Privacy Policy

Last updated: 2 November 2026

This Privacy Policy explains what personal information Crypto Tax ("Crypto Tax", "we", "us") collects when you use the website cryptotax.co.il and the capital gains reporting service offered on it (the "Service"), why, who receives it, how long it is kept, and the rights you have. It is written to meet the Israeli Protection of Privacy Law, 5741-1981, and its regulations. For any question, or to exercise a right, write to [email protected].

Who is responsible for your information

Crypto Tax is the controller (the owner of the database, in the language of Israeli law) of the personal information described here. You can reach us at [email protected].
When an accountant or tax advisor uses the Service for a client, the information they enter and upload about that client is processed on their behalf and on their instructions. The accountant is responsible for having the client's consent and for the accuracy of what they enter (see "Clients of accountants" below).

Do you have to give us your information?

No law requires you to give us any information. The Service cannot work without some of it, though: without an email address we cannot open an account or send a sign-in code, without your name we cannot print it on your report, without your ID number (or company number) we cannot fill in Form 1399 and so cannot generate a report, and without your transaction history we cannot calculate anything.
Fields marked optional, such as a phone number, can be left empty. The only consequence is that the feature which uses them (for example, pre-filling the checkout) is not available. A tax advisor or accountant account must give a phone number, because the account is verified by a WhatsApp message to it before it is approved.

The information we collect

Account details: your email address, a password (stored so that no one can read it), your full name in Hebrew and in English, the account type (private individual or company), whether you are a filer or an accountant, your preferred language, and a phone number (optional, and required for a tax advisor or accountant account). If you sign in with Google, we also receive your Google account's identifier and email address, and nothing else from your Google account.
Tax settings: your default tax year, your personal tax rate, and opening capital losses you enter, used to calculate your reports. Your Israeli ID number (or, for a company, its company number), and your tax file number if it differs, printed in the seller's details on Form 1399. A tax advisor or accountant also gives the representative number, name and license number printed on their clients' forms.
Transaction data: the exchange export files you upload, the transactions read from them, and notes you add. For a deposit or withdrawal of coins that is not a move between your own imported accounts, what you tell us it was: where the coins came from (and, for coins bought elsewhere, each purchase's amount, date and cost), or where they went. If you connect an exchange API key, the key (stored encrypted), the transaction history and current balances the exchange returns for it, and the raw responses, kept as the record the import was made from. We accept read-only keys only, and refuse a key that can withdraw funds.
Reports: the capital gains reports and Form 1399 appendices you generate, and the figures in them.
Payments: the amount, VAT, date, the number of tax year reports bought, how it was paid (card, Bit or another method), the tax invoice/receipt number, and the name, email and phone number the invoice/receipt is issued to. Card details are entered only on the payment form provided by Morning (Green Invoice); they never reach us. If you choose to save a card for future purchases, we keep only Morning's token for it, the card brand, its last 4 digits and its expiry date.
Security and activity records: a log of the significant actions on your account (sign-ins, uploads, reports, payments, settings changes, with the previous and the new value of each changed setting), and for sign-ins and sessions the IP address and the browser and device description (user agent). Sign-in codes and reset links expire within minutes or hours.
Accountants' client data: for each client, the name in Hebrew and English, account type, tax rate and the files, keys and reports the accountant handles for them, plus any notes and custom fields the accountant keeps in their client list.
Your cookie choice, with the IP address it was made from, so we can show we respected it. See our Cookie Policy.
If you left your email address to be told when the Service launches: that address, the language you used and the IP address.
If you contact us on WhatsApp or by email: what you write to us and your contact details. A message sent to our support email address, the files attached to it and our replies are kept in our systems as the record of the inquiry. A WhatsApp conversation is held by that channel.

What we use it for

To provide the Service: importing your exchange history by file or API key, calculating capital gains and losses (FIFO, CPI indexation, loss offset) and generating your reports.
To run your account: sign-in, the emailed two-factor code, password reset, email verification, and showing you your active sessions and activity log.
To take payment and issue the legal tax document (tax invoice/receipt) for every purchase.
To send you service emails: sign-in codes, verification and reset links, and messages about your account. We do not send marketing email. The one exception is the launch announcement, sent only to addresses left for that purpose.
To answer your support requests.
To keep the Service secure: detecting unauthorized access and abuse, and investigating errors.
To meet our legal obligations, such as bookkeeping and tax record-keeping, and to establish or defend legal claims.
To measure, in aggregate, how the site is used, unless you turned analytics cookies off, and to measure our advertising and show our ads to people who visited the site, unless you turned marketing cookies off.
We do not sell your information, never use your account details, transactions or tax figures for advertising, and do not make decisions about you by automated means that produce legal effects for you. The Service's calculations are automated, but they only produce a report for you to check and file.

Who receives your information

We share information only as needed for the purposes above, with these recipients:
Cloud hosting providers: one hosts the servers and databases in the European Union, and another stores uploaded files and backups in Israel and sends our emails.
A network protection provider, through whose network all traffic to the site passes, to protect it from attacks and abuse. When you fill in the launch announcement form, it also checks in your browser that the form is submitted by a person and not by automated software.
Morning (Green Invoice), which provides the payment form and issues the legal tax invoice/receipt for each payment and for any refund, receives your name, email and phone number, the purchase details and the card details you enter on its form, and emails the document to you. Morning keeps these records as the law requires of it.
The payment processor behind Morning's payment form, which receives the card and transaction details for the payment.
Google, if you choose to sign in with Google (to confirm your identity), and Google Analytics, unless you turned analytics cookies off. Analytics never receives your name, email, transactions or tax figures.
The exchanges whose API keys you connect: our servers call the exchange with your key to read your history. The exchange sees a request from our servers and nothing more about you than it already has.
Coin logo hosts: to show each coin's official logo, your browser loads it from third-party image servers. Like any website, they see your IP address and browser details. No other information is sent to them.
Meta (WhatsApp), if you contact us on WhatsApp, and the phone number of a tax advisor or accountant who signs up, to which the verification message is sent.
A messaging service in which our support team reads and answers inquiries: a message you send to our support email address is passed on there, with your name, your email address and the files you attached. Nothing is sent to you from there automatically: every reply is approved and sent by a person.
An AI service provider, whose assistant helps us prepare replies to support inquiries: the content of your inquiry and of our earlier correspondence with you is passed to it, without your name, email address or phone number attached, though whatever you wrote in the messages themselves is included. Replies we have sent, without the recipient's details attached, also serve it as examples of how we answer. It only proposes a reply. A person reads every proposal and decides what is sent.
Service providers for operations and diagnostics, such as error alerting and AI-assisted maintenance tools. They receive technical information only, with personal details removed or replaced by masked values.
Authorities or others, where the law or a court order requires it, or where needed to protect our rights or someone's safety.
A buyer or successor, if the Service's business is transferred, on condition that it keeps this policy's commitments.
We never submit anything to the Israel Tax Authority on your behalf. The reports we generate are yours to file or share.
The current list of our service providers is available on request at [email protected].

Where your information is stored

Our servers and databases are in the European Union (Germany). Uploaded files and backups are in Israel.
Your information is therefore stored outside Israel, and some of the recipients listed above operate worldwide and may also process information outside Israel. Such transfers are made in accordance with the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001, to providers bound to protect it.

How long we keep it

Account details, files, keys, transactions and reports: for as long as your account exists.
When you delete your account: your profile, keys, transactions and reports are deleted immediately, and your uploaded files and stored exchange responses are permanently removed from file storage shortly afterwards. Copies may remain in backups for up to 35 days, after which the backups are deleted.
When you delete a single file: its transactions are deleted immediately, and the file itself is kept in a closed archive for 90 days, for recovery in case of error, and then deleted. When you remove an API key: the key, its transactions and the exchange responses stored for it are deleted.
Payment records and tax documents: for as long as bookkeeping and tax law require (at least 7 years). When an account is deleted, its payment records are kept without any link to the account, together with the name, email and phone number on the invoice/receipt.
Activity log: kept as the account's audit record. The IP addresses in it are erased after 2 years. After an account is deleted, its log entries remain without any link to the account, and the personal details a settings change recorded (names, phone number) are erased from them.
Sign-in codes, reset links and expired sessions: deleted within a day after they expire or are used.
Inquiries sent to our support email address: the messages, the attached files and our replies are kept for 2 years after the inquiry is closed, and then deleted. They are kept for that period also if you delete your account in the meantime.
Cookie choice records: 2 years. Launch-announcement email addresses: 12 months. Technical logs: up to 2 years. Google Analytics measurement data, unless you turned analytics cookies off: 14 months.

How we protect it

Information is encrypted in transit and at rest. Passwords are stored so that no one, including us, can read them. Exchange API keys and authenticator secrets are stored encrypted, and are never shown, logged or included in exports.
Every password sign-in also requires a one-time code sent by email (or an authenticator app), and Google sign-in relies on Google's own verification, plus your authenticator app if you set one up. A tax advisor or accountant account must connect an authenticator app before managing clients, and once it is connected, the app's code replaces the emailed one. Sessions end after a period of inactivity.
Access to our systems is limited to what each person or component needs, and our staff's actions on user accounts, including downloading files and reports, are logged. Diagnostic tools see information with personal details masked. Our security measures follow the Protection of Privacy (Data Security) Regulations, 5777-2017.
No system is completely secure. If a security incident affecting your information occurs, we will act as the law requires, including notifying the Privacy Protection Authority and you where required.

Your rights

Access: you can see your account details, transactions, reports, payments and activity log in the app, and download all of your data from Settings (Data export). You may also ask us, in writing, for the information we hold about you.
Correction: you can edit your details in Settings, or ask us to correct information that is inaccurate, incomplete or out of date.
Deletion: you can delete your account from Settings at any time, or ask us to do it at [email protected]. Information we must keep by law (payment records) is kept as described above.
Cookies: you can change your cookie choice at any time from the site footer.
We answer requests within 30 days, and may ask you to confirm your identity first.
If you believe we have not handled your information properly, you may complain to the Privacy Protection Authority (gov.il/privacy). We would appreciate the chance to fix it first.

Clients of accountants

A client added by an accountant has no account of their own and never signs in. The accountant enters the client's details, including their ID number, and uploads their data, and must have the client's consent to do so, and inform the client of this policy.
A client can ask their accountant, or us at [email protected], to access, correct or delete their information. An accountant cannot delete their own account while they still have clients.

Children

The Service is intended for people aged 18 and over. We do not knowingly collect information about minors, other than what an accountant or parent enters for a client who is a minor, under their own responsibility.

Changes to this policy

We may update this policy. The date at the top shows when it last changed. When a change is significant, you will be asked to read and accept the updated version the next time you sign in, and you cannot keep using the Service without accepting it.

Contact

Questions and requests about your privacy: [email protected].