Privacy Policy

1Who we are

TaxSignal is a product operated by GAJO Creative Ltd (Company number 16669280), registered in England & Wales, registered office [ADDRESS]. We are the data controller responsible for your personal data. For anything about this policy or your data, contact hello@taxsignal.co.uk.

2What we collect

• Account data — your name, email, hashed password, and plan.
• Business & financial data — figures read from your connected accounting software or entered manually, such as revenue, expenses, salaries, dividends, capital expenditure and VAT status.
• Encrypted connection tokens — read-only tokens that let us sync from your accounting software, always stored encrypted.
• Basic technical & usage logs — needed to run and secure the service.

We do not use advertising trackers, and we never sell your data.

3How we use it & our lawful basis

• To provide the service and analysis — performance of our contract with you.
• Service & account emails — performance of our contract and our legitimate interests in operating the service.
• To keep the service secure and improve it — our legitimate interests.
• Optional marketing — only with your consent, which you can withdraw at any time.

4AI processing

Your figures are processed by Anthropic and OpenAI via their commercial APIs to produce your analysis. Under those commercial terms, your data is not used to train their models. We only send the data necessary to perform the analysis.

5Sub-processors

We share only what's needed with a small number of trusted providers:

We never sell your data or share it for marketing.

6Where your data is stored

Your data is stored in the UK (London) on Supabase. Some sub-processors may process data outside the UK; where they do, this is covered by appropriate safeguards such as standard contractual clauses.

7Retention

We keep your data while your account is active. You can request deletion at any time. When your account is closed, we delete or anonymise your data within a reasonable period, except for limited records we're required to keep for legal or accounting obligations.

8Security

Data is encrypted in transit over TLS and encrypted at rest. Connection tokens are held in Supabase Vault and decrypted only server-side during a sync. We apply strict access controls and only ever use read-only access to your accounting software. Read more on our Security page.

9Your rights (UK GDPR)

You have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data. To exercise any of these, email hello@taxsignal.co.uk and we'll respond within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk). ICO registration pending.

10Cookies

We use only essential cookies needed to run the service and keep you logged in. We do not use advertising or tracking cookies.

11Children

TaxSignal is for businesses and is not directed at anyone under 18.

12Changes & contact

We'll post any changes to this policy here with the date updated, and email you about material changes. Contact: GAJO Creative Ltd, [ADDRESS], hello@taxsignal.co.uk.