What is MTD for Income Tax?

Making Tax Digital for Income Tax (MTD for Income Tax) requires landlords and sole traders to keep digital records and submit quarterly updates to HMRC instead of one annual Self Assessment return. It is mandatory from April 2026 for those with income over £50,000.

Who needs to use DoneTax?

UK landlords with property income over £50,000 from April 2026, over £30,000 from April 2027, and over £20,000 from April 2028 must use MTD-compatible software. DoneTax is built specifically for property landlords.

Is DoneTax HMRC-recognised MTD software?

DoneTax is built on the official HMRC MTD API and has been tested end-to-end with HMRC. Production recognition is the final step before full public launch.

What is the best Making Tax Digital software for landlords?

DoneTax is purpose-built for UK property landlords - not adapted from general accounting tools. It connects directly to your bank via open banking, categorises rental transactions, and submits quarterly updates to HMRC for £4.99 per month.

Data Protection

Your Privacy Matters

Last updated: 17 July 2026 · DoneLabs Ltd · ICO Reg. No. ICO-0001353294

ICO Registered · GDPR Compliant

1. Who We Are

DoneTax is a product of DoneLabs Ltd, a company registered in England and Wales, company number 17056937. We provide Making Tax Digital (MTD) software for UK landlords, enabling quarterly income tax submissions to HMRC. For the purposes of UK data protection law, DoneLabs Ltd is the data controller for personal data collected through DoneTax. Contact: hello@donetax.co.uk

2. What Personal Data We Collect

We collect and process: Identity data (name, email address, National Insurance Number), HMRC data (MTD ID, property income source ID, encrypted OAuth access tokens), Financial data (bank transactions, rental income, allowable expenses via open banking), Submission data (quarterly tax returns and Final Declarations), Technical data (IP address, device ID, browser information, session data), and Usage data.

3. How We Use Your Data

To provide the DoneTax service on the basis of contractual necessity: processing your bank transactions, categorising income and expenses, and submitting quarterly MTD returns to HMRC on your behalf. To comply with legal obligations: fraud prevention header data submitted to HMRC as required. To manage your account and subscription on the basis of contractual necessity. To improve our service on the basis of legitimate interests.

4. HMRC Data and OAuth

DoneTax uses OAuth 2.0 to connect to your HMRC account. We never store your Government Gateway username or password. We store encrypted OAuth access tokens solely to submit your tax returns on your behalf. These tokens are encrypted using AES-256-GCM encryption at rest and transmitted over HTTPS. Your National Insurance Number is stored on encrypted-at-rest infrastructure and used only to identify your MTD records with HMRC.

5. Open Banking Data

DoneTax connects to your bank account via TrueLayer, an FCA-authorised open banking provider. We request read-only access to your transaction history. We cannot and never will move money from your account. Bank transaction data is stored securely and used only to identify rental income and allowable expenses for your MTD submissions.

6. Fraud Prevention Data

HMRC requires all MTD software providers to submit fraud prevention headers with every API call. This includes your device ID, IP address, browser information, and timezone. This is a legal requirement under the Delivery of Tax Information through Software (Ancillary Metadata) Regulations 2019 (SI 2019/360) and HMRC's Terms of Use. We have no discretion over this requirement.

7. Data Sharing

We share your personal data only where necessary: HMRC (to submit your quarterly MTD returns), TrueLayer (open banking, read-only), Stripe (subscription payments), Supabase (database provider, EU-hosted), Vercel (application hosting), Resend (transactional email), Upstash (session and rate-limiting infrastructure), and Anthropic (AI-assisted support - your support questions only, when you use the in-app assistant). We do not sell, rent, or share your personal data with any third party for marketing purposes.

8. Data Storage and Security

Your data is stored on Supabase infrastructure in the European Union (Frankfurt, Germany). Security measures include: AES-256-GCM encryption for all OAuth tokens at rest, HTTPS and TLS for all data in transit, HttpOnly and Secure cookie flags, Content Security Policy and HSTS headers, rate limiting on all API endpoints, and parameterised database queries.

9. Data Retention

We retain your personal data for as long as your DoneTax account is active. If you delete your account, we will delete your personal data within 30 days, except where required by law. Financial records required for tax purposes may be retained for up to 7 years.

10. Your Rights

Under UK GDPR you have: Right of access (request a copy via Data Export), Right to erasure (delete account via Delete Account feature), Right to rectification (update your profile), Right to restrict processing, Right to data portability (machine-readable format), Right to object. Contact us at hello@donetax.co.uk to exercise any right.

11. Cookies

DoneTax uses strictly necessary cookies only: session cookies for authentication and a persistent device ID cookie for HMRC fraud prevention compliance. We do not use advertising or tracking cookies.

12. Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

13. Data protection complaints

You have the right to raise a formal data protection complaint if you are unhappy with how DoneLabs Ltd handles your personal data. This right is established under the Data (Use and Access) Act 2025 and UK GDPR.

To raise a complaint, sign in to your DoneTax account and visit Settings - your complaint form is in the Data Protection Complaint section. If you are unable to access your account, you can email us directly at privacy@donelabs.co.uk with the subject line 'Data Protection Complaint'.

We will acknowledge your complaint within 30 days of receipt and will keep you informed of progress and expected timeframes for resolution.

If you are not satisfied with our response, or if we have not responded within a reasonable time, you have the right to escalate your complaint to the Information Commissioner's Office (ICO). The ICO can be contacted at ico.org.uk or by calling 0303 123 1113.