Privacy policy

Who we are

Making Tax Eazy Ltd is a company registered in England and Wales, company number 17380670, with its registered office at the address shown on the Companies House register. We trade as MakingTaxEazy. You can reach us at azhar@makingtaxeazy.co.uk.

Our registration with the Information Commissioner’s Office as a data controller is in progress, and the reference will appear here once it is issued.

We are software, not your accountant

MakingTaxEazy is a tool. It does not do your bookkeeping, prepare your accounts, or act for you. You — or your accountant — do the work; the software organises the records, applies rules, and shows you the result to check.

Where the software suggests a category for a transaction, or flags something for a second look, that is a suggestion you approve or reject. Nothing it proposes becomes a figure in a return until a person accepts it.

Controller and processor: what those words mean here

Data protection law uses “processing” in a much wider sense than everyday speech. It covers any handling of personal data at all, including simply storing it. Because your records sit in our database so the software can work, we process them in that legal sense — even though we take no part in your accounting.

Which of the two roles we hold determines who decides what happens to the data, and it is worth being precise about it.

For account holders — the people who sign in — we are the controller. We decide what we collect in order to run the service: your name, email address, and records of your use of it.

For the books and tax records inside the product, we are a processor. We hold and handle them on instruction and for no purpose of our own. Where an accountancy practice uses the software for its clients, the practice is the controller of those clients’ data. Where an individual uses it for their own affairs, they are the controller of their own.

The practical consequence, and the reason this section exists: we do not decide what happens to those records, we do not use them for our own purposes, and we do not share them with anyone except the providers listed below and HMRC when you instruct a submission.

Automated suggestions, and artificial intelligence

Categorisation today is rule-based and runs on our own systems. It compares a transaction against rules — some built in, some learned from corrections you have made — and proposes a category. There is no artificial intelligence involved and no third-party model sees your data.

We intend to introduce AI-assisted categorisation and reconciliation. When we do:

• we will update this policy and tell account holders before it happens, not after;
• it will remain a suggestion a person approves, not a decision made about you — there is no automated decision-making with legal or similarly significant effects in this product;
• we will say which provider is involved, what they receive, and whether they may retain or train on it, and we will not send identifying client data to a provider that trains on it.

Where we develop our own understanding of how merchants map to categories, we do so from information that has been stripped of anything identifying a person or a business — not from your clients’ records themselves.

What we hold

• Account details: name, email address, and a hashed password. If you enrol two-step verification we hold the factor and one-time recovery codes, stored only as hashes.
• Bank transaction data you import or connect: dates, amounts, descriptions, merchant names and account identifiers.
• Tax information needed to prepare a return, which may include your National Insurance number, income and expense figures, property and self-employment details, and CIS deductions.
• Documents you upload, such as receipts and statements.
• Technical data required by HMRC. To use HMRC’s APIs we must send “fraud prevention headers” with every call: your public IP address, device and browser characteristics, screen and window size, local timezone, and an identifier for your device. This is a legal requirement imposed by HMRC on all software connecting to their systems, not a choice we have made.

Why we are allowed to hold it

Where we act as controller, we rely on contract — we cannot provide the service without it — and on legitimate interestsfor keeping the service secure and working. Sending HMRC’s fraud prevention headers is a legal obligation arising from their conditions of API use.

Where we act as processor, our instructions come from the controller — usually the accountancy practice — under a written agreement.

Who else sees it

We use a small number of service providers, and we do not sell data to anyone or share it for advertising.

• HMRC — where you submit a return or an update, or where we read your obligations or calculations on your instruction.
• Supabase — database, file storage and authentication.
• Vercel — application hosting.
• Fly.io — network infrastructure in London that carries our connection to HMRC. It cannot read what passes through it, which is encrypted between us and HMRC.
• Xero — only if you choose to connect an account, and only to read the records you ask us to import.

No artificial intelligence provider receives your data. The categorisation in the product today is rule-based and runs on our own systems. If that changes we will update this policy and say so before it happens, not after.

Where it is held

Your data is stored and processed in the United Kingdom. Our database and file storage are in London (Supabase, region eu-west-2), the application runs in London (Vercel, region lhr1), and the proxy carrying our calls to HMRC is in London.

One qualification, because it is true and the sentence above would otherwise be too tidy: our hosting provider operates a global network that accepts your connection at a location near you before passing the request to London. The connection is encrypted throughout and no data is stored outside the UK.

If that ever changes — if we use a provider that processes data outside the UK — the transfer will be covered by the UK’s approved safeguards, such as the International Data Transfer Agreement, and this policy will say so.

How long we keep it

Records relating to a tax return are kept for six years after the end of the tax year they concern, which reflects how long HMRC may enquire into a return and how long a taxpayer is required to keep the underlying records.

Account data is kept while the account is open and for twelve months after it closes. Where we are a processor, we return or delete data on the controller’s instruction, subject to any period we are separately required to retain it.

How it is protected

Access requires a password and a second factor; two-step verification is mandatory, not optional. Your HMRC access tokens are encrypted before they are stored. Uploaded documents are held in private storage that is not publicly addressable. Traffic is encrypted in transit.

No system is beyond compromise, and we will tell you and the ICO about a breach affecting your data within the timescales the law sets.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to what we do with it, or to have it sent to another provider. Write to azhar@makingtaxeazy.co.uk and we will respond within one month.

If your data is in the product because your accountant put it there, they are the controller and the request is best made to them; we will help them answer it.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113. We would rather you told us first so we can put it right.

Cookies

We set cookies that are strictly necessary to keep you signed in and to keep the service secure. We do not use advertising or analytics cookies, so there is nothing here to consent to or refuse.

Changes

If we change this policy we will change the date at the top, and we will tell account holders directly where the change is significant.