Last updated: August 27, 2026
TaxSwipe helps UK sole traders manage Making Tax Digital compliance. We take the privacy of your financial data seriously. This policy explains exactly what we collect, why, and how it is protected.
1. Who We Are
TaxSwipe is developed and operated by Finmedtech Limited, a company registered in England and Wales (company number 17390671) whose registered office is 284 Maidstone Road, Chatham, ME4 6JL. We are the data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and we are registered with the UK Information Commissioner's Office under registration reference ZC219238.
Email: hello@finmedtech.co.uk
1.1 Data Protection Officer
We have not designated a Data Protection Officer. Under Article 37 of the UK GDPR a DPO is required only where the controller is a public authority, where its core activities involve large-scale regular and systematic monitoring of individuals, or where it processes special category data on a large scale. None of these apply to us: we are a private company, we do not track or monitor user behaviour (Section 2.6), and we do not process special category data.
Responsibility for data protection rests with the directors of Finmedtech Limited, who can be reached at hello@finmedtech.co.uk or at the registered address above.
2. What Data We Collect
2.1 Personal Information
- Email address — for account creation and communication
- Full name — for profile identification
- Business name — for tax records
- National Insurance Number — required for HMRC Making Tax Digital submissions
- Password — stored as a one-way bcrypt hash; we cannot read your password
2.2 Financial Information
- Bank transactions — imported via PDF upload, CSV import, or manual entry
- PDF bank statements — uploaded files are processed using dual-engine verification for accuracy and temporarily stored; automatically deleted after parsing
- Transaction categorisations — business vs personal, HMRC expense categories
- Income and expense data — calculated from transactions
- Tax calculations — Income Tax and National Insurance contributions
2.3 HMRC Integration Data
- HMRC OAuth tokens — to submit quarterly returns on your behalf (encrypted)
- HMRC Business ID — fetched from HMRC Business Details API
- Submission records — quarterly MTD submission history and HMRC references
2.4 Technical Data
- Authentication tokens — stored securely on your device; cleared on logout
- Biometric preference — enabled/disabled flag stored in device secure storage only; we never receive biometric data itself
- Device information — operating system and app version
- Purchase status — whether you hold submission credits or an active subscription
2.5 HMRC Fraud Prevention Data (Legally Required)
UK law requires all Making Tax Digital software to send HMRC certain information about the device a submission comes from, as fraud prevention headers, with every request made to HMRC's APIs. When you connect TaxSwipe to HMRC, we collect and forward to HMRC:
- A unique device identifier generated by TaxSwipe (stored securely on your device)
- Your device's operating system, manufacturer and model
- Screen and window size, resolution and colour depth
- Your timezone
- Your device's local and public IP addresses and port
- Whether multi-factor authentication was used for your session
This data is sent to HMRC only, is not used by us for any other purpose, and is collected under our legal obligation to comply with HMRC's fraud prevention requirements.
2.6 What We Do Not Collect
- We do not access your device's GPS location
- We do not collect advertising identifiers
- We do not use analytics or tracking SDKs
- We do not store bank login credentials (you upload PDF statements directly)
- We do not permanently store PDF files (deleted after parsing)
2.7 Data We Receive From Other Sources
Almost all of the data we hold comes directly from you. Two things do not:
- From HMRC — when you connect your HMRC account, we retrieve your Business ID, your MTD obligation periods and, at year end, your tax calculation. The source is HMRC's Making Tax Digital APIs, acting on the authorisation you gave when you connected.
- From Apple or Google — confirmation of a purchase or subscription status, via RevenueCat (Section 4.5). We receive no payment details.
2.8 Whether You Have To Provide This Data
Providing your email address and password is a contractual requirement — without them we cannot create your account. Your National Insurance Number and an HMRC connection are required by HMRC before any Making Tax Digital submission can be made; without them you can still use TaxSwipe to import, categorise and calculate, but you will not be able to submit. The fraud prevention data in Section 2.5 is a legal requirement we cannot switch off for submissions. Everything else is optional, and not providing it only limits the corresponding feature.
3. How We Use Your Data
We use the collected data for the following purposes:
- Provide and maintain our service — account management, transaction import, categorisation
- Process bank statements — extract transactions from uploaded PDFs using dual-engine verification for accuracy (see Section 4.1 for how statements are processed)
- Calculate tax liability — Income Tax and National Insurance calculations based on UK tax rates
- Submit to HMRC — quarterly Making Tax Digital updates and your year-end Final Declaration, on your behalf
- AI categorisation — suggest expense categories using Anthropic Claude. For categorisation, we send transaction descriptions, merchant names, amounts and an internal reference ID — never your name, National Insurance Number, or bank account details
- Manage purchases — track your submission credits and subscription status
- Customer support — respond to your requests and provide assistance
- Comply with legal obligations — HMRC reporting and fraud prevention requirements, data protection laws
3.1 Our lawful basis for each purpose
Article 6 of the UK GDPR requires a lawful basis for every purpose. The basis we rely on for each is:
- Provide and maintain our service — Contract: necessary to deliver the service you signed up for
- Process bank statements — Contract: extracting transactions is the core function you ask us to perform
- Calculate tax liability — Contract
- AI categorisation — Contract: category suggestions form part of the service, and you can accept, change or ignore every one (Section 3.2)
- Connecting your HMRC account — Consent: you choose to connect, and can withdraw at any time via Settings → Disconnect from HMRC
- Submit to HMRC — Contract, together with Legal obligation for the submission records we are required to keep
- HMRC fraud prevention headers — Legal obligation: UK law requires all Making Tax Digital software to send these (Section 2.5)
- Your National Insurance Number — Legal obligation and Contract: HMRC requires it to identify you for Making Tax Digital
- Manage purchases — Contract
- Customer support — Legitimate interests: our interest in answering your questions and resolving faults, balanced against and not overriding your rights
- Service security and fraud prevention — Legitimate interests: our interest in keeping the service and your financial data secure
We do not process special category data (such as health, biometric or political data). Where we rely on consent, withdrawing it does not affect the lawfulness of processing carried out before you withdrew it.
3.2 Automated decision-making and profiling
TaxSwipe uses AI (Anthropic Claude) to suggest a category for each transaction, and to read bank statements that are scanned or cannot be read by text extraction alone. These suggestions are not decisions. Every suggested category is shown to you for review and takes effect only when you accept it; you can change or reject any suggestion, and nothing is sent to HMRC until you have reviewed the figures and confirmed the submission yourself.
Because you review and confirm every outcome, this is not solely automated decision-making producing legal or similarly significant effects within the meaning of Article 22 of the UK GDPR. We do not profile you, score you, or make automated decisions about your eligibility, pricing or creditworthiness. If a categorisation looks wrong you can correct it in the app at any time, or contact us at support@finmedtech.co.uk to ask a person to look at it.
4. Third-Party Services
4.1 Statement Processing (Amazon Web Services & Anthropic)
- PDF bank statements are processed using dual-engine verification for accuracy
- Text extraction runs in an isolated serverless environment on Amazon Web Services (AWS). Privacy notice: aws.amazon.com/privacy
- Where a statement is scanned or cannot be read by text extraction alone, the statement document is processed by Anthropic Claude to read the transactions. This means the statement content (which typically includes your name, account number and transactions) is transmitted securely to Anthropic for processing. Anthropic does not use data submitted through its API to train its models
- Both engines are cross-checked against your statement balances; discrepancies are flagged for your review
- PDFs are temporarily stored during processing and automatically deleted after extraction
4.2 HMRC (Tax Submissions)
- UK Government tax authority
- Receives quarterly MTD submissions on your behalf
- We store OAuth tokens to submit on your behalf (encrypted)
- You can disconnect from HMRC at any time via Settings
- HMRC Personal Information Charter
4.3 Anthropic (AI Categorisation & Statement Reading)
- Provides Claude AI for expense categorisation suggestions and for reading scanned bank statements (Section 4.1)
- For categorisation, only transaction descriptions, merchant names, amounts and an internal reference ID are sent — never your name, National Insurance Number, or bank account details
- For statement reading, the uploaded statement document is processed by Claude (see Section 4.1)
- Anthropic does not use data submitted through its API to train its models
- Privacy policy: anthropic.com/privacy
4.4 Supabase (Cloud Infrastructure)
- Stores your profile, transactions, and submissions
- Manages user authentication
- Data encrypted at rest and in transit (HTTPS)
- Privacy policy: supabase.com/privacy
4.5 RevenueCat (Purchase Management)
We use RevenueCat to manage in-app purchases and subscriptions. RevenueCat receives an anonymised app user ID and your purchase history (products bought, subscription status) — never your payment card details or financial data. Privacy policy: revenuecat.com/privacy.
4.6 Apple / Google (App Store Payments)
If you make a purchase through the app, payment is processed entirely by Apple (App Store) or Google (Play Store). We do not receive or store your payment card details. We receive only confirmation of your purchase or subscription status.
4.7 Google Workspace (Business Email)
Our company email is hosted on Google Workspace. If you write to any of the addresses in Section 12, your message, your email address and anything you choose to include are processed by Google as our email provider. We use Google Workspace for correspondence only — your transactions, tax calculations and HMRC data are never stored there. Privacy terms: Google Workspace Data Processing Addendum.
5. Data Security
- Encryption in transit — all data transmitted via HTTPS/TLS
- Encryption at rest — database encryption via Supabase
- Passwords — stored using industry-standard one-way hashing (we cannot read your password)
- Biometric authentication — Face ID/Touch ID for app access
- Field-level encryption — your most sensitive data (National Insurance Number and HMRC connection tokens) is additionally encrypted at field level with AES-256-GCM, on top of database encryption
- Database isolation — strict access controls ensure users can only access their own data
- PDF processing security — uploaded PDFs are processed in an isolated serverless environment and automatically deleted after extraction
- No credential storage — we do NOT store bank login credentials; you upload PDF statements directly
6. Data Retention
- Active accounts — data retained while your account is active
- Deleted accounts — all personal data permanently deleted from our servers when you use Settings → Delete Account
- HMRC submissions — retained for 6 years to comply with UK tax record-keeping requirements
- PDF files — automatically deleted immediately after transaction extraction (not stored permanently)
- Subscription data — retained while subscription is active; deleted 30 days after cancellation
7. Your Rights Under UK GDPR
You have the following rights regarding your personal data:
- Access — request a copy of all data we hold about you
- Rectification — correct any inaccurate data
- Erasure — delete your account and all associated data at any time via Settings → Delete Account, or by contacting us
- Restriction — request we limit how we process your data
- Portability — export your data in a machine-readable format
- Objection — object to processing of your personal data
- Withdraw consent — disconnect HMRC or cancel subscription at any time
To exercise any right, contact us at hello@finmedtech.co.uk. We will respond within 30 days.
You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO): ico.org.uk.
8. Purchases & Submission Credits
Core features of TaxSwipe are free to use. Submitting to HMRC requires either a one-off submission credit or an active subscription. To operate this, we track:
- Submission credits — credits purchased and used
- Subscription status — whether a monthly or annual plan is active, and its renewal date
We do not sell or share your usage data with third parties.
9. Children
TaxSwipe is not intended for use by individuals under 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
10. International Data Transfers
Your data is stored in the European Union (our database infrastructure is hosted by Supabase in Germany), which the UK recognises as providing adequate data protection. Some of the third-party services in Section 4 — Anthropic, Amazon Web Services, RevenueCat and Google Workspace — may process data outside the UK and EU, principally in the United States.
Where data is transferred outside the UK, we rely on appropriate safeguards under Article 46 of the UK GDPR: the UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework where the recipient is certified), Standard Contractual Clauses, and the UK International Data Transfer Addendum. You can request a copy of the safeguards applying to a particular transfer by contacting us at hello@finmedtech.co.uk.
11. Changes to This Policy
We may update this policy from time to time. When we do, we will update the "Last updated" date at the top and, for material changes, notify you via the app. Continued use of TaxSwipe after changes constitutes acceptance of the updated policy.
12. Contact
For any privacy questions, data requests, or concerns:
← Back to TaxSwipe