Privacy Policy

SoleTax is operated by SoleTax Ltd, registered in England and Wales (company number: [TO BE ADDED]).

For the purposes of UK data protection law, SoleTax Ltd is the data controller — meaning we decide how and why your personal data is processed.

• Registered address: [TO BE ADDED ON REGISTRATION]
• Email: hello@soletax.uk
• ICO registration number: [TO BE ADDED ON REGISTRATION]

If you have any questions about this policy or how we handle your data, please email hello@soletax.uk.

We collect the following categories of personal data when you use SoleTax:

Account data

• Name and email address (provided when you sign up)
• Encrypted password

Business and tax data

• Business name and type
• Unique Taxpayer Reference (UTR) number
• National Insurance number (where required for MTD submissions)
• Tax year preferences and CIS status

Financial data

• Income records you enter (amounts, dates, descriptions, categories)
• Expense records you enter (amounts, dates, descriptions, HMRC categories)
• Mileage trips (dates, distances, descriptions)

Payment data

• Billing details are handled directly by Stripe, our payment processor. SoleTax Ltd does not store your card number or full payment details — we only receive a payment confirmation and your subscription status from Stripe.

Usage data

• How you navigate and use the app (page views, feature usage, session duration)
• Device type, browser and operating system
• IP address

HMRC connection data

• When you connect SoleTax to HMRC's Making Tax Digital service, we store the access tokens required to submit returns on your behalf. These are encrypted and never shared.

We collect your data in the following ways:

• Directly from you — when you sign up, complete onboarding, or enter financial records.
• Automatically — usage and device data is collected as you use the app, via analytics tools.
• From third parties — Stripe provides us with payment confirmation; HMRC's API provides confirmation of successful submissions.

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following:

Performance of a contract — the majority of our processing is necessary to provide you with the SoleTax service you signed up for. This includes storing your financial records, processing your MTD submissions, and managing your account and subscription.

Legal obligation — we may be required to retain certain data to comply with financial, tax or regulatory obligations under UK law.

Legitimate interests — we process usage data to understand how the product is being used, to fix bugs, and to improve the service. We have carried out a balancing test and are satisfied this does not override your rights and interests.

Consent — where we send you optional marketing communications (such as product updates or tips), we will ask for your consent first. You can withdraw consent at any time by unsubscribing or emailing hello@soletax.uk.

We retain your data for as long as you have an active SoleTax account. After your account is closed or your subscription cancelled:

• Your account and financial data is retained for 90 days, during which you can reactivate your account and access your data.
• After 90 days, your data is permanently deleted from our systems.
• You can request earlier deletion at any time by emailing hello@soletax.uk.

Some data may be retained longer where we are required to do so by law — for example, records relating to financial transactions may be kept for up to 6 years in line with HMRC guidance.

We do not sell your personal data. We share it only with the trusted third-party service providers necessary to operate SoleTax:

Supabase — our database and authentication provider. Your account data and financial records are stored securely on Supabase infrastructure. Supabase is SOC 2 Type II certified. Data is stored in the EU (Frankfurt). Supabase Privacy Policy.

Vercel — our hosting provider. Vercel serves the SoleTax application and may process request data (such as IP addresses) in the course of doing so. Vercel Privacy Policy.

Stripe — our payment processor. Stripe processes subscription payments on our behalf and is responsible for the security of your payment card data. Stripe is PCI DSS Level 1 certified. Stripe Privacy Policy.

PostHog — our product analytics provider. We use PostHog to understand how the app is used. Data is anonymised and aggregated where possible and is hosted in the EU. PostHog Privacy Policy.

HMRC — when you submit quarterly MTD returns, your financial data is transmitted to HMRC via their Making Tax Digital API. This is the core purpose of the service and you authorise this transmission when you connect your SoleTax account to HMRC.

We may also disclose your data where required by law — for example, in response to a court order or a request from a regulatory authority.

Some of our third-party providers (including Vercel and Stripe) are based in or operate infrastructure in the United States. Where your data is transferred outside the UK, we ensure that appropriate safeguards are in place in line with UK GDPR requirements — typically through the UK International Data Transfer Agreement (IDTA) or by relying on the UK adequacy regulations for transfers to countries with equivalent protection standards.

For specifics on how each provider handles international transfers, please refer to their privacy policies linked above.

Under UK data protection law, you have the following rights:

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate or incomplete data.
• Right to erasure — you can ask us to delete your personal data, subject to any legal obligations we have to retain it.
• Right to restrict processing — you can ask us to pause processing your data in certain circumstances.
• Right to data portability — you can ask us to provide your data in a machine-readable format so you can transfer it to another provider.
• Right to object — you can object to processing based on legitimate interests, including profiling.
• Rights related to automated decisions — SoleTax does not currently make automated decisions that significantly affect you, but you have the right to request human review if this changes.
• Right to withdraw consent — where processing is based on consent (such as marketing emails), you can withdraw it at any time.

To exercise any of these rights, email us at hello@soletax.uk. We will respond within one month as required by law. We will not charge a fee for reasonable requests.

SoleTax uses the following types of cookies and similar technologies:

• Essential cookies — required for the app to function, including authentication session cookies. These cannot be disabled.
• Analytics cookies — used by PostHog to collect anonymised usage data. You can opt out by contacting us or adjusting your browser settings.

We do not use advertising or tracking cookies.

We take the security of your data seriously. Our measures include:

• All data is transmitted over HTTPS/TLS encryption.
• Passwords are hashed and never stored in plain text.
• Access to production systems is restricted to authorised personnel only.
• Our database provider (Supabase) is SOC 2 Type II certified.
• We use row-level security to ensure users can only access their own data.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform affected users without undue delay, as required by UK GDPR.

SoleTax is intended for use by adults (18+) operating as UK sole traders. We do not knowingly collect personal data from anyone under the age of 18. If you believe we have inadvertently collected data from a minor, please contact us at hello@soletax.uk and we will delete it promptly.

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by email, and the updated date at the top of this page will reflect the most recent revision.

We encourage you to review this policy periodically.

If you are unhappy with how we have handled your personal data, please contact us first at hello@soletax.uk and we will do our best to resolve it.

If you remain unsatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:

• Website: ico.org.uk
• Phone: 0303 123 1113