Skip to content
Back to home
Legal

Privacy Policy

Last Updated: 10 October 2026

1. Introduction

By accessing or using the EasyTaxer software ("the Service"), provided by Agile Release Limited (of which EasyTaxer is a trading name), a company registered in England and Wales under company number 13237670, with UK VAT registration number 373385181 ("the Company", "we", "us", or "our"), we are committed to protecting the privacy and security of your personal and financial data. This policy explains how we handle your data when you use our Making Tax Digital (MTD) Income Tax software.

2. Data We Collect

We collect the following types of information to provide our tax submission services:

  • Identity Data: Name, business name, email address, and contact details.
  • HMRC Identifiers: Your National Insurance Number (NINO), Unique Taxpayer Reference (UTR), and Government Gateway credentials (processed securely via OAuth).
  • Financial Data: Income records, expense receipts, bank transaction details, and tax liability calculations.
  • Passkey Data: If you add a passkey to your account, we store its public key, a random credential identifier, the name you give the device, when it was added and last used, and a usage counter. The private key never leaves your device, and fingerprint or face data never reaches us. Passkeys are erased together with the rest of your account data when your account is permanently deleted (see section 7, Data Retention).
  • User Content: Supporting documents (PDFs, images) you upload via our secure messaging or storage features.
  • How You Heard About Us (optional): When you register, we ask how you heard about EasyTaxer. You do not have to answer. If you do, we keep your answer with your account and use it only to understand how people find EasyTaxer. That is part of improving our service, and our lawful basis for it is legitimate interests (see section 3, Legal Basis for Processing). It is a question you answer, not tracking: it sets no cookie.
  • Social Sign-In Data: If you choose to sign in with a social provider (such as Google), we store the provider’s name, your unique account identifier at that provider, and the email address the provider asserts for you, so we can recognise your account on later sign-ins. We never receive or store your provider password. These linked identities are erased together with the rest of your account data when your account is permanently deleted (see section 7, Data Retention).
  • Website Usage Data (only if you accept analytics cookies): How you use the public pages of our website, collected by Google Analytics — see section 6.5. We collect none of it if you reject analytics cookies or do not choose.

3. Legal Basis for Processing

Under Article 6 of the UK GDPR we must have a lawful basis for processing your personal data. The bases we rely on are:

  • Performance of a contract (Art. 6(1)(b)) — for the data we need to provide the Service to you, including your account details, HMRC identifiers (NINO, UTR), bank transaction records, and financial data used to prepare and submit your tax obligations.
  • Compliance with a legal obligation (Art. 6(1)(c)) — for retaining your HMRC submission evidence, fraud-prevention data, and billing records for approximately 6 years, in line with HMRC record-keeping requirements (see section 7, Data Retention).
  • Consent (Art. 6(1)(a)) — for analytics cookies on our public website (Google Analytics, which we use only if you accept it in our cookie banner — see section 6.5) and any future marketing communications. You can withdraw your consent to analytics cookies at any time with the “Cookie settings” link at the bottom of our website pages, and to marketing in your account settings.
  • Legitimate interests (Art. 6(1)(f)) — for security monitoring, fraud prevention (including making sure our free trial is used only once per person), investigating and fixing problems you report to us, and service improvement, where these do not override your rights and freedoms. Website analytics does not rely on legitimate interests: it runs only with your consent.

4. How We Use HMRC Data

Our software integrates directly with HMRC APIs to help you comply with UK tax law. We use this connection to:

  • Retrieve your current tax obligations and liabilities.
  • Submit quarterly updates and your final declaration on your behalf.
  • View your tax calculation and payment history.

Authorization: We only access your HMRC data after you provide explicit authority via the official HMRC OAuth 2.0 authentication process. We do not view or store your Government Gateway password.

5. Data Storage and Security

We take the security of your data seriously and employ multiple layers of protection:

  • Encryption in Transit: All data transmitted between your browser, our servers, and HMRC is encrypted using TLS 1.2/1.3 (HTTPS).
  • Encryption at Rest: All personal data, financial records, and uploaded files are stored on encrypted storage volumes using infrastructure-level AES-256 encryption at rest provided by our hosting platform (IONOS).
  • Data Location: Your data is hosted on IONOS Cloud infrastructure located in the United Kingdom or the European Economic Area (EEA). Both the UK and the EEA recognise each other under reciprocal adequacy decisions, so data may move between them without additional safeguards. Apart from Google Analytics, which runs only if you accept analytics cookies (section 6.5), we do not transfer your personal data outside the UK or EEA.

Reporting a security concern. If you believe you have found a security vulnerability or that your data may have been compromised, please report it to us immediately at info@easytaxer.com or via the in-app support feature. We investigate all reports promptly. Where a personal-data breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it, and inform affected users without undue delay where required.

6. Data Sharing and Sub-processors

6.1 HMRC

We share your financial data with HM Revenue & Customs (HMRC) solely to fulfil your Making Tax Digital obligations. Submissions are made via HMRC's official APIs after your explicit OAuth 2.0 authorisation.

6.2 Sub-processors

To deliver our service we engage a small number of trusted third-party processors. Each is bound by a data processing agreement and may only use your data on our documented instructions.

  • IONOS Cloud — Hosting and encrypted data storage. Location: UK / EEA.
  • Hostinger — Transactional and account email delivery (registration, password reset, submission confirmations, etc.). Location: EU (Lithuania).

This list will be kept current. If we add a new sub-processor or materially change how an existing one is used, we will update this policy and, where required, obtain your consent before the change takes effect.

6.3 No sale of personal data

We do not sell, trade, or rent your personal information to any third party. Data is shared only with the parties listed in this section, and only for the purposes described.

6.4 Videos on our help pages and guides (YouTube)

Our help pages (easytaxer.com/help) and guides (easytaxer.com/guides) show each video as a still picture with a play button, and nothing is loaded from YouTube until you press play. If you press play, your browser loads the video player directly from YouTube's privacy-enhanced domain (youtube-nocookie.com), which is operated by Google. Google then receives your IP address and browser information and may store information on your device; it does so under Google's own privacy policy, not on our instructions. We do not send Google any of your EasyTaxer account or tax data, and Google is not one of our sub-processors. If you prefer not to connect to Google, do not press play: every one of these pages also sets out the video's steps in full as text.

6.5 Website analytics (Google Analytics) — only with your consent

If you choose “Accept analytics cookies” in our cookie banner, the public pages of easytaxer.com (our home page, guides, help pages and legal pages) load Google Analytics 4, a service provided by Google (Google LLC and its group companies). Nothing is loaded from Google before you accept, and nothing at all if you reject or never choose; if no cookie banner appears on your first visit, website analytics is switched off. What Google Analytics collects: the pages you visit, the page you came from, the time of your visit, your device type, browser and screen size, and an approximate location (city or region) that Google works out from your IP address. Google Analytics 4 does not log or store your IP address itself. It places the _ga cookies described in our Cookie Policy. We use the results, in aggregate, only to understand which pages are useful and to improve the website. We do not use Google Analytics inside the EasyTaxer application after you sign in, and we never send it your account, HMRC or tax data. We do not allow Google to use this data for advertising: Google’s advertising consent signals are always set to “denied”, and Google signals and ad personalisation are switched off. Google keeps Google Analytics data for 2 months and then deletes it automatically. Google may process this data in the United States; Google LLC is certified under the UK Extension to the EU–US Data Privacy Framework, which the UK recognises as providing adequate protection. Our lawful basis is your consent (see section 3), which you can withdraw at any time with the “Cookie settings” link at the bottom of every page; if you do, Google Analytics stops on that page straight away and its _ga cookies are deleted.

7. Data Retention

How long we keep your data depends on what it is, and on whether you have asked us to delete your account.

While you have an account. We keep your account and the data in it for as long as the account exists. If you cancel your subscription, or your paid term ends and you do not renew, your account stays — read-only once your paid term has ended — until you re-subscribe or delete it. We do not delete an account because its subscription ended. You remain responsible for keeping your own Self Assessment records for at least 5 years after the 31 January submission deadline.

When you delete your account. Your account stops working straight away: you are signed out on every device, we delete our connection to your HMRC record, and we send you one email to confirm. We keep everything else for 60 days, so you can change your mind: sign in within 60 days and you can restore your account exactly as it was (you will need to connect to HMRC again). After 60 days we permanently delete your account and the data in it. You can also remove EasyTaxer’s access in your HMRC account at any time.

What we keep after that, and why.

  • Compliance and billing records — your HMRC submission evidence, fraud-prevention header data, and our own invoices and credit notes — are retained for approximately 6 years, because the law requires us to keep them (UK GDPR Art. 17(3)(b) and HMRC record-keeping requirements).
  • A record that your National Insurance number has used EasyTaxer: when it was first connected to HMRC, and whether its free trial, its first year’s payment and its refund have been used. When we permanently delete your account, we replace the number in this record with a coded form that does not show it, and we keep the record for 6 years after that, so that the free trial can be used only once per person. If an accountant added you as a client, the record of the client place they paid for is kept in the same way. Our lawful basis is legitimate interests (see section 3, Legal Basis for Processing).
  • Support messages you sent us through the in-app support feature, and any files you attached to them, are kept so that we can still investigate and fix a problem you reported. When your account is permanently deleted, we remove your email address from each message’s sender details and remove the link to your account, but what you wrote and any files you attached are kept as you sent them (so anything personal you included in them stays until they are erased). We erase them completely 12 months after you asked us to delete your account. This does not reach the email notification of your message, including your email address, that our support mailbox received when you sent it. Our lawful basis is legitimate interests (see section 3, Legal Basis for Processing).

Logs and backups. We keep technical logs — records our systems write as they run, including the IP address and browser details of each request — on our servers for 30 days and in encrypted backups for up to 1 year, then delete them. Our application logs hide your National Insurance number, email address, HMRC business IDs and postcode; logs written before we started hiding these details can still show them until they are deleted. We keep encrypted backups of our databases and stored files for 60 days in normal running, so your data leaves those backups no later than 60 days after we permanently delete it from our systems. If we ever have to restore our systems from a backup, an account that was deleted after that backup was taken is not brought back into use: we delete it again.

You may also ask us to delete your account and associated data by contacting support. The compliance and billing records above may be retained for the period the law requires, and support messages are kept for 12 months as described above.

8. Your Rights

Under the UK GDPR and Data Protection Act 2018, you have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate data.
  • Request deletion of your data ("Right to be forgotten").
  • Object to or restrict certain processing.
  • Receive your data in a portable format.
  • Withdraw your consent for HMRC integration, or any other consent-based processing, at any time.

To exercise any of these rights, contact us at info@easytaxer.com. We will respond within one month.

9. Right to Lodge a Complaint

You have the right to lodge a complaint with the UK supervisory authority for data protection, the Information Commissioner's Office (ICO), if you believe we have not handled your personal data in accordance with the law:

We would, however, appreciate the chance to address your concerns first — please contact us before approaching the ICO.

10. Contact Us

If you have any questions about this Privacy Policy, please contact us via the support feature within the application or email us at: info@easytaxer.com

Data protection contact / responsible individual. The person responsible for data protection and HMRC-integration compliance at Agile Release Limited is Fatih Ucar (Director). You can reach our data protection contact at info@easytaxer.com.