Privacy Policy – aligned.tax
Last updated: 11th September 2026
1. Who We Are
This Privacy Policy explains how Aligned Logic Ltd ("we", "our", "us") collects, uses, stores, and shares your personal data when you use the aligned.tax platform ("Service").
Data Controller: Aligned Logic Ltd Registered Address: 167-169 Great Portland Street, 5th Floor, London, W1W 5PF Company Number: 17081706 Data Protection Contact: hello@aligned.tax
We are not required to appoint a Data Protection Officer, but you may contact us at the address above with any data protection query.
2. What This Policy Covers
This policy applies to personal data we collect through the Service, our website at aligned.tax, and related communications. It applies to all users including individual taxpayers, accountants, bookkeepers, and agents using the Service on behalf of clients.
Where an accountant or agent uploads client data, the accountant or agent acts as the data controller for that client data and we act as a data processor. Our Data Processing Agreement governs that relationship separately.
3. Personal Data We Collect
3.1 Data you provide directly
- Full name and email address (account registration)
- Phone number (where provided for two-factor authentication)
- Organisation or practice name (where applicable)
- Unique Taxpayer Reference (UTR)
- National Insurance Number (where required for HMRC submissions)
- Business income and expense figures
- Financial data contained in uploaded spreadsheets
- Bank account or payment details (for subscription payments)
- Any correspondence you send us
3.2 Data we collect automatically
- IP address and approximate location for account security. IP addresses are HMAC-protected for correlation and encrypted for restricted investigation access
- Browser type and operating system
- Device identifiers and screen dimensions
- Pages visited and features used within the Service
- Timestamps of actions including submissions
- Referral source
3.3 Data collected for HMRC fraud prevention
HMRC legally requires all Making Tax Digital software to collect and transmit fraud prevention headers with every API request. This includes:
- Client IP address and port
- Device identifiers and screen dimensions
- Browser plugins and user agent string
- Timezone and local timestamp
- Multi-factor authentication status
This data is transmitted directly to HMRC and is not stored by us beyond the duration of the API request.
3.4 Data we receive from third parties
- HMRC: business details, obligation periods, submission confirmations, and calculation results retrieved via HMRC APIs following your authorisation
- Payment processor: confirmation of payment status (we do not store full card numbers)
3.5 Product analytics and session playback
The public website uses cookie-free aggregate website measurement to count visits and understand traffic sources. This measurement does not use cookies or persistent identifiers, and we do not use it to follow people across websites or days.
If you enable Analytics in the cookie settings, we also use a consent-based product analytics service on the public website. It records page views, approved campaign parameters, and clicks on links to app.aligned.tax. This is off until you actively consent. Session recording is disabled on the public website.
In the app, consented product analytics helps us understand where people complete or leave signup, onboarding, spreadsheet upload, mapping, review, and submission journeys. The service receives a pseudonymous browser or internal aligned.tax user ID, bounded milestone names, safe enum or count summaries, browser and device metadata, sanitised page addresses, constrained link and button interactions, and optional survey answers you choose to submit. Survey prompts ask you not to include tax figures or personal information in free text. Dynamic route identifiers, query strings, and fragments are removed from page addresses.
Masked session playback records layout and interaction patterns. All text, element attributes, and inputs are masked, and spreadsheet content, file and sheet names, cells and ranges, mapping values, tax and HMRC data, financial figures, receipt references, and other sensitive result areas are excluded from capture. We also collect page visits and page exits, dead and repeated clicks, and bounded technical categories for unhandled browser errors. Raw error messages, source context, console logs, network headers, and request or response bodies are not collected.
We do not enable form-change or form-submit automatic capture, heatmaps, performance capture, console recording, cross-origin iframe recording, or network payload capture. You can withdraw consent at any time using the Cookie settings link in the site footer or Settings > Help us improve aligned.tax. Withdrawal stops future analytics and session playback and clears analytics data stored in your browser. It does not affect the lawfulness of processing before withdrawal.
3.6 Account security evidence
For successful login and logout events, we may use a network-intelligence service to derive country, autonomous system number (ASN), network organisation, connection type, user type, and indicators for anonymous VPN, hosting provider, public proxy, residential proxy, and Tor exit node use. The service receives the source IP address over an encrypted connection when a cached result is not available.
These indicators are advisory evidence for human security investigations. They may be incomplete or inaccurate. We do not automatically suspend accounts or make legal or similarly significant decisions from location, hosting, VPN, proxy, residential, or Tor indicators.
4. How We Use Your Data and Our Lawful Basis
The UK GDPR requires us to have a lawful basis for each processing activity. The table below sets out our purposes and the corresponding lawful basis.
| Purpose | What we do | Lawful basis |
|---|---|---|
| Account creation and management | Register your account, authenticate you, manage your subscription | Performance of contract (Article 6(1)(b)) |
| Service delivery | Transform spreadsheet data, prepare financial summaries, transmit data to HMRC on your instruction | Performance of contract (Article 6(1)(b)) |
| HMRC submissions | Submit quarterly updates and other authorised MTD for Income Tax data to HMRC | Performance of contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)) |
| HMRC fraud prevention | Collect and transmit device and connection data as required by The Income Tax (Digital Requirements) Regulations | Legal obligation (Article 6(1)(c)) |
| AI categorisation | Provide automated categorisation suggestions for financial transactions | Performance of contract (Article 6(1)(b)) |
| Phone verification | Verify your phone number via SMS for two-factor authentication | Performance of contract (Article 6(1)(b)) |
| Audit and compliance | Maintain submission logs, user confirmations, and system event records | Legal obligation (Article 6(1)(c)) and legitimate interest (Article 6(1)(f)) |
| Security | Detect and prevent fraud, misuse, or security incidents | Legitimate interest (Article 6(1)(f)) |
| Error monitoring | Track application errors to maintain service reliability (with automatic PII redaction) | Legitimate interest (Article 6(1)(f)) |
| Aggregate website analytics | Measure public page visits and traffic sources without cookies or persistent identifiers | Legitimate interest (Article 6(1)(f)) |
| Product analytics and service improvement | Analyse consented public website visits, privacy-safe journey milestones and masked app session playback to improve the Service | Consent (Article 6(1)(a)) |
| Advertising measurement | Measure whether an online advert led to a registration or filing action, only after you enable advertising measurement | Consent (Article 6(1)(a)) |
| Communications | Send service notifications, submission confirmations, security alerts, and policy updates | Performance of contract (Article 6(1)(b)) |
| Customer support | Receive, track and respond to support enquiries, and keep a history of that correspondence | Performance of contract (Article 6(1)(b)) and legitimate interest (Article 6(1)(f)) |
| Customer relationship management | Maintain contact records, sales pipeline and engagement history to operate and improve the customer relationship | Legitimate interest (Article 6(1)(f)) |
| Marketing | Send product updates or feature announcements (only with your separate consent) | Consent (Article 6(1)(a)) |
| Payment processing | Process subscription payments and manage billing | Performance of contract (Article 6(1)(b)) |
Where we rely on legitimate interest, our interest is in operating and securing the Service. We have assessed that this does not override your rights and freedoms. You may contact us to request details of our balancing assessment.
5. AI and Automated Processing
The Service uses artificial intelligence to suggest categorisations for financial transactions and to assist with mapping spreadsheet columns to HMRC-required fields. This processing is automated but does not produce legal or similarly significant effects because:
- Suggestions are presented to you for review before any submission to HMRC
- You may accept, reject, or modify any AI-generated suggestion
- No submission to HMRC occurs without your explicit confirmation
When using AI features, we send transaction descriptions, column names, and category labels to our AI providers. We do not send National Insurance Numbers, names, or other direct personal identifiers to AI providers.
We do not use automated decision-making that produces legal effects without human intervention.
6. Who We Share Your Data With
We share personal data only where necessary to deliver the Service or where required by law.
6.1 HMRC
| Recipient | Purpose | Safeguards |
|---|---|---|
| HMRC | Submitting financial data and fraud prevention headers under Making Tax Digital | UK government body; data stays in the UK; legally mandated |
6.2 Service providers and other recipients
We use carefully selected service providers to operate and protect the Service. They may process only the information necessary to provide their services and must protect it under contract. We may share information with the following categories of recipient:
| Recipient category | Why information is shared | Types of information involved |
|---|---|---|
| Cloud hosting and storage services | Host, store, back up and deliver the Service | Account information, uploaded records, tax return information, service configuration and technical logs as necessary to operate the Service |
| Communications and customer-operations services | Send service and consented marketing messages, manage customer relationships, and receive and answer support enquiries | Contact details, communication content, consent records, engagement information and limited filing-status metadata |
| Payment and subscription services | Take payments, manage subscriptions and prevent payment fraud | Contact, order and subscription information and payment tokens; payment-card details are handled by the payment provider |
| Security, fraud-prevention and error-monitoring services | Protect accounts and the Service, diagnose faults and investigate abuse | Account identifiers, device and network information, security events and redacted technical logs |
| Analytics and advertising-measurement services | With consent where required, understand use of the Service and measure campaigns | Consent state, website or product usage, device and browser information, campaign attribution and pseudonymous identifiers; not tax return content |
| AI-assisted product services | Provide mapping, categorisation and other clearly identified AI-assisted features | Only the data required for the feature, such as transaction descriptions, column headings and category labels; not direct tax identifiers |
| Professional advisers, insurers, regulators and public authorities | Obtain advice, establish or defend legal claims, comply with law and make filings a customer authorises | The information reasonably necessary for the relevant purpose |
We do not sell your personal data to any third party. We do not share personal data for marketing purposes without your consent.
6.3 Changes to service providers
We may change individual providers within these categories. Where there is a material change in how a category of recipient processes personal data, we will update this policy and notify you by email or through the Service where appropriate.
7. International Transfers
Some service providers process information outside the United Kingdom. Where this happens, we rely on UK adequacy regulations or use approved contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as appropriate.
You may contact us for more information about the safeguards relevant to your information.
8. Data Retention
We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law.
| Data category | Retention period | Reason |
|---|---|---|
| Account data (name, email, phone) | Duration of account plus 12 months | Contract performance and reasonable follow-up |
| Submission records and audit logs | 7 years from date of submission | Tax record-keeping obligations |
| Financial data in spreadsheets | Duration of account; deleted on termination unless legal retention applies | Service delivery |
| HMRC authorisation tokens | Until revoked by user or expiry | Service delivery |
| Payment records | 7 years from transaction date | Financial record-keeping and tax obligations |
| Uploaded files | Duration of account; deleted on termination | Service delivery |
| Device and usage logs | 12 months from collection | Security and service improvement |
| Encrypted IP address evidence for account security | 90 days from collection | Time-limited human investigation of suspected account misuse |
| Account security event metadata, including 2FA events, HMAC-protected correlation values and derived network intelligence | 12 months from collection | Security investigation and incident accountability |
| Error-monitoring data | 90 days from collection | Diagnose faults and protect reliability |
| Customer relationship and marketing records | Duration of the relationship plus 12 months | Operate the relationship and demonstrate consent |
| Support correspondence | 24 months from closure | Maintain support history and resolve recurring issues |
| Advertising measurement consent state | Duration of the account | Demonstrating the current consent decision |
| Product analytics events | 12 months from collection | Understand and improve use of the Service |
| Masked session playback | 30 days from collection | Diagnose user-experience problems |
| Advertising-measurement identifiers and campaign attribution | Up to 90 days | Measure consented campaigns and prevent duplicate conversion records |
Upon account termination, we delete or anonymise personal data in accordance with the periods above, unless retention is required by law.
9. Your Rights
Under the UK GDPR, you have the following rights:
- Right of access – obtain a copy of the personal data we hold about you
- Right to rectification – correct inaccurate or incomplete personal data
- Right to erasure – request deletion of your personal data where there is no compelling reason to continue processing
- Right to restriction of processing – request that we limit how we use your data in certain circumstances
- Right to data portability – receive your personal data in a structured, commonly used, machine-readable format
- Right to object – object to processing based on legitimate interests or for direct marketing
- Right to withdraw consent – where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing
- Rights related to automated decision-making – not to be subject to a decision based solely on automated processing that produces legal effects (see section 5)
To exercise any of these rights, contact us at hello@aligned.tax. We will respond within one month. In certain circumstances we may extend this by a further two months, in which case we will inform you.
We will not charge a fee for responding to a request unless it is manifestly unfounded or excessive.
10. Right to Complain
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Website: ico.org.uk Helpline: 0303 123 1113
We would appreciate the opportunity to address your concerns before you contact the ICO.
11. Cookies and Tracking Technologies
Our website and Service may use cookies and similar technologies. Cookies are small text files placed on your device.
11.1 Essential cookies
These are necessary for the Service to function, including session management and authentication. They do not require consent.
11.2 Analytics cookies
We use optional analytics storage only after you enable Analytics. On the public website, this supports page-view and app-link measurement without session recording. In the app, it supports product analytics and masked session playback as described in section 3.5. We also measure aggregate public website visits without cookies or persistent identifiers.
11.3 Advertising measurement cookies
If you enable Advertising measurement, first-party cookies may be used for up to 90 days to connect an advert click with a later filing action and to pass bounded first-touch and latest-touch campaign information between our website and the Service. We do not use this choice for remarketing or personalised advertising.
Advertising and analytics storage are denied by default. When Advertising measurement is denied, the advertising-measurement technology is not loaded and no advertising-measurement request is sent.
11.4 Managing cookies
Use the Cookie settings link in the site footer to accept, reject or change optional purposes. In the app, you can also control product analytics through Settings > Help us improve aligned.tax. Withdrawing Advertising measurement consent immediately stops future measurement events, expires accessible advertising and campaign cookies, and deletes stored campaign attribution from aligned.tax. It does not affect the lawfulness of processing before withdrawal, and a conversion request already received by the advertising-measurement service cannot be recalled through the cookie control. You can also control cookies through your browser settings. Disabling essential cookies may affect your ability to use the Service.
12. Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encryption of data in transit (TLS) and sensitive data at rest (HMRC OAuth tokens are encrypted using AES-256)
- Role-based access controls with a six-tier permission hierarchy (Reviewer, Bookkeeper, Preparer, Supporting Agent, Main Agent, Client Owner)
- Centralised audit logging of all user actions, data access, and HMRC submissions
- Automatic PII redaction in application logs (NINOs, emails, IP addresses, phone numbers, and sensitive fields are masked before logging)
- IP address hashing in user activity records
- Rate limiting and abuse prevention on API endpoints
- Regular review of security practices and dependency updates
No system is completely secure. We cannot guarantee absolute security but we take reasonable steps to protect your data.
13. Children
The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it promptly.
14. Third-Party Links
The Service may contain links to third-party websites including HMRC. We are not responsible for the privacy practices of these websites. We encourage you to read their privacy policies.
15. Changes to This Policy
We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email or through the Service before the changes take effect.
The date at the top of this policy indicates when it was last updated.
16. Contact Us
If you have questions about this Privacy Policy or wish to exercise your rights, contact us at:
Email: hello@aligned.tax Post: Aligned Logic Ltd, 167-169 Great Portland Street, 5th Floor, London, W1W 5PF