Skip to main content

Privacy policy

The short version: we collect only what the service needs, we never store your government credentials, we don't sell data, and your documents are never used to train AI models.

Last updated: 2 September 2026

Who we are

GoTaxes (gotaxes.co.uk) is operated by House Medical Consultants Ltd, a company registered in England and Wales (company number 12540692), registered office Unit 4 Stirling Court Yard, Stirling Way, Borehamwood, Hertfordshire WD6 2FX. We are the data controller for the personal data described in this policy. Contact: hello@gotaxes.co.uk.

What we collect

  • Account data — your email address and a hash of your password (we use argon2; we cannot see the password itself).
  • Company and filing data — the company you attach, the figures you enter for your accounts and tax return, and the documents generated from them, plus submission receipts (IRmark, submission numbers).
  • Money records — the income sources, transactions, categories and receipt images you add for Making Tax Digital record keeping.
  • Assist workspaces — client profiles you create and the documents you upload to them, the AI summaries, checklists, email drafts, tasks and packs generated from them, and a log of every AI action.
  • Public registry data— company details, officers, people with significant control and previously filed accounts, retrieved from Companies House's public API when you attach a company, prepare a confirmation statement, or import an earlier year. Imported years are stored as read-only history.
  • Personal tax data— for a Self Assessment return: your name, personal UTR, National Insurance number and date of birth; each employment's employer name, PAYE reference, pay and tax deducted, P11D benefits, and — for close-company directorships — the company's registration number, your shareholding and dividends taken from it; dividends and savings interest; State and private pension income and tax deducted; pension and Gift Aid contributions; student loan plan; Child Benefit received; your taxpayer country (for the Welsh marker); and the calculation produced from all of it.
  • Your spouse's details for Marriage Allowance — if you transfer your allowance, HMRC requires your spouse or civil partner's name, National Insurance number, date of birth and your marriage/civil-partnership date. We use these only to complete that section of your return; by entering them you confirm you're entitled to share them for this purpose.
  • Prefill suggestions— we may offer to reuse details GoTaxes already holds (your companies as employers, last year's return). Every suggestion shows its source and is applied only when you confirm it.
  • Director identity data for confirmation statements — each director's name and date of birth. Companies House personal codes (identity-verification codes) are treated like government credentials: used once, in memory, never stored (see below).
  • Documents you upload or we generate — trial balance files, receipt images, Assist uploads, and the iXBRL accounts, computations and CT600 data we produce, plus the exact figures frozen at the moment of each submission.
  • E-signature records— where you send a document for signature: the signer's name and email, the time and IP address of signing, and the audit certificate produced.
  • Security data — hashed session records, an audit log of filing actions, and (if you enable two-factor authentication) the shared secret your authenticator app uses.
  • Fraud-prevention data for Making Tax Digital— when you use the Making Tax Digital features, HMRC legally requires filing software to send fraud-prevention headers with every API call. We collect these at request time and forward them to HMRC: your device's timezone; its screen size, scaling factor and colour depth; your browser window size; your browser's user agent and Do-Not-Track setting; your public IP address and the time we observed it; a device identifier we generate for each HMRC connection; your GoTaxes user id; the time of your last two-factor sign-in (if two-factor authentication is on); and our own server's public IP address, together with our software's name and version. Apart from that connection identifier and ordinary request logs, we do not store this data ourselves. See HMRC's fraud prevention guidance (opens in a new tab).

What we deliberately do not store

Government Gateway user IDs and passwords, Companies House authentication codes, and Companies House director personal codes are used once and in memory only, to make the submission you explicitly requested. They are never written to our database or logs — there is deliberately nowhere in the system to store them. Card details are the same: they go directly to our payment provider and we never see or hold them.

How we use your data

  • To provide the service: calculating your tax, generating documents, filing to HMRC and Companies House at your request, keeping MTD records, and running Assist workspaces.
  • To operate your account: authentication, receipts, deadline reminders and service messages.
  • To meet our legal obligations, including records we must keep as a software filer.
  • We do not sell personal data, and we do not use it for third-party advertising.

Our legal bases under UK GDPR are performance of a contract (providing the service you signed up for), legal obligation (filing and business records), and legitimate interests (service security and improvement, balanced against your rights).

AI processing in Assist

Assist's AI features are currently in private beta. When they are enabled for your account and you use them, the documents in that client workspace and its structured records (deadlines, checklist, tasks) are sent to Anthropic's Claude API to generate the summaries, checklists, checks, drafts and answers you request. Anthropic processes this data as our service provider under commercial API terms and does not use it to train AI models. Nothing is sent until you take an action (upload, check, generate, ask), and every AI action is recorded in the workspace's activity log.

Who we share data with

  • HMRC and Companies House — the filings you explicitly submit, sent to their official gateways.
  • HMRC (fraud-prevention headers)— with every Making Tax Digital API call, the fraud-prevention data listed above (device, browser, public IP address, connection identifier, user id, two-factor time and our server's IP address), which HMRC requires by law from all filing software.
  • Service providers (subprocessors) — each bound by contract to process data only on our instructions:
    • Google Cloud Run (London, UK) — application hosting.
    • Supabase (London, UK) — database and document storage.
    • Vercel — website delivery.
    • Stripe — payments (card details go directly to Stripe; we never see them).
    • Resend — email delivery (verification, deadline reminders, e-signature invitations, and any email you explicitly choose to send from Assist).
    • Sentry — error monitoring.
    • Anthropic — Assist AI processing, when those private-beta features are enabled for your account.
    Your filing and account data is stored in the UK. Some providers (for example error monitoring and AI processing) may process data outside the UK; where they do, transfers rely on the UK International Data Transfer Addendum or equivalent safeguards.
  • No one else — unless required by law.

How long we keep it

  • Filings, the figures submitted with them, government receipts and their audit trail — kept as evidence of what we filed and when. The statutory duty to keep your company's own tax records (six years) rests with you, not us; our retention is purpose-based. If you close your account we do not delete these immediately — we anonymise them, detaching the records from your personal identity, and retain that evidence because we may need to show that a submission was made.
  • Account details, Money records, Assist workspaces and uploaded documents — while your account is active, then deleted when you delete the account (except where they underpin a filing covered above).
  • E-signature audit certificates — six years, because their purpose is to evidence who signed what and when.
  • Payment records — Stripe keeps its own transaction ledger under its legal obligations; we keep the receipt reference for accounting purposes.
  • Sessions, verification and password-reset tokens — deleted automatically once expired.
  • Backups — kept on a rolling schedule and overwritten; data deleted from the live system disappears from backups as they cycle rather than instantly.

Security

  • All traffic is encrypted in transit (TLS).
  • Passwords are hashed with argon2; sessions are httpOnly secure cookies, stored server-side as hashes and revoked on logout.
  • Every record is scoped to your account — data isolation between users is enforced in the application and covered by automated tests.
  • Government credentials are never persisted (see above).
  • Optional two-factor authentication (any authenticator app) is available on your account page, and required actions like paying, filing and exporting your data need a confirmed email address.
  • Independent penetration testing is planned before general availability; this policy will state the date of the most recent test once completed.

Your rights

Under UK GDPR you can ask for access to your data, correction, deletion, restriction, portability, or object to processing. Email hello@gotaxes.co.uk from your account address and we'll respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).

If something goes wrong

If a personal data breach occurs and it is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and tell affected account holders without undue delay where the risk is high. You can report a suspected security problem to us at security@gotaxes.co.uk.

Cookies and local storage

We use no advertising or tracking cookies. The only cookies we set are your session cookie (httpOnly, so scripts cannot read it) and a signed-in flag — both removed when you log out.

Changes to this policy

We'll post any changes here and, for material changes, email account holders before they take effect.