Privacy policy

Last updated: 6 August 2026

Who we are

GoTaxes (gotaxes.co.uk) is operated by House Medical Consultants Ltd, a company registered in England and Wales (company number 12540692), registered office Unit 4 Stirling Court Yard, Stirling Way, Borehamwood, Hertfordshire WD6 2FX. We are the data controller for the personal data described in this policy. Contact: hello@gotaxes.co.uk.

What we collect

• Account data — your email address and a hash of your password (we use argon2; we cannot see the password itself).
• Company and filing data — the company you attach, the figures you enter for your accounts and tax return, and the documents generated from them, plus submission receipts (IRmark, submission numbers).
• Money records — the income sources, transactions, categories and receipt images you add for Making Tax Digital record keeping.
• Assist workspaces — client profiles you create and the documents you upload to them, the AI summaries, checklists, email drafts, tasks and packs generated from them, and a log of every AI action.
• Public registry data— company details, officers, people with significant control and previously filed accounts, retrieved from Companies House's public API when you attach a company, prepare a confirmation statement, or import an earlier year. Imported years are stored as read-only history.
• Personal tax data — for a Self Assessment return: your employment pay and PAYE deducted, dividends, savings interest, pension and Gift Aid contributions, student loan plan and Child Benefit received, together with the calculation produced from them.
• Director identity data for confirmation statements — each director's name and date of birth. Companies House personal codes (identity-verification codes) are treated like government credentials: used once, in memory, never stored (see below).
• Documents you upload or we generate — trial balance files, receipt images, Assist uploads, and the iXBRL accounts, computations and CT600 data we produce, plus the exact figures frozen at the moment of each submission.
• E-signature records— where you send a document for signature: the signer's name and email, the time and IP address of signing, and the audit certificate produced.
• Security data — hashed session records, an audit log of filing actions, and (if you enable two-factor authentication) the shared secret your authenticator app uses.

What we deliberately do not store

Government Gateway user IDs and passwords, Companies House authentication codes, and Companies House director personal codes are used once and in memory only, to make the submission you explicitly requested. They are never written to our database or logs — there is deliberately nowhere in the system to store them. Card details are the same: they go directly to our payment provider and we never see or hold them.

How we use your data

• To provide the service: calculating your tax, generating documents, filing to HMRC and Companies House at your request, keeping MTD records, and running Assist workspaces.
• To operate your account: authentication, receipts, deadline reminders and service messages.
• To meet our legal obligations, including records we must keep as a software filer.
• We do not sell personal data, and we do not use it for third-party advertising.

Our legal bases under UK GDPR are performance of a contract (providing the service you signed up for), legal obligation (filing and business records), and legitimate interests (service security and improvement, balanced against your rights).

AI processing in Assist

Assist's AI features are currently in private beta. When they are enabled for your account and you use them, the documents in that client workspace and its structured records (deadlines, checklist, tasks) are sent to Anthropic's Claude API to generate the summaries, checklists, checks, drafts and answers you request. Anthropic processes this data as our service provider under commercial API terms and does not use it to train AI models. Nothing is sent until you take an action (upload, check, generate, ask), and every AI action is recorded in the workspace's activity log.

Who we share data with

• HMRC and Companies House — the filings you explicitly submit, sent to their official gateways.
• Service providers (subprocessors) — each bound by contract to process data only on our instructions:
  • Google Cloud Run (London, UK) — application hosting.
  • Supabase (London, UK) — database and document storage.
  • Vercel — website delivery.
  • Stripe — payments (card details go directly to Stripe; we never see them).
  • Resend — email delivery (verification, deadline reminders, e-signature invitations, and any email you explicitly choose to send from Assist).
  • Sentry — error monitoring.
  • Anthropic — Assist AI processing, when those private-beta features are enabled for your account.
  Your filing and account data is stored in the UK. Some providers (for example error monitoring and AI processing) may process data outside the UK; where they do, transfers rely on the UK International Data Transfer Addendum or equivalent safeguards.
• No one else — unless required by law.

How long we keep it

• Filings, the figures submitted with them, government receipts and their audit trail — kept as evidence of what we filed and when. The statutory duty to keep your company's own tax records (six years) rests with you, not us; our retention is purpose-based. If you close your account we do not delete these immediately — we anonymise them, detaching the records from your personal identity, and retain that evidence because we may need to show that a submission was made.
• Account details, Money records, Assist workspaces and uploaded documents — while your account is active, then deleted when you delete the account (except where they underpin a filing covered above).
• E-signature audit certificates — six years, because their purpose is to evidence who signed what and when.
• Payment records — Stripe keeps its own transaction ledger under its legal obligations; we keep the receipt reference for accounting purposes.
• Sessions, verification and password-reset tokens — deleted automatically once expired.
• Backups — kept on a rolling schedule and overwritten; data deleted from the live system disappears from backups as they cycle rather than instantly.

Security

• All traffic is encrypted in transit (TLS).
• Passwords are hashed with argon2; sessions are httpOnly secure cookies, stored server-side as hashes and revoked on logout.
• Every record is scoped to your account — data isolation between users is enforced in the application and covered by automated tests.
• Government credentials are never persisted (see above).
• Optional two-factor authentication (any authenticator app) is available on your account page, and required actions like paying, filing and exporting your data need a confirmed email address.
• Independent penetration testing is planned before general availability; this policy will state the date of the most recent test once completed.

Your rights

Under UK GDPR you can ask for access to your data, correction, deletion, restriction, portability, or object to processing. Email hello@gotaxes.co.uk from your account address and we'll respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).

If something goes wrong

If a personal data breach occurs and it is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and tell affected account holders without undue delay where the risk is high. You can report a suspected security problem to us at security@gotaxes.co.uk.

Cookies and local storage

We use no advertising or tracking cookies. The only cookies we set are your session cookie (httpOnly, so scripts cannot read it) and a signed-in flag — both removed when you log out.

Changes to this policy

We'll post any changes here and, for material changes, email account holders before they take effect.