Last updated: August 2026
Privacy Policy
1. Data controller
Your data controller is Taxly Technologies Limited, a company registered in England and Wales under company number 17210367, which trades as Taxxona.
Our registered office is at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF.
If you have questions about how we handle your data, you can contact us at privacy@taxxona.ai.
We are registered with the Information Commissioner’s Office (ICO) under registration number C1935249.
2. What data we collect
When you use Taxxona to prepare your Self Assessment tax return, we collect and process the following categories of personal data:
Identity data
Your name, email address, and phone number.
Tax identification data
Your Unique Taxpayer Reference (UTR), National Insurance number, and date of birth. These are required by HMRC to file your return.
Financial data
All financial information you provide during the AI-guided intake conversation, including employment income, self-employment income, rental income, savings and dividend income, expenses, capital gains, pension contributions, student loan details, and any other information relevant to your tax return.
Documents
Any documents you upload, such as P60s, P11Ds, P45s, bank statements, rental income records, and other supporting paperwork.
Technical data
Your IP address and browser type, collected automatically through our authentication provider (Clerk) when you sign in.
Communication data
The full transcript of your AI intake conversation, including all questions asked and answers you provide. This transcript forms the basis of your tax return.
3. Lawful basis for processing
We process your personal data under the following lawful bases as defined by UK GDPR:
Contract (Article 6(1)(b))
Processing your data is necessary to perform the contract between us: namely, preparing and filing your Self Assessment tax return. Without this data, we cannot provide the service.
Legal obligation (Article 6(1)(c))
HMRC requires us to retain records relating to your tax return for a minimum period after the end of the relevant tax year. We are legally obliged to keep these records to comply with tax legislation.
Legitimate interest (Article 6(1)(f))
Where you purchase our review service, a contracted qualified reviewer checks your completed return for accuracy before filing. This review is in both your interest (ensuring your return is correct) and ours (maintaining the quality and integrity of the service).
4. Who we share your data with
We use a small number of trusted third-party services (sub-processors) to operate Taxxona. Each processor is bound by a data processing agreement and processes your data only as necessary to provide their service.
| Processor | Location | Purpose |
|---|---|---|
| Supabase Inc. | United Kingdom (London) | Database hosting and file storage |
| Anthropic PBC | USA | AI processing of intake conversations. Your conversation data is sent to Anthropic’s API to generate your tax return. Anthropic does not use API data to train its models. |
| Clerk Inc. | USA | Authentication and identity management |
| Stripe Inc. | USA | Payment processing |
Your tax data and documents are stored by Supabase in London, so the database and file storage never leave the United Kingdom. Clerk, Stripe and Anthropic process data in the United States: these international transfers are protected by Standard Contractual Clauses (SCCs) and, where applicable, UK adequacy decisions. We have satisfied ourselves that appropriate safeguards are in place for each transfer.
5. Data retention
HMRC requires that records relating to a tax return are retained for at least 5 years after the 31 January filing deadline, plus the remainder of the current tax year. In practice, this means we retain your data for a minimum of 6 years from the end of the relevant tax year.
For example, data relating to the 2025–26 tax year (ending 5 April 2026) will be retained until at least 5 April 2032.
After the retention period expires, your data will be securely deleted unless there is another lawful reason to retain it.
6. Your rights
Under UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:
- Right of access (Subject Access Request): You can download all the data we hold about you via the portal settings page. Alternatively, contact us and we will provide it within 30 days.
- Right to rectification: If any data we hold about you is inaccurate or incomplete, contact us and we will correct it promptly.
- Right to erasure: You can request that we delete your data. However, please note that we are legally required to retain tax return records for the period described in section 5. We cannot delete data that we are obliged to keep.
- Right to restrict processing: You can ask us to limit how we use your data in certain circumstances.
- Right to data portability: You can download your data in JSON format from the portal settings page, making it easy to transfer to another service.
- Right to object: You can object to processing based on legitimate interest. We will stop unless we have compelling grounds to continue.
- Right to complain: If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.
7. Cookies
Taxxona uses only strictly necessary cookies required for authentication, provided by Clerk. These cookies allow you to sign in and stay signed in while using the service.
We do not use any analytics, advertising, or marketing cookies. There is no cookie consent banner because we do not use any optional cookies.
8. Data security
We take the security of your data seriously. All data is encrypted in transit using TLS (Transport Layer Security) and encrypted at rest in our database and file storage systems.
Access to your data is restricted to authorised systems and, where you have purchased our review service, the contracted qualified reviewer assigned to your return. We do not share your data with any parties other than the sub-processors listed in section 4.
9. Data breach notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, as required by UK GDPR Article 33.
If the breach is likely to result in a high risk to you, we will also notify you directly without undue delay, explaining what happened and what steps we are taking.
10. Changes to this policy
We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The “Last updated” date at the top of this page will always show when the policy was most recently revised.
For significant changes, we will notify you by email or through a notice on theTaxxona portal.