Skip to main content

Privacy Policy

Last updated: 6 October 2026 · DoneLabs Ltd · ICO Reg. No. ICO-0001353294

1. Who We Are

DoneTax is a product of DoneLabs Ltd, a company registered in England and Wales, company number 17056937. We provide Making Tax Digital for Income Tax software for UK landlords, enabling quarterly income tax submissions to HMRC. For the purposes of UK data protection law, DoneLabs Ltd is the data controller for personal data collected through DoneTax. Contact: hello@donetax.co.uk

2. What Personal Data We Collect

We collect and process: Identity data (name, email address, National Insurance Number), HMRC data (your Making Tax Digital ID, property income source ID, and encrypted HMRC connection tokens), Financial data (the rental income and allowable expenses you enter, and bank transactions only if you connect a bank, which is not available yet), Submission data (your quarterly updates and year-end tax returns), Address data (the property address you look up when you add your property), Accountant activity (if an accountant invites you, asks you to authorise them at HMRC, files for you or is disconnected, a short in-app alert recording that event; an invitation or authorisation alert names the practice), Technical data (IP address, device ID, browser information, session data), and Usage data.

3. How We Use Your Data

To provide the DoneTax service on the basis of contractual necessity: recording and categorising your income and expenses, and submitting your quarterly updates and tax return to HMRC on your behalf. To comply with legal obligations: fraud prevention header data submitted to HMRC as required. To manage your account and subscription on the basis of contractual necessity. To improve our service on the basis of legitimate interests.

4. HMRC Data and OAuth

DoneTax uses OAuth 2.0 to connect to your HMRC account. We never store your Government Gateway username or password. We store encrypted HMRC connection tokens so DoneTax can send your quarterly updates and tax return. If you connect an accountant who uses DoneTax+, a current HMRC connection token is also passed to DoneTax+ each time you send them a quarter (section 8). These tokens are encrypted using AES-256-GCM encryption at rest and transmitted over HTTPS. Your National Insurance Number is stored on encrypted-at-rest infrastructure, used to identify your records with HMRC and, if you connect an accountant, passed to DoneTax+ (section 8).

5. Bank Connection

Bank connection is not available yet. When it is, it will be optional and provided by Finexer Ltd, an FCA-authorised open banking provider (FRN 925695), with read-only access to your transaction history. DoneTax will never be able to move money from your account. Bank transaction data will be used only to identify rental income and allowable expenses for your quarterly updates.

6. Fraud Prevention Data

HMRC requires all Making Tax Digital software to submit fraud prevention headers with every API call. This includes your device ID, IP address, browser information, and timezone. This is a legal requirement under the Delivery of Tax Information through Software (Ancillary Metadata) Regulations 2019 (SI 2019/360) and HMRC's Terms of Use. We have no discretion over this requirement.

7. Data Sharing

We share your personal data only where necessary to run the service:

  • HMRC, to submit your quarterly updates and tax return.
  • Stripe, for subscription payments.
  • Supabase, our database provider (London).
  • Vercel, application hosting.
  • Amazon Web Services (CloudFront), the network layer every request to DoneTax passes through.
  • Resend, for sign-in links and service emails.
  • Upstash, for rate limiting (your IP address and, on some routes, your email address, held briefly).
  • Ideal Postcodes, for the address search when you add your property.
  • Anthropic, when you use the in-app assistant: your questions only. Your questions and the assistant's answers are also stored in DoneTax.
  • DoneTax+, only if you connect an accountant (section 8).
  • Finexer, once bank connection is available and only if you connect a bank.

We do not sell, rent, or share your personal data with any third party for marketing purposes.

8. Accountant Access

If you accept an invitation from an accountant's practice, your DoneTax account is connected to that practice through DoneTax+, our platform for accountants, run by DoneLabs Ltd. Each time you send a quarter to your accountant, DoneTax passes to DoneTax+ your National Insurance Number, Making Tax Digital ID and HMRC business ID, a current HMRC connection token, and the income and expenses for that period. To show whether an accountant is connected, DoneTax checks with DoneTax+ using your National Insurance Number. Connecting is voluntary and needs your acceptance. To end accountant access, use Disconnect on your Account page; any authorisation you gave your accountant at HMRC is withdrawn through your HMRC online account. DoneLabs Ltd is not responsible for how your accountant uses the figures you send them.

9. Data Storage and Security

Your data is stored on Supabase infrastructure in the United Kingdom (London). Security measures include: AES-256-GCM encryption for all OAuth tokens at rest, HTTPS and TLS for all data in transit, HttpOnly and Secure cookie flags, Content Security Policy and HSTS headers, rate limiting on sign-in and other sensitive routes, and parameterised database queries.

10. Data Retention

We retain your personal data for as long as your DoneTax account is active. If you delete your account, your personal data, including your properties, bank transactions, income records and submission history, is deleted immediately and permanently. Our payment provider, Stripe, deletes your customer record at the same time; Stripe keeps its own records of past payments, as the law requires of it. Records of any data protection complaints you have raised are kept in anonymised form, with your email and message removed, so we can evidence how they were handled. If you sent figures to an accountant through DoneTax+, those copies are not removed automatically: email hello@donetax.co.uk and we will remove them. You remain responsible for keeping records that support your tax returns for the periods HMRC requires; you can export your data from your dashboard before deleting your account.

11. Your Rights

Under UK GDPR you have: Right of access (request a copy via Data Export), Right to erasure (delete account via Delete Account feature), Right to rectification (update your profile), Right to restrict processing, Right to data portability (machine-readable format), Right to object. Contact us at hello@donetax.co.uk to exercise any right.

12. Cookies

DoneTax uses strictly necessary cookies only: session cookies for authentication and a persistent device ID cookie for HMRC fraud prevention compliance. We do not use advertising or tracking cookies.

13. Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

14. Data protection complaints

You have the right to raise a formal data protection complaint if you are unhappy with how DoneLabs Ltd handles your personal data. This right is established under the Data (Use and Access) Act 2025 and UK GDPR.

To raise a complaint, sign in to your DoneTax account, open Account, and use the complaint form in the Data Protection section. If you are unable to access your account, you can email us directly at privacy@donelabs.co.uk with the subject line 'Data Protection Complaint'.

We aim to acknowledge your complaint within 3 working days, and always within 30 days, and will keep you informed of progress and expected timeframes for resolution.

If you are not satisfied with our response, or if we have not responded within a reasonable time, you have the right to escalate your complaint to the Information Commissioner's Office (ICO). The ICO can be contacted at ico.org.uk or by calling 0303 123 1113.