Privacy Policy

1. Who we are

TaxEru (“we”, “us”) is a UK self-employment tax planning and bookkeeping product. You can contact the operator through the channels published in the product or repository when a support address is established. Until then, treat in-product Settings and the project maintainers as the contact path for privacy requests.

2. Pre-recognition and sandbox stance

TaxEru currently offers MTD planning and sandbox support only. It is not HMRC-recognised compatible software for Making Tax Digital for Income Tax, and it does not appear on GOV.UK’s compatible-software list. Live production HMRC API filing is not generally available in TaxEru; any quarterly submission controls that appear in non-production or explicitly sandbox-flagged environments are for HMRC sandbox / test APIs only.

3. Data we process

Depending on how you use TaxEru, we may process:

• Account data — email address and authentication credentials managed via our auth provider (Supabase Auth).
• Bookkeeping and tax-planning data you enter — income and expense transactions, business / income sources, settings (tax year, allowances, VAT flags, MTD planning fields), exchange rates you store, and exports you generate.
• HMRC connection metadata — whether you have authorised TaxEru to talk to HMRC APIs on your behalf, when you connected, linked income-source identifiers, OAuth scopes, and submission-attempt records (period, status, correlation identifiers, and non-secret payloads needed for support and audit).
• HMRC OAuth tokens — access and refresh tokens issued by HMRC after you complete OAuth. See section 4.
• Technical data for fraud-prevention headers — when calling HMRC APIs, the browser may supply device and session attributes required by HMRC’s fraud-prevention rules (for example timezone, screen metrics, and similar). TaxEru does not persist raw fraud-prevention header payloads in application logs.

4. HMRC tokens — encryption and access

When you connect a HMRC account (sandbox today; a future production environment would use separate production credentials and configuration), HMRC issues OAuth access and refresh tokens. TaxEru:

• Stores tokens in the database only as encrypted ciphertext fields (`access_token_encrypted`, `refresh_token_encrypted`), using AES-256-GCM with a server-only encryption key (`HMRC_TOKEN_ENCRYPTION_KEY`).
• Keeps the encryption key and HMRC client secrets on the server only — they are not exposed to the browser via public environment variables.
• Never returns raw tokens to the client UI or public API responses. Connection status endpoints report whether you are connected, not the token material.
• Uses tokens only on the server to call HMRC APIs you have authorised (for example obligations retrieval and sandbox quarterly updates where enabled).

5. Retention

• Account and bookkeeping data remain while your account exists, or until you clear or delete them using in-product controls (for example Clear All Data) or request account deletion.
• Active HMRC tokens are retained only while a non-revoked connection exists, so TaxEru can refresh access and call APIs you authorised.
• Submission attempt history (without raw tokens) may be retained for support, debugging, and recognition/sandbox evidence purposes while your account exists.
• Revoked connections keep a `revoked_at` timestamp and connection row history where needed for audit, but encrypted token fields are wiped (see section 6).

6. Deletion on disconnect (soft revoke)

When you disconnect HMRC in Settings, TaxEru performs a soft revoke:

• Sets `revoked_at` on your HMRC connection record.
• Nulls / wipes `refresh_token_encrypted`, `access_token_encrypted`, and `access_token_expires_at`.
• Blocks further token refresh or API use for that connection until you reconnect via OAuth.

Soft revoke does not currently call an external HMRC token-revocation HTTP API (v1 design). To end TaxEru’s ability to use stored tokens, disconnect in Settings. You may also revoke TaxEru’s access in your HMRC / Government Gateway account where HMRC provides that control.

If you delete your TaxEru account entirely, associated user data — including transactions, business sources, settings, and HMRC connection rows — is removed via database foreign-key ON DELETE CASCADE from the auth user, subject to any backup retention of the hosting provider.

7. Access control and subprocessors

Application data is stored in PostgreSQL (Supabase) with row-level security scoped to your authenticated user id for owner-owned tables. Hosting and auth are provided by our infrastructure vendors (for example Supabase and the application host). Those vendors process data under their own terms and privacy notices. TaxEru does not sell your personal data.

8. Exports

JSON backups and CSV exports include your bookkeeping and settings data. They are designed not to include HMRC OAuth tokens or encrypted token columns. Treat any download as sensitive personal financial information.

9. Your choices

• Update or delete records in the app.
• Disconnect HMRC to wipe stored tokens (section 6).
• Export your data from Settings.
• Request account deletion via the published support channel when available.

10. Changes

We may update this policy as the product evolves (including any future move from HMRC sandbox to separately configured production credentials). The “Last updated” date at the top will change when material revisions ship. Continued use after an update means you accept the revised policy for product purposes; formal legal reliance still requires counsel review.

11. Related terms

What TaxEru does and does not do — including that it is not tax advice — is described in the Terms of Use.