Privacy Policy

Hidbrain Ltd (“SmallTax”, “we”, “us”) is the data controller for personal data you provide when using SmallTax. We are registered in England and Wales. For privacy enquiries contact us at privacy@smalltax.co.uk.

We collect the following categories of data:

• Account data: email address, password (hashed), and account preferences.
• Company data: company name, Companies House registration number, UTR, registered address, and Companies House authentication code.
• Financial data: income, expense, and balance sheet figures you enter for the purpose of preparing returns.
• Submission data: CT600 XML payloads and HMRC responses stored as an audit trail.
• Usage data: IP addresses, browser type, pages visited, and session duration, collected via server logs and analytics.

We process your data for the following purposes:

• Providing and operating the SmallTax service (contract).
• Transmitting CT600 returns and accounts to HMRC on your behalf (contract).
• Fraud prevention and security monitoring (legitimate interest).
• Service improvement and analytics (legitimate interest).
• Sending essential service communications, such as submission confirmations and security alerts (contract/legitimate interest).
• Sending product updates and offers (consent — you can opt out at any time).

We share your data only where necessary:

• HMRC: your CT600 and accounts are transmitted to HMRC as instructed by you.
• Cloud infrastructure provider: our database and authentication provider (EU data centres, SOC 2 Type II certified).
• Hosting provider: our application hosting provider (servers in the EU, ISO 27001 & SOC 2 certified).
• Payment processor: billing and subscription management (PCI DSS Level 1 certified; we never store card details).

We do not sell your personal data to third parties.

We retain your account and submission data for 7 years from the date of filing, in line with HMRC record-keeping requirements. You may request earlier deletion of non-submission data (see section 7). Deleting your account removes your profile and company data; submission records are retained for compliance.

All data is encrypted in transit (TLS 1.2+) and at rest. We use row-level security to ensure that users can only access their own data. Passwords are never stored in plain text.

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate personal data.
• Request erasure of data we are not legally required to retain.
• Object to processing based on legitimate interest.
• Data portability — receive your data in a machine-readable format.
• Withdraw consent for marketing at any time.

To exercise any of these rights, email privacy@smalltax.co.uk. We will respond within 30 days.

SmallTax uses session cookies strictly necessary for authentication. We do not use third-party advertising cookies. Analytics cookies (if any) are only set with your consent.

We may update this policy from time to time. Material changes will be notified by email or in-app notice at least 14 days in advance.

If you have concerns about how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.