Privacy Policy

• Transaction data (date, merchant, amount, category, VAT).
• Receipt metadata extracted by OCR (supplier, totals, dates).
• Account information (name, email, business type, UTR if you provide it).
• Usage telemetry needed to operate and improve the service.

To categorise income and expenses, calculate Income Tax and VAT estimates, support HMRC Making Tax Digital submissions, and improve the accuracy of automated suggestions.

AutoTax AI uses customer data only to:

• Categorise income and expenses.
• Generate tax estimates.
• Prepare HMRC MTD submissions.
• Provide receipt OCR analysis.
• Detect likely missing expenses.

We do NOT:

• Sell data.
• Share data without your consent.
• Share your uploaded documents with anyone else — only you can access your Document Vault.

Receipts, bank statements and invoices you upload are held in a private storage bucket on our managed backend (UK/EU region), encrypted at rest by the storage platform (AES-256) and encrypted in transit over HTTPS. The bucket is not public: files are only reachable via short-lived signed URLs generated for your authenticated session, and row-level security scopes every document to your account so no other user — and no unauthenticated request — can list or download them. You can download or delete any document at any time from the Documents page, and deleting your account removes every file from storage. We do not currently sync uploads to Google Drive, OneDrive or any other external cloud storage; those integrations are on the roadmap and are clearly labelled as "coming soon" wherever they appear in the app.

Data is stored securely in our managed database (UK/EU region) with encryption in transit and at rest. Access is restricted to the authenticated account holder via row-level security.

We process personal data under the UK GDPR and the Data Protection Act 2018. Tax-related metadata may be retained for up to six years in line with HMRC record-keeping requirements.

• Right of access — request a copy of the data we hold about you.
• Right to erasure — request deletion (subject to HMRC retention rules).
• Right to portability — export your data in a machine-readable format.
• Right to object or restrict certain processing.

Contact privacy@autotaxai.co.uk to exercise any of these rights.

We share data only with the providers required to deliver the service:

• HMRC APIs (Self Assessment and VAT submissions).
• Open Banking providers (if you connect a bank feed).
• Stripe (subscription billing).
• Supabase (managed database, authentication and Document Vault storage, UK/EU region).