Privacy Notice

This notice explains what CG1 Assist does with your information. It is written to be read, not to be survived. Where a decision is still outstanding, it says so instead of guessing.

Who is responsible for your data

Shane O'Brien is the data controller for the information described here.

What we collect

• Your account: name, email address, and a hashed password. If you turn on two-factor authentication, the secret and recovery codes for it.
• Your tax records: the transaction history files you upload from brokers, exchanges and wallets, and everything we derive from them: the transaction lines drafted from your files, your edits and confirmations, and calculation results.
• The name you file under, as it appears on your tax records.
• An audit trail of significant actions on your case, which is append-only and hash-chained so that neither you nor we can quietly rewrite history.
• Payment records: which tax year you bought and what you paid.
• A waiting list address, if you asked to be told when the service opens. That is your email address and the channel that brought you, and nothing else — see below.

If you joined the waiting list

Before the service opened we offered a form to be told when it did. If you used it we hold your email address, the date you gave it, and the same channel name we record for everyone (such as "google"). We do not hold a name, an IP address, or anything else about you.

We use it for one message: that the service is open. It is not a newsletter, it is never sold or shared, and it is not used to advertise to you. Ask at [email protected] and we will delete it — you do not have to give a reason, and you do not need an account to ask.

What we deliberately never collect

• Your Revenue login. We never ask for it and never sign in as you.
• Wallet files, private keys or seed phrases. We only want exported transaction history. If you try to send a wallet file, we do not want it — only you should ever hold it.
• Card details. Payments are handled by Paddle, our payment processor; card numbers never reach us.

Where AI is used, and what it sees

CG1 Assist uses a large language model for one job: reading what you upload and drafting a list of your transactions, because every broker and exchange exports a different format. To do that, the document you upload is sent to our AI provider (currently Anthropic). If you upload a photograph or a PDF, the whole file is sent, including anything else visible on it.

The model never decides what you owe. It drafts the transaction lines; you review and edit every one of them, and confirming them is the point you take them on as yours. The tax itself is then worked out by ordinary deterministic code against reviewed, versioned rules, from the lines you confirmed. No figure on your return is calculated by a model.

The companies that process data on our behalf are Anthropic (reading your files) and Paddle (our merchant of record, taking payment and handling VAT). We do not sell your data or share it with anyone else.

How your records are stored

Uploaded files are held on private storage. There is no public link to any file you upload; downloads use short-lived signed links that expire. Files are scanned for malware on upload. Your uploaded files are kept exactly as you sent them and are never rewritten, and each calculation is stored as it stood, so the evidence behind every figure survives.

How long we keep it

We keep your records while your access to that tax year is live, and for a short grace period after the return deadline, because you need your own records after filing rather than only up to it.

You can delete your account at any time from your settings. Doing so deletes your account, your cases, your uploaded files and the records derived from them, including the files held on private storage.

A waiting list address is kept only until the launch announcement has been sent, and is deleted within three months of that. Joining the list and then creating an account are two separate things: deleting your account does not by itself remove a waiting list entry, so ask us at [email protected] if you want both gone.

Your rights

Under the GDPR you can ask for a copy of your data, have inaccurate data corrected, have your data erased, object to or restrict how we use it, and receive it in a portable form. Write to [email protected] and we will respond within one month.

If you are unhappy with how we have handled your information, you can complain to the Irish Data Protection Commission at dataprotection.ie.

How we measure the product

We keep a record of the steps you reach — registering, uploading records, locking a ledger, calculating — so we can see where people get stuck. We also record which website first sent you, as a name such as "google" or "chatgpt", so we know which guides are worth writing. We never record your IP address, we use no third-party analytics service, and none of this leaves our servers.

You can ask us to delete it along with the rest of your data.

Cookies

We set only the cookies needed to keep you signed in and to protect forms against cross-site request forgery. We run no analytics or advertising cookies at all. See the cookie policy.

Contact

[email protected]