Privacy notice
What we collect, why, and what happens to it. Written to match the software as it actually works.
Version 0.3 — 7 November 2026
Status of this document
This is a working version published so that it describes the software as it actually behaves today. It has not yet been through independent legal review and will be revised before the service is offered commercially. It makes no claim of HMRC recognition.
Who operates #ATaxMate
#ATaxMate is a trading name of ATAXMATE LTD, a company registered in England and Wales (company number 17562784), which operates it. Registered office: 82a James Carter Road, Bury St. Edmunds, United Kingdom, IP28 7DE.
Support and data requests: admin@ataxmate.co.uk
What we collect and why
| Data | Purpose | Lawful basis | Kept |
|---|---|---|---|
| Account details Your name, email address and a one-way hash of your password. The password itself is never stored. | To create and secure your account and to send verification, password-reset and invitation emails. | Performance of the contract with you. | Until you delete your account. Your name can be corrected at any time under Settings → Your data. |
| Organisation and business records Organisation name, business name, VAT registration number, and any client reference or contact details you enter. | To identify which VAT registration each return belongs to and to call HMRC for that registration. | Performance of the contract with you. | Until an owner closes the organisation. |
| HMRC authorisation tokens The OAuth access and refresh tokens HMRC issues when you authorise #ATaxMate. Your Government Gateway user ID and password are entered on HMRC’s website only and never reach us. | To retrieve your VAT obligations and submit the returns you approve. | Performance of the contract with you. | Encrypted (AES-256-GCM) until you disconnect the business, the authorisation expires, or the account is deleted. Disconnecting deletes the tokens. |
| VAT figures and uploaded files The nine VAT return boxes, the spreadsheet or CSV cells they came from, a SHA-256 fingerprint of the file, and the declaration and HMRC receipt for each submission. | To check, submit and evidence each VAT return and to keep a digital link between your records and what was filed. | Performance of the contract with you, and your legal obligation to keep digital VAT records. | Until an owner closes the organisation. Filing evidence is not deleted individually while the organisation is open, because it is the digital link between your records and what was filed. The spreadsheet cells kept while a column-mapping question is outstanding are removed as soon as the file is applied or discarded. |
| Fraud-prevention data sent to HMRC Your public IP address and connection port, a random device identifier stored in a cookie, browser and screen characteristics, time zone, and a reference to your #ATaxMate user ID. These are sent to HMRC as headers with every HMRC request, as HMRC requires of all MTD software. | HMRC requires this data to detect fraud. #ATaxMate does not use it for analytics or advertising. | HMRC’s legal requirement on software that connects to its APIs. | The current values are held in a short-lived cookie and regenerated each session; the device identifier persists so HMRC can recognise the same device. HMRC’s own retention applies once sent. |
| Sign-in and audit records Sign-in time, IP address and browser identifier for each session, and a tamper-evident log of significant actions (sign-ins, HMRC connections, imports, filings). | To secure the account, investigate problems and evidence who filed what. | Our legitimate interest in security, and your legal obligation to keep VAT records. | Sign-in records until you delete your account. The organisation’s audit log until the organisation is closed; if you leave or delete your account while it continues, entries you made keep your user ID only and lose your IP address and browser identifier. A single record that an organisation was closed or an account deleted is kept. |
Cookies
#ATaxMate sets three cookies, all essential to operating the service: a session cookie that keeps you signed in, a device identifier and a short-lived fraud-prevention cookie, both required by HMRC. There are no advertising, analytics or third-party cookies, and no tracking scripts.
Where data is stored and who can see it
Data is stored in a PostgreSQL database on servers in the United Kingdom (London) region of Amazon Web Services, over encrypted connections. HMRC receives the data described above when you authorise a connection or submit a return. AWS also processes transactional account and filing emails through Amazon Simple Email Service (SES) in the AWS London region over encrypted connections. Delivery to the recipient’s mail server requires TLS.
Access within #ATaxMate is limited to the organisation that owns each record, enforced on the server for every request. Operator access to the database is restricted to the people who run the service and is used only to operate and support it.
Your rights
Under UK GDPR you can access, correct, export and delete your personal data. Signed in, go to Settings → Your data to:
- download everything we hold about you, and — as an owner or admin — everything the organisation holds, as a JSON file;
- correct your name;
- delete your account. Organisations where you are the only member are closed with it; where others belong, only your access is removed;
- as an owner, close the organisation: its businesses, HMRC authorisations, VAT returns and receipts, uploaded files and audit log are deleted for everyone.
Both deletions ask for your password again and cannot be undone. HMRC keeps its own copy of every return submitted to it, and you remain responsible for keeping your VAT records for the period the law requires — export a copy before closing an organisation. You can withdraw HMRC authorisation at any time by disconnecting a business or through your HMRC account.
To change your email address, or for anything you cannot do yourself, contact the support address above. Requests are answered within one month. Local backups are scheduled for deletion after 14 days. Off-site backup objects expire after 90 days, followed by 30 days for noncurrent versions; storage-provider deletion runs asynchronously. These copies are encrypted and access-restricted. They are used for recovery or verification, and deletion requests must be reapplied before recovered data is returned to service.
You can complain to the Information Commissioner’s Office at ico.org.uk.
Security
How authorisation tokens are protected and how to report a vulnerability is described on the security and trust page.