Tax Hare

Privacy Policy

1. Who we are

Tax Hare (“we”, “us”, “our”) is a bridging software service designed to help UK landlords comply with HMRC's Making Tax Digital for Income Tax Self Assessment (MTD ITSA) mandate. We are the Data Controller for the personal data you provide to us.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. UK Data Residency

Your data never leaves the UK. All personal and financial data is stored securely in the London region (eu-west-2) of our cloud infrastructure providers (Supabase / AWS). This ensures your data is protected under UK GDPR and the Data Protection Act 2018.

3. What data we collect

  • Identity data: Your email address (used for authentication via secure magic link).
  • Tax reference data: Your National Insurance Number (NINO), required by HMRC to identify your tax account.
  • Financial data: Property income and expense records extracted from your uploaded spreadsheet.
  • HMRC credentials: OAuth 2.0 tokens that authorise us to submit updates on your behalf. These are encrypted with AES-256-GCM.

4. Legal basis for processing

  • Consent (UK GDPR Art. 6(1)(a)): We rely on your explicit consent, given at signup, to process your financial data and submit it to HMRC.
  • Legitimate interests (UK GDPR Art. 6(1)(f)): We maintain anonymised audit logs to detect fraud and support dispute resolution.

5. Security & Encryption

To fulfill your MTD obligations, we capture your National Insurance Number (NINO). Your NINO is encrypted at the application layer using AES-256 before being saved to our database. Only your authenticated session can decrypt this information for submission to HMRC.

6. Data retention

  • Raw upload data: Automatically deleted 24 hours after submission.
  • Submission records:Retained for 5 years to align with HMRC's statutory record-keeping requirements.
  • Account data: Retained until you choose to delete your account.

7. Your rights

Under UK GDPR, you have the right to access, rectify, or erase your data, and to withdraw consent at any time. To exercise these rights, use the Settings panel within the app or contact us directly.

8. Contact us

For any data protection queries, please contact us at: privacy@taxhare.co.uk

9. Cookies & Local Storage

We use a limited number of “strictly necessary” cookies and local storage items to operate the service safely and securely. Under UK PECR, these do not require opt-in consent as they are essential for the service you have requested.

  • Session Authentication: We use cookies to maintain your secure authenticated session.
  • HMRC Connectivity: Temporary state and verifier items are stored to facilitate the secure OAuth 2.0 connection to HMRC.
  • Preferences: We use local storage to remember that you have read and acknowledged our transparency notices.
Last updated: April 2026 • Version 1.0
← Back to Home