Privacy Policy

1. Who we are

TapTax ("we", "us", "our") is a UK-based software service for sole traders and landlords. We are the data controller for personal data processed through taptax.co.uk and our mobile application. You can contact us at privacy@taptax.co.uk.

TapTax is a trading name of HomePortfolio HQ Ltd, registered in England and Wales, company number 14708415. Registered office: 2 Buttercup Drive, Newcastle upon Tyne, NE15 9FW.

2. Data we collect

We collect only what we need to provide the service:

Account data - name, email address, and password (hashed) when you register.
Financial data - income, expense, and transaction records you enter or import via Open Banking.
Tax data - quarterly submission figures and HMRC filing history.
Device and usage data - IP address, browser type, app version, and pages visited, collected automatically via server logs and analytics.
Payment data - subscription status and billing history. Card details are handled entirely by our payment processor (Stripe) and never stored by TapTax.
Open Banking data - read-only access to bank transaction data via a regulated Open Banking provider. We never store your banking credentials.
Documents you upload - receipt and invoice images or PDFs you add to your account, and the details read from them. A payslip or coding notice you upload to the free tax code checker is read once and never stored.
Google sign-in data - only if you choose to sign in with Google. See below.

If you choose to sign in with your Google account, Google shares with us your name, your email address, your profile picture and an identifier for your Google account. We ask only for this basic profile information. We do not request access to your Gmail, contacts, calendar, Drive or any other Google data.

We use your name and email address to create your TapTax account, sign you in, and contact you about your account. The profile picture and account identifier are kept only as part of your sign-in record, held by our authentication provider (Supabase) under a data processing agreement. We do not use Google account data for advertising, we do not sell it, and we do not share it with anyone else.

TapTax's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove TapTax's access at any time from your Google Account permissions. Deleting your TapTax account also deletes the Google sign-in data we hold.

3. How we use your data

To provide, operate, and improve the TapTax service.
To submit quarterly MTD updates to HMRC on your behalf when you instruct us to.
To calculate and display your estimated tax liability.
To process your subscription payments.
To send transactional emails (receipts, submission confirmations, account alerts).
To detect fraud, abuse, and security incidents.
To improve the service through aggregated, anonymised usage analytics - you will never be individually identifiable in analytics data.

4. Legal basis (UK GDPR)

Contract - processing necessary to deliver the service you signed up for (Art. 6(1)(b)).
Legal obligation - retaining financial records as required by UK law (Art. 6(1)(c)).
Legitimate interests - security monitoring, fraud prevention, and service improvement (Art. 6(1)(f)).
Consent - marketing emails and website analytics (Ahrefs Web Analytics and Google Analytics), only if you opt in. You can withdraw consent at any time.

5. Data sharing

We do not sell your data. We share data only with:

HMRC- quarterly MTD updates submitted at your instruction via HMRC's official APIs.
Stripe - for payment processing. Subject to their own privacy policy.
Open Banking provider - to retrieve your read-only bank transaction data.
Anthropic - our AI provider (Anthropic PBC, United States). When you use an AI feature we send it only what that feature needs: transaction descriptions and amounts so it can suggest a tax category, and the receipt, invoice or payslip image you upload so it can read the details. Anthropic processes this to provide the service to us under its commercial terms, which do not allow it to train its models on this data. It may process this outside the UK under appropriate safeguards.
Infrastructure providers - cloud hosting and database services, operating under data processing agreements with us.
Analytics providers - only if you allow analytics: Ahrefs Pte Ltd (Singapore) for Ahrefs Web Analytics, and Google for Google Analytics. They receive the pages you visit, the site that referred you, your browser, device and screen size, and your IP address, which they use to estimate your country. They may process this outside the UK under appropriate safeguards.
Accountants - only if you explicitly grant them access via the Pro plan accountant access feature.

6. Data retention

We keep your account and financial data for as long as your account is active and for six years after closure, as required by HMRC record-keeping rules. You may request deletion of data not required for legal compliance by contacting us.

7. Your rights

Under UK GDPR you have the right to:

Access - request a copy of the personal data we hold about you.
Rectification - correct inaccurate data.
Erasure - request deletion where no legal obligation to retain applies.
Portability - receive your data in a machine-readable format.
Objection - object to processing based on legitimate interests.
Restriction - limit how we use your data in certain circumstances.

To exercise any right, email privacy@taptax.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the ICO at ico.org.uk.

8. Cookies

We use strictly necessary cookies to keep you signed in, protect the service, and remember your privacy choices. These cannot be switched off.

Analytics is off unless you allow it. If you allow analytics, we load Ahrefs Web Analytics, which sets no cookies, and Google Analytics, which sets first-party _ga cookies that last up to two years. Google's advertising features and Google signals are switched off. We do not use advertising cookies.

You can change or withdraw your choice at any time in , also linked from the footer of every page. Withdrawing consent stops both tools on the page you are on and deletes the Google Analytics cookies.

9. Security

We use industry-standard encryption (TLS in transit, AES-256 at rest - including app-layer AES-256-GCM encryption of HMRC access and refresh tokens) and enforce access controls to protect your data. We will notify HMRC, the ICO, and you of any personal data breach within 72 hours where required, in line with our published incident-response process. Our designated responsible individual for data protection and security is the TapTax founder, contactable at privacy@taptax.co.uk.

10. Where your data is stored

TapTax is committed to storing and processing your personal and financial data on infrastructure located in the United Kingdom. We use reputable cloud infrastructure and database providers operating under data processing agreements with us, and we are completing the alignment of all hosting to UK regions as a pre-launch action before onboarding production customers. Some sub-processors named in section 5 (for example, your payment processor, our AI provider and the Open Banking provider) may process limited data outside the UK under appropriate safeguards as described in their own policies.

11. Changes to this policy

We may update this policy from time to time. We will notify you by email of material changes before they take effect. The latest version is always available at taptax.co.uk/privacy.

12. Contact

Questions about this policy? Email us at privacy@taptax.co.uk.