Privacy Policy

Smart Tax Digital is Making Tax Digital for Income Tax software operated by Smart Tax Digital Ltd, a company registered in England and Wales (company number [Companies House number]), whose registered office is at [Registered office address]. We’re headquartered in Exeter, United Kingdom.

For the personal data described in this policy we are the data controller — we decide why and how it’s used. We are registered with the Information Commissioner’s Office (ICO) under registration number [ICO registration number].

Questions about this policy or your data: privacy@smarttaxdigital.com.

This policy covers our public website and the Smart Tax Digital app, including the connection you make between the app and HMRC. It applies to:

• people who visit our website
• people who create an account and use the app
• accountants and bookkeepers invited to help with someone’s account
• people who apply to be a growth partner
• anyone who emails or otherwise contacts us

If you use our invoicing and quotes features, you’ll store details about your own customers (names, email addresses, postal addresses). For that data you are the controller and we process it only on your instructions, to create and send the documents you ask us to. You are responsible for having a lawful basis to hold and contact your customers.

If you’re one of our users’ customers and have a question about your details, please contact the business that invoiced you first — they decide how your information is used. We’ll help them answer.

If you give us information about someone else — for example by inviting an accountant or adding a customer — please make sure you’re allowed to, and that they know you’re doing it.

We do not use analytics or advertising trackers, and we do not sell your data to anyone.

You don’t have to give us any of this, but some of it is needed for the service to work — for example, we can’t send anything to HMRC without your National Insurance number.

• HMRC — once you connect, the businesses HMRC holds for you, your filing deadlines and their status, HMRC’s tax calculations, and HMRC Assist prompts.
• Google — your name and email address, if you choose to sign in with Google.
• Square — confirmation that your payment went through, and its reference.
• Account owners — if you’re an accountant, the person who invites you gives us your email address and chooses your access level.

HMRC requires all software that connects to its Making Tax Digital services to send “fraud prevention headers” with each request. This is a legal requirement and helps protect you from criminals using your identity. With every request we send to HMRC on your behalf, we include:

• your public IP address and port, and the time it was recorded
• a device identifier stored in a cookie on your browser
• your browser’s user agent (browser and operating system version)
• your screen size, colour depth and browser window size
• your time zone
• an identifier for your account in our app
• how you connected (through a web browser) and details of our own servers and software version

HMRC uses this data under its own privacy notice. You can read about it on GOV.UK.

We only rely on legitimate interests where the use is necessary and doesn’t override your rights.

Marketing: we don’t send marketing emails. If we ever do, we’ll only send them where the law allows or you’ve agreed, and every one will let you unsubscribe. Service emails — about your account or its security — aren’t marketing, and will still be sent.

Consent: we don’t currently rely on your consent for anything. If that changes, we’ll ask first, and you’ll be able to withdraw it at any time.

We don’t need any “special category” data — such as health, religion, ethnicity, political views or sexual orientation — to provide Smart Tax Digital. Please don’t include it in free-text fields like transaction descriptions or customer notes.

We don’t make decisions about you by automated means that have legal or similarly significant effects. Your tax calculations and HMRC Assist prompts are produced by HMRC, not by us. The app may suggest values from your own earlier entries to save you typing, but you always choose what to keep.

• HMRC — only what you ask us to submit or retrieve, plus the fraud prevention data above.
• Google (Firebase) — sign-in and our database, hosted in [Firestore region, e.g. europe-west2 (London)].
• Our hosting provider — [VPS hosting provider and server location], which runs the app’s servers.
• Square — to process your access-fee payment.
• Resend — to deliver the emails we send, including invoices and quotes to your customers.
• People you choose — accountants or bookkeepers you invite, and customers you send invoices or quotes to.
• Our professional advisers — such as lawyers, accountants and insurers, where they need it to advise us.
• Authorities — if the law requires it, for example HMRC, the ICO, a court or the police.
• A buyer or successor — if our business is sold, merged or restructured, your data may pass to the new owner, who must keep protecting it as this policy describes.

Our service providers only process your data on our instructions, under written contracts that require them to keep it confidential and secure, to help us respond to your rights requests, and to delete or return it when they stop working for us.

Some of our providers may process data outside the UK. Where they do, we rely on a UK adequacy decision or on safeguards approved under UK law, such as the International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses. Contact us for details of the safeguards that apply.

• HMRC access tokens are encrypted with AES-256-GCM before they are stored.
• All traffic between your browser, our servers and HMRC is encrypted in transit (TLS).
• Our database can only be read by our servers — your browser has no direct access to it.
• Staff access to account data is limited by role, staff are bound by confidentiality, and their actions are recorded in an audit log.
• Accountants you invite can never connect to HMRC, submit anything or view your HMRC details, whatever access level you give them.

No system can be guaranteed completely secure, so we keep reviewing these measures. If you think your account has been compromised, or you’ve found a security problem, email security@smarttaxdigital.com — our Security page explains what to do. If a breach affects your personal data, we will notify the ICO and HMRC within 72 hours where required, and tell you without undue delay if it is likely to put you at high risk.

We keep your data for as long as you have an account. If you ask us to delete your account, we permanently delete your account and all the records linked to it — including your transactions, submission copies, invoices, your customers’ details and HMRC connection — within 30 days. Copies in our providers’ backups are overwritten within [backup retention period, e.g. 35 days].

Your own record-keeping duty: HMRC requires you to keep your business records for at least 5 years after the 31 January deadline for the tax year they relate to. Please export anything you need (for example, CSV reports from the Reports page) before asking us to delete your account.

Your customers’ details are kept until you delete them or close your account. Messages you send us are kept for as long as we need them to deal with your request and any follow-up. Growth-partner applications are kept for as long as needed to review them and manage any partnership. Server logs are kept for a limited period for security.

Under UK data protection law you have the right to:

• access the personal data we hold about you
• have inaccurate data corrected
• have your data deleted
• restrict or object to how we use it
• receive your data in a portable format
• withdraw any consent you have given
• not be subject to decisions made solely by automated means that significantly affect you

To use any of these rights, email privacy@smarttaxdigital.com. We may need to confirm your identity first. We’ll respond within one month — or, if a request is complex, tell you within that month that we need up to two months more. Some rights have legal limits; if we can’t do everything you ask, we’ll explain why.

You can stop our access to HMRC at any time by disconnecting in your HMRC online account, or by asking us to delete your account.

If you’re unhappy with how we’ve handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk, on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

We only use cookies and browser storage that are needed for the service to work, so we don’t ask for consent. Our public website stores nothing on your device unless you choose light or dark mode, and we don’t use analytics or advertising cookies.

Our Cookie Notice has the full list, including what each item holds and the cookies Google, HMRC and Square set on their own pages.

Smart Tax Digital links to other sites — GOV.UK, HMRC’s own sign-in pages, Google sign-in and Square’s payment page. When you use them, their own privacy notices apply, not this one.

• Keep the information you give us accurate and up to date.
• Keep your sign-in details safe, and tell us straight away if you think someone else has used your account.
• Only add other people’s details — such as customers or an accountant’s email — when you’re allowed to.

Smart Tax Digital is for adults managing their own tax affairs. It isn’t intended for anyone under 18.

We’ll update this page when our practices change and revise the date at the top. If a change significantly affects how we use your data, we’ll tell you by email or in the app before it takes effect.

Smart Tax Digital Ltd, headquartered in Exeter, United Kingdom.

• Your data and this policy: privacy@smarttaxdigital.com
• Help with your account: support@smarttaxdigital.com
• Security issues: security@smarttaxdigital.com