkeeping, VAT and Corporate Tax services (in Saudi Arabia: VAT and Zakat), including the filings we prepare for you;
• our conversations with you on WhatsApp, by e-mail, by phone and in video meetings;
• the AI-agent connection at mcp.quicktax.ac, which lets your own AI assistant, such as Claude or ChatGPT, work with your QuickTax account (section 5).

Our role

We decide how and why we use the data of our clients, their representatives and website visitors, and we are responsible for it.

Your documents also contain personal data of other people: your customers, suppliers, employees and shareholders. We use that data on your instructions to deliver the services you ordered, and we keep it as part of the accounting records that tax law requires to be kept. You are responsible for having the right to share it with us.

We do not sell personal data.

We use AI models from Google (Gemini), OpenAI, Anthropic (Claude) and TypeSafe to:

• read and classify uploaded invoices, receipts, bank statements and company documents;
• match counterparties and suggest how a transaction should be booked;
• transcribe voice messages and calls, and summarise chats, calls and meetings;
• help our team draft replies and find answers in our knowledge base;
• run the onboarding assistant that collects company details on WhatsApp.

Accountants review the results before they go into your books or a tax filing. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.

We use these providers through their paid business APIs. Under those terms the providers do not use the data we send them to train their models.

You can connect your own AI assistant, for example Claude or ChatGPT, to your QuickTax account through our server at mcp.quicktax.ac. The agent can then read your company data, upload documents, draft and issue sales invoices, and request changes to your bank accounts, on your instruction.

How you connect

• Sign-in from your AI app. Your AI app sends you to our sign-in page. You enter the e-mail of your client app account, then the six-digit code we e-mail you. The code is valid for 10 minutes. You type it on our page, never in the chat. Then you see which app is asking for access and what it will be able to do, and you allow or refuse it.
• Personal link. In the client app you can also create a personal connection link and paste it into an AI app that supports custom connectors. The link is shown to you once; we store only a hash of it. Each user has one active link, and replacing it disables the old one.

What the agent can see

• Only the companies linked to your user in the client app. The list is checked again on every call.
• A fixed set of fields per tool. The agent does not receive our accountants’ internal notes, internal review statuses or internal AI assessments.
• From our knowledge base, only public tax documents and client guides.

What the agent can change

• Documents it uploads go into the same processing pipeline as uploads in the client app.
• Invoices are created as drafts. Issuing, cancelling or marking an invoice as paid happens only on your instruction. QuickTax does not send invoices to your customers and does not move money.
• A new bank account, or any change to where your customers pay you, takes effect only after you press “Confirm” on a page we link to in an e-mail to your account address. The link is valid for 15 minutes. The agent never asks you for that link or for any code.

Sign-in tokens

After you allow access, your AI app receives an access token that is valid for 15 minutes and a refresh token that renews it. The connection ends after 30 days without use, and in any case 90 days after you allowed it; then you sign in again. You can give an app read access only, or read and write access. Each user can have up to 10 active connections; an eleventh replaces the one used least recently.

What we store

• For each connection: your user, the app name, the permissions you granted, when it was created and last used, and hashes of its tokens. We never store tokens or links in readable form.
• Sign-in requests and codes, stored as hashes. They are deleted automatically within a day after they expire.
• Hashes of the e-mail address and IP address of each sign-in code we send, used only to limit how many codes can be sent. They are deleted after one day.
• One log entry per tool call: tool name, type, company, whether the call was allowed, and the time. We do not log the agent’s questions, the arguments it sends or the answers we return.
• The documents, invoices and bank account changes themselves, as with any other use of the client app.

Your AI provider

What QuickTax returns to your agent is then processed by your AI provider (for example Anthropic or OpenAI) under your own agreement with that provider. QuickTax does not control how that provider stores or uses it. Check your provider’s privacy settings before connecting.

Disconnecting and deleting

• On the home page of the client app, the block “Connect your AI agent to QuickTax via MCP” lists your “Connected AI apps”. “Disconnect” ends one connection and “Disconnect all” ends all of them; “Revoke” disables your personal link. It takes effect from the agent’s next call.
• You can also remove the QuickTax connector in your AI app, or write to client@quicktax.ac and we will disconnect it for you.
• Disconnecting stops access. It does not delete the documents and invoices your agent added: they are part of your accounting records (section 8). To have your connection records and call log deleted, write to us (section 11).

We share personal data with the service providers below. They process it for us under contract and only as far as each needs for its task.

We also disclose data:

• to the Federal Tax Authority (UAE) or ZATCA (Saudi Arabia) when we file returns or registrations on your behalf;
• to banks, auditors or other advisers when you ask us to;
• to a referral partner who introduced you to us, limited to the fact that you became our client and the fees on which the partner’s commission is calculated;
• when the law, a court or a government authority requires it.

Our main database and document storage are in the European Union, and the AI-agent server is in Belgium. Some providers in section 6, including the AI providers, process data in other countries, among them the United States.

We transfer personal data outside the UAE and Saudi Arabia only to the providers listed in this policy, under contracts that require them to protect it, and on the grounds the UAE and Saudi data protection laws allow for such transfers.

• Data travels over encrypted connections (HTTPS).
• In the client app and through the AI-agent connection, a client sees only their own companies.
• Our team works with client data through internal tools that require a personal login. Access ends when a team member leaves.
• AI-agent links and tokens are stored only as hashes. Our AI-agent server does not log request contents.
• A change to where your customers pay you needs your confirmation through a link sent to your e-mail.

No system is completely secure. If a breach affects your personal data, we will tell you and the competent authority without undue delay, as the law requires.

The website uses Google Tag Manager, Google Analytics and Google Ads, the Meta Pixel, Yandex Metrica (with click maps) and Rick.ai. They set cookies and collect information about your visit. When you submit a form, we send a hashed (SHA-256) version of your e-mail and phone number to Meta to measure our advertising.

The AI-agent sign-in pages at mcp.quicktax.ac do not use these analytics tools. You can block or delete cookies in your browser settings; the website keeps working without them.

Depending on the law that applies to you, you have the right to:

• know what data we hold about you and get a copy;
• correct inaccurate or incomplete data;
• ask us to delete your data, except what the law requires us to keep;
• restrict or object to processing, including marketing;
• receive your data in a structured, machine-readable format;
• withdraw your consent at any time, where we rely on consent;
• not be subject to a decision based solely on automated processing;
• complain to the regulator: in the UAE, the UAE Data Office; in Saudi Arabia, the Saudi Data & AI Authority (SDAIA).

How to ask

Write to client@quicktax.ac with “Privacy” in the subject, or message us on WhatsApp from the number linked to your account. We may ask you to confirm your identity. We reply within 30 days.

What deletion covers

When you close your account or ask us to delete your data, we delete your client app login, your AI-agent connections and call log, your tax portal access and your marketing data. We keep the accounting records, tax filings and the documents behind them for the periods in section 8, because tax law requires them to be kept; after that we delete them. You can ask for a copy of your documents and records before your service ends.

If you are a customer, supplier or employee of one of our clients and your data appears in their documents, we will pass your request to our client and help them answer it.

We process personal data in line with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and, for clients and individuals in Saudi Arabia, the Saudi Personal Data Protection Law (Royal Decree No. M/19 of 1443H, as amended) and its regulations.

Our services are for businesses in the UAE and Saudi Arabia. QuickTax is not established in the European Union, although our database is hosted there.

Our services are for businesses. We do not knowingly collect data from children under 18.

We may update this policy. The date at the top shows the current version. We will tell clients about material changes by e-mail or WhatsApp before they take effect.