Privacy Policy

1. Who we are

TaxEase UK (“we”, “us”, “our”) is a trading name of TAXEASEUK LTD, a company registered in England and Wales (Company Number: 17244428), providing software tools to help individuals prepare their UK Self Assessment tax return. We are not affiliated with HMRC or any UK Government department.

Data controller: TAXEASEUK LTD. For questions about this policy, contact us at hello@taxeaseuk.com.

2. The short version

TaxEase UK is designed with a privacy-first approach. The standalone application (HTML/desktop) stores all your tax calculation data locally on your device. However, as a registered platform user (account holder), certain account and licence data is stored in our secure cloud database. We do not sell your data. We do not serve you advertisements.

3. Data stored locally on your device

When you use TaxEase UK as a standalone tool (free HTML version or desktop application without signing in), the following data is saved in your browser’s localStorage or the desktop app’s local storage only:

• Your tax return figures (income, expenses, deductions, etc.)
• Your language and display preferences
• Your onboarding status and plan selection
• MTD quarterly tracker entries (if used)
• Bank statement merchant category mappings (if you use the OCR feature)

In standalone mode, this data never leaves your device. No tax calculation data is transmitted to our servers.

4. Data we collect on the website

When you visit our website (taxeaseuk.com), standard server logs may record your IP address, browser type, and pages visited. These are used solely for security and performance monitoring and are not used to identify you personally.

4b. Account & platform data (Supabase)

When you create a TaxEase UK account (individual, B2B accountant, or affiliate), the following data is stored in our secure database (Supabase, hosted in the EU, Frankfurt, Germany):

• Individual accounts: email address, licence key, licence status, purchase date, and — for licences bought as a subscription — the reference number of that subscription at our payment provider and the date the licence runs until
• B2B accountant accounts: firm name, contact name, email, phone, professional body and membership number, languages, region, opt-in status for the public directory, and the client records you create
• Affiliate accounts: name, email, referral code, conversion records, payout history

Legal basis: Contract performance (Article 6(1)(b) UK GDPR), this data is necessary to provide you with the service you signed up for.

If you were invited by an accountant. Where an accountancy practice adds you as a client, they create a record that holds your name, email address, Unique Taxpayer Reference and National Insurance number, the tax year being prepared, and the status of your return. When you complete and send your return through the invitation link, that record also holds the figures you entered and, where you signed one, your declaration that those figures are correct, together with the date, time and the IP address recorded by our server at the moment you signed. The IP address is stored because a declaration without a verifiable record of when and from where it was made is of little use to either of you.

This record is visible to you and to the accountancy practice that invited you. It is not shared with other practices, is not used to build a profile of you, and is not sold or disclosed to anyone else. If you would like your record removed, ask your accountant, or email hello@taxeaseuk.com.

Documents you exchange in the secure chat (bank statements, receipts, your completed return) are stored in a private area of our storage. They are not published and have no public address. Each time you or your accountant opens one, our server first checks that you are entitled to it and then issues a link that expires after a few minutes. A link that leaks or is forwarded does not give anyone lasting access.

Legal basis: Contract performance (Article 6(1)(b) UK GDPR). Your accountant is a separate data controller for the work they carry out for you and has their own privacy notice; we process this data to provide the platform through which you both work.

Accountants listed in our public directory. An accountant can choose to appear in our public directory, and can turn that off at any time. While listed, these fields are visible to anyone: firm name, contact name, town, contact email, languages spoken, specialisms, website, the description they wrote, and whether we have verified them. These are business details, published so that a client can find and contact them. Nothing else from their account is published, and in particular not their membership number, phone number, company number, referral code, application status or any security token. The listing is off by default and the exact list of published fields is shown next to the switch, before it is turned on. Legal basis: consent (Article 6(1)(a) UK GDPR), given by enabling the listing.

We do not store your UTR. A licence covers one person’s Self Assessment, so it has to be tied to one tax return and not passed around. To do that we do not need to know your Unique Taxpayer Reference, only to recognise that it is the same one as last time. When you first enter your UTR in the wizard, we convert it into a fixed string of characters (a one-way fingerprint, computed with a secret key held only by our server) and store that. The number itself never reaches our database, and the fingerprint cannot be turned back into it.

If a licence key is later used with a different UTR, the fingerprints will not match and the paid features stay locked. If you need a licence released, for example because the wrong number was entered, email hello@taxeaseuk.com and we can clear it, without ever seeing either number.

Your Self Assessment figures stay on your device. The tax wizard runs entirely in your browser: the numbers you enter, your calculations and the documents you scan are held in your browser’s local storage and are not transmitted to us.

Monthly Expenses is the one exception, and only if you choose to use it. When you save a month from the Monthly Expenses feature, that month is stored in our database so it is available to you across devices and at the end of the tax year. What we store for each saved month: the tax year and month, your expense categories and the transactions inside them (description, amount and, where we can read it, the transaction date), your income entries, your merchant-to-category preferences, and the monthly totals.

This data is visible only to you. It is protected both by row-level security policies in the database, which restrict every row to the account that created it, and by an ownership check in our application code. Saving a month again replaces the previous version. You can delete any saved month yourself, at any time, from the Expenses page in your account; the deletion is immediate and permanent. Deleting your account removes all of it.

Legal basis: Contract performance (Article 6(1)(b) UK GDPR), this data is necessary to provide the feature you chose to use.

Supabase (data processor): Supabase Ltd acts as a data processor on our behalf. Your account data is stored in their EU-region infrastructure (Frankfurt, Germany) and is subject to their Data Processing Agreement.

Chat translation (Google, data processor): The chat between you and your accountant can be shown in your own language. To do that, the text of a message is sent to Google Cloud Translation, which acts as a data processor for us under Google’s Data Processing Addendum. Only the message text is sent, never your name, email, UTR or any figure from your return. Google states that it does not use this text to train its translation models, does not share it, and holds it only briefly in memory to perform the translation rather than storing it. We do not send a message more than once: the translation is stored next to the original in our own database, so it is never sent again. We also store the language you choose, so you do not have to pick it again. The original message is always kept and always shown, above the translation. One point of detail, because we would rather state it than leave it implied: this translation runs on Google’s global infrastructure, so unlike the rest of your data, which is stored in the EU, the few milliseconds of translation are not restricted to a particular region.

5. Licence key purchases

If you purchase a Premium or B2B licence, the payment is processed by Stripe, Inc. (our payment provider). We receive confirmation of payment and your email address for licence delivery. We do not store your payment card details, these are handled entirely by Stripe under their own privacy policy and PCI-DSS Level 1 compliance.

Where a licence is sold as a subscription, we also store the reference number that Stripe gives that subscription. We use it for one purpose: to know which licence a renewal or a cancellation belongs to, so that we can show you the correct renewal date and stop the licence when the subscription ends. It is an internal reference and contains no payment details.

The “Manage / Cancel subscription” button opens Stripe’s own billing portal, where you can cancel the renewal, update your card and download your invoices. We generate a single-use link for you; you do not need a Stripe account and you do not create one. What you do inside that portal is handled by Stripe under their privacy policy.

For B2B accountant partners receiving commissions, payouts are processed via Stripe Connect. Stripe may require additional KYC (Know Your Customer) information directly from you as part of their onboarding process.

Invoice Maker (taxeaseuk.com/invoice-maker) follows the same model. Your invoice content, client details and settings are stored only in your browser on your device and are never sent to our servers. If you buy an Invoice Maker licence, we store the licence key, the plan purchased and the email address used at checkout; the key you enter into the tool is sent to our server so that it can be checked against our licence records.

6. Cookies

The TaxEase UK standalone application uses localStorage (not cookies) to persist your preferences and tax data locally.

Our website (taxeaseuk.com) uses two categories of cookies:

• Essential session cookies, set by Supabase for authentication. These are strictly necessary for the service to function and do not require your consent.
• Affiliate referral cookie, if you arrive via an affiliate referral link (e.g. taxeaseuk.com/r/CODE), a cookie named affiliate_ref is set for 90 days. This cookie is used solely to attribute your purchase to the referring affiliate for commission purposes. No personal data is stored in this cookie, only the affiliate’s referral code. Your referral code is also stored in your browser’s localStorage as a fallback (e.g. if cookies are blocked). Both the cookie and localStorage entry expire after 90 days.
• Analytics cookies (optional), we use Google Analytics 4 (GA4) to understand how visitors use TaxEase UK. GA4 sets cookies (_ga, _gid) only after you give explicit consent via the cookie banner shown on your first visit. If you decline, no analytics cookies are set and GA4 is never loaded. You can change your preference at any time by clearing your browser’s localStorage.

We do not use advertising or marketing cookies. Your cookie preference is stored in your browser’s localStorage (not a cookie) and is never sent to our servers.

7. Third-party services

TaxEase UK uses the following third-party services as data processors. Each operates under their own data processing agreement and privacy policy:

• Vercel Inc., web hosting (EU region: London, UK). Processes request logs.
• Supabase Ltd., database (EU region: Frankfurt, Germany). Stores account data.
• Stripe, Inc., payment processing. Stores payment and identity data.
• Cloudflare, Inc., DNS and CDN. Processes network requests.
• Zoho Corporation, transactional email (hello@taxeaseuk.com). Processes email addresses for delivery.
• Cloudflare R2, encrypted database backups. Stores anonymised backup snapshots.

We have Data Processing Agreements in place with each of the above where required under UK GDPR.

8. HMRC API integration & OAuth

TaxEase UK integrates with HM Revenue & Customs (HMRC) APIs under the HMRC Making Tax Digital (MTD) programme. When you choose to connect your HMRC account to TaxEase UK, the following applies:

• You will be redirected to HMRC’s official login page (Government Gateway) to grant TaxEase UK authorisation via OAuth 2.0. TaxEase UK never sees or stores your HMRC username or password.
• HMRC will issue TaxEase UK a time-limited access token. This token is used only to submit your Self Assessment data to HMRC on your behalf, or to retrieve status information about your submission.
• The access token is stored securely in your session and is not retained after your session ends.
• Data submitted to HMRC (your income and expense figures) is transmitted directly from your device to HMRC’s systems. TaxEase UK does not retain a copy of the submitted return data.
• You can revoke TaxEase UK’s access to your HMRC account at any time via your HMRC account settings.

HMRC as data controller: Once data is submitted to HMRC, it is processed by HMRC under their own privacy notice: HMRC Privacy Notice.

Fraud prevention data: As required by HMRC’s fraud prevention standards, TaxEase UK transmits certain device and connection information (such as IP address, browser type, and screen resolution) with each API call to HMRC. This is a mandatory requirement of the HMRC API platform and cannot be disabled. See HMRC’s Fraud Prevention Headers guidance for details.

9. Your rights under UK GDPR

Under UK GDPR, you have the right to: access your personal data; rectify inaccurate data; erase your data (right to be forgotten); restrict or object to processing; and data portability.

For tax calculation data stored locally on your device, you exercise these rights directly, clear your browser localStorage or uninstall the desktop application.

For account data we hold in our database, contact us at hello@taxeaseuk.com. We will respond within 30 days as required by UK GDPR.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

10. Data retention

• Tax calculation data: retained locally on your device only, we hold no copy.
• Account data: retained for the duration of your account, then deleted within 30 days of account closure.
• Licence records: retained for 7 years as required by UK financial regulations (HMRC record-keeping requirements).
• Stripe payment records: retained per Stripe’s policies (typically 7 years for financial compliance).
• HMRC OAuth tokens: session-only; not persisted after your session ends.
• Database backups (Cloudflare R2): retained for 12 weeks (rolling). Backups are encrypted at rest.

11. Children

TaxEase UK is intended for adults who are required to file a UK Self Assessment tax return. We do not knowingly collect data from individuals under 18.

12. Changes to this policy

We may update this Privacy Policy from time to time. The current version is always available at taxeaseuk.com/privacy. Material changes will be notified via the application or email to registered account holders.

12b. Verified Accountants Directory, Public Data

If you are a registered B2B accountant partner and you opted in to the Verified Accountants Directory during registration, the following data will be displayed publicly on taxeaseuk.com/find-accountant:

• Firm name and contact name
• Professional body and membership number (displayed as verified)
• Languages spoken and specialisms
• Region and website (if provided)
• A direct enquiry link

Legal basis: Consent (Article 6(1)(a) UK GDPR). You may withdraw consent at any time by emailing hello@taxeaseuk.com. We will remove your public listing within 5 business days.

Your email address, phone number, Companies House number, and password are never displayed publicly.

Marketing Communications

We send marketing emails (tax tips, product news, special offers) only to users who have explicitly opted in by ticking the marketing consent checkbox at the point of account registration. The checkbox is unchecked by default — we never pre-tick it on your behalf.

Your marketing preference is stored as a boolean value in our secure database alongside your account record. We record the fact of consent but do not record the exact timestamp of consent separately — consent is given at the moment of account creation.

You can withdraw consent at any time by:

• Toggling off “Marketing emails” in your Account Settings, or
• Clicking “Unsubscribe” in any marketing email we send, or
• Emailing hello@taxeaseuk.com

Legal basis: Consent (Article 6(1)(a) UK GDPR). Withdrawal does not affect the lawfulness of processing before withdrawal. Transactional emails (account confirmations, licence keys, inactivity notices) are sent regardless of marketing preference as they are necessary for the service.

13. Contact

For any privacy-related questions or requests, contact us at hello@taxeaseuk.com. We aim to respond within 5 business days.

Language

This Privacy Policy is published in English. Where a translation into another language is provided, it is offered for convenience and understanding only. In the event of any inconsistency, ambiguity or dispute, the English version prevails and is the legally binding version.