Privacy policy

TaxLi provides the TaxLi product. Operated by Fahad Khan as a sole trader (not registered as a limited company). Registered address: 43 Brightside Road, Manchester, Lancashire, M8 5XJ. Not VAT registered. Privacy requests can be sent to support@taxli.co.uk.

TaxLi may collect account details, contact details, Self Assessment return data, tax-year selections, income source selections, uploaded documents, support messages, review requests, payment metadata and technical usage information needed to run and protect the service.

We use your information to provide the preparation workspace, save your draft return, calculate draft estimates, generate return packs, handle support, manage review requests, improve reliability and keep the service secure.

Before launch, TaxLi should confirm and document the final lawful bases for each processing purpose. The working position is that core account, return workspace, return pack, support and billing processing is mainly needed to provide the service, meet legal obligations, keep the service secure, and handle customer requests. Final legal/privacy review is still required.

TaxLi can submit your return directly to HMRC once that's switched on for your account. We process HMRC identifiers you provide, including your Unique Taxpayer Reference (UTR), National Insurance number, PAYE references, and the employment/income/property details entered into your return. Submission payloads, validation results, cryptographic hashes, IRmark metadata, and HMRC status/rejection receipts may be stored for audit, support, and compliance purposes. Raw XML submitted to HMRC is retained only where a controlled evidence process or an approved retention policy specifically allows it. HMRC credentials and access tokens are stored server-side only and are never exposed in client apps, support tickets, or logs.

Self Assessment data can include sensitive financial information. Access should be limited to you, authorised support/admin users, and any accountant review workflow you request.

When live payments are enabled, payment details should be processed by the payment provider. TaxLi should store only the minimum payment metadata needed for access, receipts, refunds and support.

TaxLi uses essential browser storage for sign-in, security, tax-year preference, onboarding drafts and app reliability. Analytics or advertising cookies should not be enabled until cookie consent and privacy wording are production-ready.

TaxLi stores core application data in Google Cloud services configured for the europe-west2 (London) region. Payment processing is provided by Stripe. Email notifications are provided by Resend. Final production hosting and data processor evidence should be reviewed before launch.

Return data should be retained only for as long as needed to provide the service, meet legal obligations, resolve support issues and preserve records you ask us to keep. You can ask us to delete a tax year, close an account, or export personal data. Some limited payment, fraud-prevention, support or legal records may need to be retained where required or justified.

UK users may have rights to access, correct, delete, restrict or export personal data, object to certain processing, and withdraw consent where consent is used. Contact support@taxli.co.uk or raise an in-app support ticket for privacy requests. We may need to verify your identity before exporting or deleting sensitive tax data.

Right now, privacy requests are handled manually through support. Include your account email, the tax year affected, the request type, and whether you want account data, return data, support messages, review requests, or billing metadata included. Do not send UTR or National Insurance numbers by email unless support specifically asks through a safe route.

This privacy policy is written and maintained by TaxLi's operator to reflect the current product, hosting, and processor setup. It is reviewed as the product changes, including before new features such as direct HMRC submission are switched on. If anything here is unclear, contact us before sharing sensitive data.