Privacy Notice

Effective from: 01/11/2026

Last updated: 01/11/2026

This notice explains how TaxHalo (“we”, “us”, “our”) collects, uses, and protects your personal data when you use our service. It is written to satisfy Articles 13 and 14 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

The data controller is:

Invasive Security Limited
(trading as TaxHalo)
Email: privacy@taxhalo.co.uk

2. What data we hold and why

2.1 Account data

When you register, we collect your email address, chosen password (hashed — never stored in plain text), full name (optional), and phone number (optional). This is necessary to create and manage your account.

Lawful basis: Article 6(1)(b) UK GDPR — performance of a contract with you.

Retention: For the lifetime of your account, plus 30 days after you close it, so that you can change your mind. If you ask for a copy of your data when you close your account, we wait until we have sent it. After that we delete your sign-in, replace your email address, and clear your name, phone number, National Insurance number and tax profile. What is left is an account record that no longer carries your name or contact details. It is linked to the filings in §2.2 and the invoices in §2.4, so we keep it for as long as we keep them, and then delete it.

2.2 Financial and tax data

To provide the TaxHalo service you enter income, expenses, and other tax-related records. We store these securely in our UK-hosted database (AWS eu-west-2, London).

Lawful basis: While your account is open, Article 6(1)(b) — performance of a contract. After you close your account, or we erase your data, we keep the filings described below under Article 6(1)(f) — our legitimate interest in being able to show what was filed with HMRC through TaxHalo if it is ever questioned. You can object to this (§4).

Retention: We keep each tax year’s records until 6 years after its 31 January filing deadline, or 6 years after the latest filing or amendment for that year if that is later. For example, the filing deadline for the 2024/25 tax year is 31/01/2026, so we delete that year’s records from 01/02/2032, unless its return was filed or amended after 31/01/2026. The same period applies whether your account is open, closed or erased. Closing your account or asking us to erase your data deletes some records sooner, as described below and in §4.1, but never makes us keep anything longer.

This covers your transactions, receipts and their files, income, mileage and investment records, tax calculations, and your returns and updates with every version you filed. Receipt files are deleted with the tax year they belong to. An investment’s records stay while you still hold any of it, because they show what it cost you; once you have sold or given away all of it, they follow the tax year you did so in. Records you delete yourself go sooner. While your account is open, we will tell you at least 30 days before we delete the records for an old tax year, with a link to download them.

The law separately requires you, as the taxpayer, to keep the records behind your Self Assessment return (Taxes Management Act 1970 s.12B). If you are in business or let property, you must keep them until 5 years after the 31 January filing deadline for the tax year. Otherwise, you must keep them until 1 year after that deadline. If HMRC opens an enquiry into your return, you must keep them until the enquiry is finished. Our period is longer than both, but keeping your records is still your duty, not ours.

If your plan stops including bank feeds, for example when you move to the Free plan, we cancel our access to your connected bank and delete the stored bank access token 30 days later, together with any bank transactions you never imported; the transactions you did import stay in your records.

If you close your account, we keep only what you filed with HMRC through TaxHalo: your returns and updates, when you sent them, HMRC’s reference, and the loss and foreign income positions you declared in them. We keep them, with your name and contact details removed (§2.1), for the period above, so that we can show what was filed if it is ever questioned, and then we delete them. Closing your account does not restart that period.

We delete the rest of your financial and tax data when the 30 days in §2.1 end, or once we have sent you the copy you asked for: your transactions, receipts and their files, documents you uploaded for us to read, income, mileage and investment records, and any return you never filed. Keeping your own tax records is your duty, so download a copy before you close: once that period is over, we can no longer tell which records were yours, so we cannot send you one.

If you are a member of a shared workspace and its owner closes it, we move you to a workspace of your own. The records you kept in the closed workspace stay there and are deleted when its 30 days end, so we email you when the closure starts with a link to download them. The link works until then.

2.3 HMRC connection

If you connect TaxHalo to HMRC via Making Tax Digital (MTD), we store OAuth access and refresh tokens (encrypted at column level using AES-256), your National Insurance number (also encrypted), and your HMRC business identifier. These are used solely to file updates and retrieve information on your behalf.

Lawful basis: Article 6(1)(b) — performance of a contract. We need them to file updates and returns with HMRC for you. The duty to file is yours, not ours.

Retention:

Access and refresh tokens — deleted when you disconnect HMRC, when your account is closed (§2.1) or when we erase your data (§4.1). The tokens for a live connection are also deleted when your plan stops including filing to HMRC.
National Insurance number — kept while your account is open. Closing your account clears it at the end of the period in §2.1, and asking us to erase your data clears it straight away. We do not keep it after that.
HMRC business identifier — removed when you disconnect HMRC and no other HMRC connection remains, and when we erase your data. If you close your account while still connected, it stays on the business record, which no longer carries your name, address or UTR.

The record of what you filed with HMRC through TaxHalo is kept as described in §2.2.

2.4 Subscription and billing data

When you subscribe to a paid plan, we hold your subscription tier, billing interval, and subscription status. We do not store your card number or CVV — those stay entirely with Stripe (see §5 below). We store only non-sensitive card metadata: card brand (e.g. Visa), last four digits, and expiry date. Invoices we issue to you are retained for accounting purposes.

Lawful basis: Article 6(1)(b) — performance of a contract; Article 6(1)(c) — our own corporation tax, VAT and Companies Act accounting obligations for invoices.

Retention: Active subscription data is held for the lifetime of your subscription, plus 30 days after cancellation. Payment method metadata (card brand, last four, expiry) is deleted 30 days after cancellation.

Invoices we issue to you are our own accounting records, which the law requires us to keep. We keep them for at least 6 years after the end of our financial year in which we issued them, and then delete them. That meets the corporation tax rule (Finance Act 1998 Schedule 18 paragraph 21) and, where VAT applies, the VAT rule (Value Added Tax Act 1994 Schedule 11 paragraph 6; VAT Notice 700/21). It is longer than the 3 years the Companies Act 2006 requires of a private company (s.388).

2.5 Usage and diagnostic data

We log API calls and errors for operational monitoring. These logs contain no financial or tax data. They are retained for 90 days and then deleted.

Lawful basis: Article 6(1)(f) — legitimate interests (securing and improving the service).

2.6 Feedback you send us

If you use the feedback panel in the app to tell us something is broken, confusing, or worth building, we store what you wrote along with the page you were on, the environment you were using, your browser's user agent, and your account and workspace identifiers. We ask you not to include tax figures, your UTR or your National Insurance number — we do not need them to fix a problem — but anything you do type is stored as you wrote it.

Feedback is kept for 2 years and then deleted automatically. It is also deleted if you ask us to erase your data, and it is included in a subject access request. Nothing is collected unless you choose to send a report.

Lawful basis: Article 6(1)(f) — legitimate interests (improving the service for the people using it).

2.7 Feedback you send us when you are not signed in

The sign-in, registration and password-reset pages carry the same feedback control, because a problem that stops you signing in is one you cannot report from inside the app. A report sent from one of those pages is stored separately and differently, and the differences matter to you:

We store what you wrote, which of those pages you were on, the environment, your browser's user agent, and the reference of the last error the app hit. That reference is our own; it identifies a request on our servers, not you or your device.
We do not store your IP address, or any value derived from it, on the report. We use your IP address only to limit how many reports can be sent from one network in an hour, and that count is held briefly and separately from the report itself.
Because you are not signed in, the report is not linked to any account — not even if you have one. We ask you not to include your password, and to leave out tax figures, your UTR and your National Insurance number, but anything you do type is stored as you wrote it.

Reports sent this way are kept for 90 days and then deleted automatically — a shorter period than §2.6, for the reason in the next sentence. We hold nothing that identifies who sent one, so we cannot find it to show you, correct it or delete it on request, and we cannot confirm that a report was yours (UK GDPR Article 11). If you want a report you can see and have erased, sign in first and use the panel inside the app instead. We also cannot reply to a report sent this way, for the same reason.

Lawful basis: Article 6(1)(f) — legitimate interests (being told when the way into the service is broken).

2.8 Bank feeds

If your plan includes bank feeds, you can connect a bank account so that its transactions come into TaxHalo without you typing them in. The connection runs through TrueLayer (§3.5), which is authorised by the Financial Conduct Authority to read bank accounts on your behalf. You choose your bank and which accounts to share on TrueLayer’s and your bank’s own screens. We never see your bank login, and we cannot make payments or move money.

What we fetch. Every transaction of the accounts you choose: its date, amount, currency, whether money went in or out, the type of payment (for example, a direct debit), the description your bank gives it and, where the bank provides one, the merchant name. We fetch up to 12 months of past transactions for an account connected to a business, and up to 6 months for one connected to Personal & property, and then new ones as they appear. We also keep your bank’s name, the account type and the last four digits of the account number. TrueLayer sends us the full account number and sort code too, but we do not store them.

How we hold it. Fetched transactions wait for you to review them. We hold them encrypted, with the description and merchant name under a key used only for bank data, until you import them or they are removed. Only the transactions you import become part of your records, and those are kept as described in §2.2. We use your bank data only to keep your records. We do not use it for marketing, profiling, credit decisions, advertising or training AI models.

Who can see it. For an account connected to a business, every member of that workspace can see its transactions and import them. For an account connected to Personal & property, only you can, not other members of your workspace. Once imported, a transaction is part of that ledger, and anyone who can see the ledger can see it.

How long we keep it.

Transactions you never import are deleted 12 months after the transaction date for an account connected to a business, and 6 months (183 days) after it for an account connected to Personal & property. The review screen shows when each one will be removed. You can still enter a removed transaction by hand or from a CSV file.
When you import a transaction, we delete the description and merchant name from our copy of the bank’s version at our next daily clean-up. We delete the rest of that copy 12 months after the transaction date. The imported transaction itself is kept as described in §2.2.
Your bank consent lasts up to 90 days, or less if your bank or TrueLayer sets an earlier date. To keep the feed running you renew it by reconnecting. If you do not, the feed stops and we delete the stored bank access token.

When it ends.

You disconnect. You can disconnect at any time, on any plan. We ask TrueLayer to end the consent, delete the stored bank access token and delete every transaction you never imported. Transactions you imported stay in your records.
You stop importing one account. If your consent covers more than one account, you can stop importing any one of them at any time. We delete the transactions from that account that you never imported and fetch nothing more from it. Transactions you imported stay in your records.
Your plan changes. If your plan stops including bank feeds, we end the connection 30 days later, as described in §2.2.
You leave a workspace. The connections you made there to Personal & property are ended at your bank through TrueLayer and deleted, with the transactions you never imported. The transactions you did import move with you. Connections you made for a business stay with that business, but the bank access behind them is still yours. If any of them is still active, we email you to say so, without naming the bank or the account. In My account you can see each one, by bank and the last four digits of each account it covers, and disconnect it yourself. When you do, we ask TrueLayer to end the consent and delete the connection and the transactions the business never imported. Transactions the business already imported stay in its records. We also tell the workspace’s owners and admins that you disconnected it, without sharing any account details.
You close your account or ask us to erase your data. We end your connections at TrueLayer as well as deleting them here. To do that, we keep the encrypted bank access token for up to 14 days afterwards and use it for nothing else (§4.1).

Other people in your transactions. A transaction can name someone else: a customer who paid you, a tenant, a landlord, a sole trader you bought from, or someone you sent money to. On a joint account, we fetch the other account holder’s transactions too. We keep these details because they are part of an accurate record of your income and expenses, and they are no more than your bank already shows you on your statement. We do not tell the people named in your transactions that we hold their details, because we have no way to contact them and doing so would take disproportionate effort (UK GDPR Article 14(5)(b)). Their details are protected and deleted in the same way as the rest of your bank data.

Lawful basis: Article 6(1)(b) — performance of a contract: you asked us to bring in your bank transactions. Your bank and TrueLayer also ask for your consent, because banking law requires it; that consent is separate from the basis we rely on here. For the people named in your transactions, Article 6(1)(f) — your and our legitimate interest in complete and accurate tax records.

3.1 HMRC

When you authorise an MTD submission, we transmit your income and expense records to HMRC on your behalf. HMRC acts as a joint controller for that data under Article 6(1)(c). We do not sell or share your data with HMRC for any other purpose.

3.2 Amazon Web Services (AWS — EMEA)

Our infrastructure runs on AWS in the eu-west-2 (London) region. AWS acts as a processor under a GDPR Data Processing Addendum. Your data does not leave the UK for processing by AWS.

3.3 Stripe, Inc. (United States)

We use Stripe to process subscription payments. When you add a payment method, your card details are sent directly to Stripe and stored on their servers. We receive only non-sensitive metadata (brand, last four, expiry). Stripe is certified to PCI DSS Level 1.

Stripe is based in the United States. The transfer of billing metadata to Stripe is covered by an International Data Transfer Agreement (IDTA) under UK GDPR Article 46(2)(d), executed between us and Stripe. You can review Stripe’s own privacy policy at stripe.com/gb/privacy.

3.4 Google Ireland Limited (Google AdSense/AdWords)

If you are on the Free plan and explicitly agree via the cookie consent banner shown in the app, we use Google AdSense/AdWords to show non-intrusive ads. Paid plans never show ads, and no advertising cookie or script is loaded unless you agree. Your lawful basis for this processing is your consent (Article 6(1)(a)), which you can withdraw at any time in Account settings.

Google’s ad-serving infrastructure is not confined to the UK/EU. This transfer is covered by Google’s Additional Data Processing Terms and the applicable UK international data transfer mechanism. You can review Google’s own privacy policy at policies.google.com/privacy.

3.5 TrueLayer Ltd (United Kingdom)

If you connect a bank account (§2.8), we use TrueLayer, which is authorised by the Financial Conduct Authority as an account information service provider. You give your consent to share your accounts on TrueLayer’s and your bank’s own screens. TrueLayer then reads the accounts you chose and passes us the account details and transactions described in §2.8. The access we ask for is read-only and cannot be used to make payments. When you disconnect, close your account or ask us to erase your data, we ask TrueLayer to end the consent.

4. Your rights

Under UK GDPR you have the right to:

Access — request a copy of the personal data we hold about you.
Rectification — ask us to correct inaccurate data.
Erasure — ask us to delete your data where there is no overriding legal reason to retain it (see below).
Restriction — ask us to limit how we use your data while a dispute is resolved.
Portability — receive your data in a machine-readable format.
Object — object to processing based on legitimate interests, such as the filings we keep after you close your account (§2.2). We will stop unless we need them to establish, exercise or defend a legal claim.
Withdraw consent — where we rely on consent, you can withdraw it at any time (though this does not affect processing already carried out).

4.1 Right to erasure — what we keep

We will erase your personal data on request. Some records are kept afterwards, with your name and contact details removed. This section says which ones, and for how long.

Download a copy first. The law requires you, not us, to keep the records behind your tax returns for the period set out in §2.2 (Taxes Management Act 1970 s.12B). Once we have erased your details, we can no longer tell which records were yours, so we cannot send you a copy.

When we erase your data:

Your National Insurance number is cleared. We do not keep it.
Your name, email address, phone number and sign-in are deleted or replaced.
Your transactions, income figures, tax calculations, receipts and their files, documents you uploaded for us to read, mileage journeys, investment and employment records, returns you never filed, and HMRC and bank connections are deleted. If you share a workspace with someone who is staying, the business records you kept in it stay with that workspace, and your own notes on them are removed.
Your bank connections are also ended at TrueLayer (§3.5), including any you made in a workspace you have since left. To do that, we keep the encrypted bank access token for each connection for up to 14 days after we erase your data, and use it for nothing else. It holds no account details or transactions. This relies on our legitimate interest in ending your bank consent so the feed stops (Article 6(1)(f)).
The returns and updates filed with HMRC through TaxHalo are kept: what was sent, when, HMRC’s reference, and the loss and foreign income positions declared in them. We keep them with your name and contact details removed, so that what was sent to HMRC through TaxHalo can still be shown if it is ever questioned, for the period in §2.2, and then delete them. Erasing your data does not restart that period. This relies on our legitimate interests (Article 6(1)(f)) and on the exception for legal claims (Article 17(3)(e)).
Invoices we issued to you are kept for the period in §2.4, because the law requires us to keep our own accounting records.

We will erase all other personal data within 30 days of a valid request.

5. Security

We apply the following safeguards:

All data in transit is encrypted with TLS 1.2 or higher.
Sensitive fields (HMRC tokens, National Insurance number) are encrypted at column level using AES-256 with AWS KMS customer-managed keys.
Database storage is encrypted at rest using AWS RDS encryption.
Card data never touches our systems — Stripe handles it directly in scope of PCI DSS Level 1.
We apply row-level security to ensure one tenant’s data is never accessible to another.
We report any personal data breach to the Information Commissioner’s Office (ICO) within 72 hours, as required by UK GDPR Article 33.

6. Cookies

This marketing website does not set any tracking or analytics cookies. The TaxHalo app at app.taxhalo.co.uk uses a session cookie strictly necessary for authentication.

The TaxHalo app shows occasional, non-intrusive third-party ads (Google AdSense/AdWords) to Free plan users only — paid plans are always ad-free. Advertising cookies and scripts are only loaded if you explicitly agree via the cookie consent banner shown in the app; you can change your choice at any time in Account settings. If you do not agree, no advertising cookie or script is loaded and no ad is shown. See section 3.4 below for details of Google’s role.

7. How to exercise your rights or make a complaint

To make a subject access request, request erasure, or raise any data protection concern, contact us at:

privacy@taxhalo.co.uk

We will respond within one calendar month.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO):

Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
ico.org.uk/make-a-complaint/
Tel: 0303 123 1113

8. Changes to this notice

We may update this notice from time to time. Material changes will be communicated by email at least 14 days before they take effect. The current version is always available at taxhalo.co.uk/privacy.