Privacy notice

TaxPip is run by [the operator's legal name], of [the operator's postal address]. For anything about your data, write to [a support email address].

• Your email address and your role in an account, so you can sign in.
• A short-lived record of each sign-in code that is asked for (hashed), and each browser you are signed in on (a hashed token, the name the browser gives itself, and dates).
• The company's bank statements, transactions and descriptions. These name the people and businesses the company pays or is paid by, who are not users of the service.
• The books, the tax figures and the filing packs.
• A record of who changed what, by an identifier rather than a name.
• If billing is switched on, the payment provider's customer and subscription identifiers. Card numbers never reach this service.

To keep the company's books and prepare its filings for you, which is the service you asked for. Nothing is held for advertising, and nothing is sold.

• Cloudflare, which hosts the service: its Workers, database and file storage.
• An AI model, through Cloudflare's AI Gateway, which receives transaction descriptions to suggest categories. Logging of what is sent is switched off unless somebody turns it on to find a fault.
• Companies House, which is asked for the public details of a company you add.
• The payment provider, if billing is switched on.
• The people you add to your account, who can see the account's books according to their role.

One: the cookie that keeps your browser signed in. There are no advertising or analytics cookies and no third-party scripts.

• Accounting records are kept, because the law requires companies to keep them for years.
• Sign-in codes are cleared a day after they run out, and sessions a week after they end.
• Payment events are cleared after 90 days, and reminder markers after 400 days.
• Files in storage that nothing refers to are cleared after a day.

Which retention periods apply to the filings sent to an authority has still to be decided.

• An owner can download a copy of everything held for the account.
• Anybody can ask for their own details to be erased from the account page. That removes them from every account, ends every sign-in and replaces their email address with a placeholder. Records that name them only by identifier stay, because the trail has to, and no longer lead to anyone.
• The only owner of an account has to confirm that the account's records are kept and that nobody can then sign in to it.

For anything else, write to [a support email address].