Privacy Policy

The data controller for personal data processed through TaxQuest is Edward Dobie trading as TaxQuest (Sole Trader). For any privacy-related query, exercise of your rights, or complaint, contact support@taxquest.co.uk. If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

To provide the service, we collect and process:

• Account information (name, email address, authentication credentials).
• Tax identifiers, including your National Insurance Number (NINO), Unique Taxpayer Reference (UTR), and HMRC Business IDs.
• Uploaded receipts, invoices, and bank statements you submit for processing.
• Anti-Fraud telemetry required by HMRC for Making Tax Digital submissions, including device IDs, IP addresses, and timezones.

Document parsing (receipt and invoice OCR) is performed using enterprise Google Gemini 3.7 Flash API endpoints. Data submitted through these endpoints is not retained beyond the processing request and is not used to train Google's or any third party's models. Parsed results are stored solely in our own database for your use within TaxQuest.

Where you connect your HMRC account, TaxQuest transmits your categorised income and expense figures to HMRC exclusively through HMRC's official Making Tax Digital (MTD) APIs, via an OAuth 2.0 connection you explicitly authorise. Every API call to HMRC includes the mandatory Anti-Fraud telemetry headers (device, connection, location, and timezone metadata) required by HMRC's developer terms to help prevent tax evasion, and this data is used for no purpose beyond that submission.

Sensitive financial identifiers and OAuth access/refresh tokens issued by HMRC are encrypted at rest using PostgreSQL's pgcrypto extension for field-level encryption, via dedicated security.encrypt_pii / security.decrypt_piidatabase functions, isolated from the application's general-purpose data API and decrypted only server-side, at the point of use.

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the right to access, rectify, or erase your personal data, subject to applicable legal exemptions (e.g. HMRC record-keeping requirements). You may revoke TaxQuest's access to your HMRC account at any time via your HMRC online account, in addition to exercising any of the above rights by contacting us using the details in Section 1.