FirmaCheck dashboard and SPV extension privacy

What the extension does

The extension connects the Firma dashboard at firma-finance-preview.vercel.app to ANAF’s certificate-authenticated SPV service at webserviced.anaf.ro. It runs operations requested from the dashboard: verify access, list messages, retrieve original documents and request a selected official report or copy of an existing declaration. It does not submit tax returns, issue invoices or make payments.

Data handled

ANAF responses can contain taxpayer identifiers (CUI/CNP), certificate metadata, message details and private financial documents. The extension filters inbox results to the selected taxpayer and passes the selected records to the Firma page. Certificate approval and PIN entry belong to Chrome, the operating system and your signature provider. The extension neither receives the PIN nor exports the certificate’s private key.

SPV connection and local storage

The extension temporarily stores authentication progress and verified message IDs in Chrome’s extension-session storage. This supports resuming after certificate approval and limits document access to the verified taxpayer. Temporary access state expires and is cleared on disconnect, tab closure or browser restart. The extension does not store original documents, use Chrome Sync storage, or send records to an analytics service.

The dashboard caches original documents in this browser’s IndexedDB, and connection choices and message summaries in browser storage. If you connect a FirmaCheck account and approve device syncing, profiles, financial results, review decisions, saved PFA statements, SPV originals/previews, read status, reminder preferences and report-request history are uploaded to the operator’s Supabase project and made available to your signed-in devices. Database row policies restrict records to the owning account; originals are in a private storage bucket. Device language, appearance, certificate bindings, PINs, private keys and ANAF sessions are not synced. Supabase hosts this project in Ireland; provider metadata and backup retention are governed by the provider’s arrangements. Cloud records are protected by account access controls and provider encryption, rather than a password known only to you.

You can save a separate VAT number on a business profile to recognize documents addressed to that identifier. This relationship is supplied by you; it does not grant ANAF access or combine tax-account balances. Report-request history prevents duplicate submissions after uncertain responses. Connected accounts reserve report requests in the database before contacting ANAF, so another device cannot submit the same daily request. A cloud connection is required for these requests when device syncing is enabled. Existing report-request safeguards are retained when restoring a backup, including an older one.

Importing ANAF PDFs and ZIPs

You can import original PDFs or ZIP archives downloaded from SPV using any browser. The dashboard reads and interprets these files on your device without sending them to the parsing server or requesting a certificate. Original files, import dates and extracted previews are stored in the existing browser workspace; if you have enabled Account & sync, these saved records follow that opt-in syncing policy. Business CUI and personal CNP records are kept separately. Unknown document layouts and uncertain taxpayer matches require review and do not automatically establish amounts payable.

Optional e-Factura OAuth connection

When enabled by the operator, the separate invoice connection redirects you to ANAF to authorize access using your qualified certificate. The certificate and PIN stay with ANAF, your browser and your signing provider. Firma's server exchanges and refreshes OAuth tokens, encrypts them and retains them in Secure, HttpOnly browser cookies; tokens are decrypted only in server memory. Production invoice access is bound to your verified Firma account. Credential cookies are excluded from device syncing and backups. Downloaded invoice ZIPs and metadata follow your existing workspace storage and optional account-sync choices. The connection retrieves invoices when you request a sync; it does not issue invoices, submit declarations or execute payments. Disconnecting removes this browser's credential cookies and keeps saved originals; it does not claim to revoke the authorization at ANAF.

Local document overviews

Document overviews are produced on your device from recognized document types and validated extracted figures. No AI provider is used, and document text is not sent to an AI service. Unsupported or ambiguous records require review of the original. Extracted amounts describe the dated source report; they are not a guarantee of current tax liability.

Financial file imports and hosting

Separately from the SPV connection, importing accounting files or bank statements sends their contents, or extracted text for large PDFs read in the browser, to FirmaCheck’s Vercel-hosted parsing functions. These requests may contain personal identifiers, account details, transaction descriptions and financial information. Parsing runs in memory and does not log request bodies or retain uploaded contents in the parsing function. Parsed results and retained originals are cached in this browser and, after account syncing is enabled, saved in Supabase. Parsing does not use an AI provider. SRL source PDFs are not retained; keep your originals separately.

Application import diagnostics contain only fixed result codes, file-format categories and processing status, without document contents or taxpayer identifiers. Vercel processes hosting requests; ordinary platform access logs may include connection and request metadata such as IP address, request path and time. Application non-storage does not mean the hosting provider has no retention. Hosting locations and metadata retention depend on the operator’s provider arrangements; this notice does not promise EU-only processing or zero provider retention.

Public ANAF checks

When you check public company status, the business CUI is sent through the hosting server to ANAF’s public registry. Public status and selected calendar preferences are cached separately in this browser. This does not access your private SPV account or establish an unpaid tax balance. Foreign-currency conversion requests send only the currency code and transaction date to the hosting server, which retrieves published BNR exchange rates.

Backup and restore

Settings → Backup & restore creates a password-encrypted file locally on your device. It includes saved business profiles, classifications and review decisions, retained PFA statement files, cached SPV originals and previews, read status, report-request history and selected preferences. Only files still present in browser storage can be included; SRL source PDFs are not retained. The backup and password are not uploaded to FirmaCheck or ANAF. Encryption uses AES-256-GCM with a key derived using PBKDF2-SHA256 and a random salt. The password cannot be recovered by the operator.

Restoring replaces this browser’s saved workspace after you inspect the backup and confirm replacement. An encrypted safety copy of the previous workspace downloads first, using the password entered for restore. Keep that file until you verify the result. Close other FirmaCheck tabs before restoring. Backups do not contain certificate private keys, PINs, ANAF browser sessions or verified connection bindings. SPV certificate connection bindings require fresh approval after restoration. Any e-Factura credential cookies already held by this browser are separate from the backup and can be removed using Disconnect. Deleting browser storage does not delete downloaded backups; manage those files and their retention yourself.

Google sign-in

Google sign-in requests your basic profile information (name and profile picture) and email address to create and identify your FirmaCheck account. This account information is stored in Supabase Authentication and is used for sign-in and access to your private workspace. FirmaCheck does not request access to your Gmail, Google Drive, contacts or calendar, and does not sell your Google account information or use it for advertising.

Device storage

Browser storage is not an encrypted financial vault: use normal device/account protections. Cloud syncing runs while the app is open, with offline edits queued on the device. Competing edits to the same record require a version choice. Signing out through Account & sync clears the local account cache after syncing successfully. Clearing site storage does not erase cloud records or ANAF records. Removed businesses leave deletion markers for sync safety; retained file versions may remain in private storage. Contact the operator for full cloud/account erasure. Independent encrypted backups remain under your control.

Permissions

Access is restricted to Firma’s dashboard and the ANAF SPV host. The scripting permission activates the dashboard connection in an already-open Firma tab after installation; the extension does not inject code into unrelated websites. Storage permission saves temporary connection state. No native application, broad browsing-history permission, advertising, tracking SDK or remotely loaded extension code is used.

Your choices

Connecting ANAF and connecting a cloud account are separate actions. You can stop an ANAF sync, disconnect a business or uninstall the extension. Disconnecting ANAF preserves downloaded originals and does not revoke your certificate. Account & sync signs out and clears the local account cache after syncing; your private cloud copy remains available on your other devices. Report requests are explicit actions and are never automatically replayed after uncertain responses.

Publisher and privacy contact: Akos Kis-Kallo · kiskalloakos1@gmail.com. Contact the publisher for privacy and support requests.