Privacy Policy

1. Who we are

TaxEase UK (“we”, “us”, “our”) is a trading name of TAXEASEUK LTD, a company registered in England and Wales (Company Number: 17244428), providing software tools to help individuals prepare their UK Self Assessment tax return. We are not affiliated with HMRC or any UK Government department.

Data controller: TAXEASEUK LTD. For questions about this policy, contact us at hello@taxeaseuk.com.

2. The short version

TaxEase UK is designed with a privacy-first approach. The standalone application (HTML/desktop) stores all your tax calculation data locally on your device. However, as a registered platform user (account holder), certain account and licence data is stored in our secure cloud database. We do not sell your data. We do not serve you advertisements.

3. Data stored locally on your device

When you use TaxEase UK as a standalone tool (free HTML version or desktop application without signing in), the following data is saved in your browser’s localStorage or the desktop app’s local storage only:

• Your tax return figures (income, expenses, deductions, etc.)
• Your language and display preferences
• Your onboarding status and plan selection
• MTD quarterly tracker entries (if used)
• Bank statement merchant category mappings (if you use the OCR feature)

In standalone mode, this data never leaves your device. No tax calculation data is transmitted to our servers.

4. Data we collect on the website

When you visit our website (taxeaseuk.com), standard server logs may record your IP address, browser type, and pages visited. These are used solely for security and performance monitoring and are not used to identify you personally.

4b. Account & platform data (Supabase)

When you create a TaxEase UK account (individual, B2B accountant, or affiliate), the following data is stored in our secure database (Supabase, hosted in the EU — Frankfurt, Germany):

• Individual accounts: email address, licence key, licence status, purchase date
• B2B accountant accounts: firm name, contact name, email, professional body, languages, region, opt-in status for public directory, client list (client names/emails you add)
• Affiliate accounts: name, email, referral code, conversion records, payout history

Legal basis: Contract performance (Article 6(1)(b) UK GDPR) — this data is necessary to provide you with the service you signed up for.

We do not store your tax return figures, income data, or financial calculations in our database. These remain on your local device only.

Supabase (data processor): Supabase Ltd acts as a data processor on our behalf. Your account data is stored in their EU-region infrastructure (Frankfurt, Germany) and is subject to their Data Processing Agreement.

5. Licence key purchases

If you purchase a Premium or B2B licence, the payment is processed by Stripe, Inc. (our payment provider). We receive confirmation of payment and your email address for licence delivery. We do not store your payment card details — these are handled entirely by Stripe under their own privacy policy and PCI-DSS Level 1 compliance.

For B2B accountant partners receiving commissions, payouts are processed via Stripe Connect. Stripe may require additional KYC (Know Your Customer) information directly from you as part of their onboarding process.

6. Cookies

The TaxEase UK standalone application uses localStorage (not cookies) to persist your preferences and tax data locally.

Our website (taxeaseuk.com) uses two categories of cookies:

• Essential session cookies — set by Supabase for authentication. These are strictly necessary for the service to function and do not require your consent.
• Affiliate referral cookie — if you arrive via an affiliate referral link (e.g. taxeaseuk.com/r/CODE), a cookie named affiliate_ref is set for 90 days. This cookie is used solely to attribute your purchase to the referring affiliate for commission purposes. No personal data is stored in this cookie — only the affiliate’s referral code. Your referral code is also stored in your browser’s localStorage as a fallback (e.g. if cookies are blocked). Both the cookie and localStorage entry expire after 90 days.
• Analytics cookies (optional) — we use Google Analytics 4 (GA4) to understand how visitors use TaxEase UK. GA4 sets cookies (_ga, _gid) only after you give explicit consent via the cookie banner shown on your first visit. If you decline, no analytics cookies are set and GA4 is never loaded. You can change your preference at any time by clearing your browser’s localStorage.

We do not use advertising or marketing cookies. Your cookie preference is stored in your browser’s localStorage (not a cookie) and is never sent to our servers.

7. Third-party services

TaxEase UK uses the following third-party services as data processors. Each operates under their own data processing agreement and privacy policy:

• Vercel Inc. — web hosting (EU region: London, UK). Processes request logs.
• Supabase Ltd. — database (EU region: Frankfurt, Germany). Stores account data.
• Stripe, Inc. — payment processing. Stores payment and identity data.
• Cloudflare, Inc. — DNS and CDN. Processes network requests.
• Zoho Corporation — transactional email (hello@taxeaseuk.com). Processes email addresses for delivery.
• Cloudflare R2 — encrypted database backups. Stores anonymised backup snapshots.

We have Data Processing Agreements in place with each of the above where required under UK GDPR.

8. HMRC API integration & OAuth

TaxEase UK integrates with HM Revenue & Customs (HMRC) APIs under the HMRC Making Tax Digital (MTD) programme. When you choose to connect your HMRC account to TaxEase UK, the following applies:

• You will be redirected to HMRC’s official login page (Government Gateway) to grant TaxEase UK authorisation via OAuth 2.0. TaxEase UK never sees or stores your HMRC username or password.
• HMRC will issue TaxEase UK a time-limited access token. This token is used only to submit your Self Assessment data to HMRC on your behalf, or to retrieve status information about your submission.
• The access token is stored securely in your session and is not retained after your session ends.
• Data submitted to HMRC (your income and expense figures) is transmitted directly from your device to HMRC’s systems. TaxEase UK does not retain a copy of the submitted return data.
• You can revoke TaxEase UK’s access to your HMRC account at any time via your HMRC account settings.

HMRC as data controller: Once data is submitted to HMRC, it is processed by HMRC under their own privacy notice: HMRC Privacy Notice.

Fraud prevention data: As required by HMRC’s fraud prevention standards, TaxEase UK transmits certain device and connection information (such as IP address, browser type, and screen resolution) with each API call to HMRC. This is a mandatory requirement of the HMRC API platform and cannot be disabled. See HMRC’s Fraud Prevention Headers guidance for details.

9. Your rights under UK GDPR

Under UK GDPR, you have the right to: access your personal data; rectify inaccurate data; erase your data (right to be forgotten); restrict or object to processing; and data portability.

For tax calculation data stored locally on your device, you exercise these rights directly — clear your browser localStorage or uninstall the desktop application.

For account data we hold in our database, contact us at hello@taxeaseuk.com. We will respond within 30 days as required by UK GDPR.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

10. Data retention

• Tax calculation data: retained locally on your device only — we hold no copy.
• Account data: retained for the duration of your account, then deleted within 30 days of account closure.
• Licence records: retained for 7 years as required by UK financial regulations (HMRC record-keeping requirements).
• Stripe payment records: retained per Stripe’s policies (typically 7 years for financial compliance).
• HMRC OAuth tokens: session-only; not persisted after your session ends.
• Database backups (Cloudflare R2): retained for 12 weeks (rolling). Backups are encrypted at rest.

11. Children

TaxEase UK is intended for adults who are required to file a UK Self Assessment tax return. We do not knowingly collect data from individuals under 18.

12. Changes to this policy

We may update this Privacy Policy from time to time. The current version is always available at taxeaseuk.com/privacy. Material changes will be notified via the application or email to registered account holders.

12b. Verified Accountants Directory — Public Data

If you are a registered B2B accountant partner and you opted in to the Verified Accountants Directory during registration, the following data will be displayed publicly on taxeaseuk.com/find-accountant:

• Firm name and contact name
• Professional body and membership number (displayed as verified)
• Languages spoken and specialisms
• Region and website (if provided)
• A direct enquiry link

Legal basis: Consent (Article 6(1)(a) UK GDPR). You may withdraw consent at any time by emailing hello@taxeaseuk.com. We will remove your public listing within 5 business days.

Your email address, phone number, Companies House number, and password are never displayed publicly.

13. Contact

For any privacy-related questions or requests, contact us at hello@taxeaseuk.com. We aim to respond within 5 business days.