Privacy Policy | Simple Returns

This policy explains what personal data we collect when you use SimpleReturns, why we collect it, how long we keep it, and the rights you have over it under the UK GDPR and the Data Protection Act 2018. It works alongside our Terms of Service, neither one stands on its own.

1. Who's responsible for your data

$IMPLE RETURNS LTD (the Company, we, us) is the data controller for the personal data described in this policy. We are a private limited company registered in England and Wales under company number 17263315, registered with the Information Commissioner's Office (ICO).

Our Data Protection contact is [email protected]. We respond to data-subject requests within one month, as required by Article 12 of the UK GDPR.

2. What personal data we collect

About you (the user):

Your name, email address, and any other contact details you give us when you create an account or contact support.
Authentication metadata: when you log in, the device/browser you log in from, and the IP address of that session, and, while you are signed in, the fact that your session is active and which area of the app you are using, so we can operate and support the service.
Payment metadata: the timestamp, amount and reference of any submission fee you pay. We do not see or store your full card details, those go directly to our payment processor Stripe.
Support correspondence: any emails, messages or call notes exchanged with our support team.
If you arrive from a Google ad and you say yes when we ask, we keep Google's click reference for up to 90 days so we can tell Google the ad worked if you sign up or pay. If you say no, nothing is kept at all. It is deleted after 90 days either way, and we never send Google your name, email, or anything else about you. See section 10 to change your answer.

About anyone who visits the site, whether or not they have an account:

Which pages were visited and in what order, tied together by a one-way fingerprint of the connection and browser rather than by a name. When an account is first created, we use that fingerprint once to increment a limited count by first-visit day, source and landing page. We do not store the fingerprint on your account or retain a link between your account and the fingerprint.
Which filing-start interactions you choose, using only a fixed interaction label; we do not send what you type and never join these records to your account.
Roughly where the visit came from: the country and the approximate city your internet connection appears to be in, worked out at the moment of the visit. We do not store the IP address itself alongside these visit records.
The kind of device and browser used, and the site that linked you to us.

About your company (which may include personal data about other directors, employees or counterparties):

Company number, registered office and the company's public Companies House record.
The Companies House Authentication Code you provide so we can transmit returns on the company's behalf.
Bank statement transactions you upload or enter manually: date, description (which may include counterparty names), amount, and any classification notes.
Year-end figures you enter: receivables, payables, opening balances, stock, capital allowance claims, charitable donations, losses carried forward, director's loan account balances.
The director's name and confirmation tick recorded when you sign and submit a return.

3. Where we get it from

Most data comes directly from you, what you type or upload into the wizard. We also pull public Companies House data (your company's record, directors and historic accounts) from the Companies House public APIs. Where you have previously filed accounts via Companies House, we read the prior-year micro-entity iXBRL so the wizard can show comparatives.

4. Why we use it (and our lawful basis)

UK GDPR requires us to identify a lawful basis under Article 6 for every use of your personal data. Ours are:

Performing our contract with you (Art 6(1)(b)). Preparing and transmitting your Corporation Tax return and accounts is the service you signed up for. Without your personal data and your company's financial data we cannot do it.
Compliance with a legal obligation (Art 6(1)(c)). HMRC and Companies House require us to keep records of what we transmitted on your behalf, and the Money Laundering Regulations require certain checks. We hold transmission records for the periods set out in section 7 of this policy.
Consent (Art 6(1)(a)). One thing only: keeping the advertising click reference described in section 2, which we ask about on screen when it applies and never take without a yes. You can withdraw it whenever you like in section 10, and nothing else about the service depends on it.
Legitimate interests (Art 6(1)(f)). We use limited operational data (error logs, pseudonymised usage statistics, including per-visit page sequences keyed to a one-way browser fingerprint and the once-only account-creation count described in section 2, and security audit trails) to keep the service running safely and to improve it. The account-creation count retains no account, visitor fingerprint or link between them. Our balancing assessment concluded these uses do not override your interests; you can object at any time using the contact details in section 1.

5. AI processing

To read your statements and to assist categorisation and explanation, your data is sent to third-party large-language model providers under our standard processor agreements. A PDF or photo of a statement is sent whole, so the provider sees everything on the page, including account numbers, sort codes and names. For Word and spreadsheet uploads, and for every categorisation request, we first apply automated redaction to remove full bank account numbers, sort codes, card numbers and National Insurance numbers. Personal names are not removed. No automated redaction is perfect, please avoid uploading statements containing data you would not want a processor outside the UK to see. Our model providers are contractually prohibited from training on our data and do not retain personal data beyond the immediate request/response cycle.

Our in-app help assistant answers your questions about using the service from a curated library of our own guidance and quoted official HMRC / Companies House material; it does not browse the internet and has no access to your tax data. To improve our help, we store the questions you ask it (together with the step and field you were on and whether we had an answer). Please do not type personal or sensitive details into the help assistant. Your question is sent to our large-language model provider on the same terms described above to generate the answer.

6. Who we share it with

We do not sell your personal data. We share with a small number of processors strictly to deliver the service:

HMRC, recipients of the Corporation Tax return you authorise us to submit.
Companies House, recipients of the micro-entity accounts you authorise us to submit.
Stripe, our PCI-DSS-compliant payment processor (for submission fees).
Resend, an email provider that sends your sign-in links and some support emails.
Google, in three ways: Gmail sends your filing receipts (with copies of your filed return attached) and other emails about your filings; Google Drive holds the encrypted copies of our database backups and server logs (see section 11); and Gemini is the large-language model we use, see section 5 above for what is and isn't sent.
Telegram, which passes the messages you send through the in-app support chat or feedback form, with your name, your email address and the company you are asking about, to our support team.
Hostinger, our hosting provider; the database and application servers are presently in a London data centre.

We disclose data to law-enforcement or other public authorities only where we are legally required to do so (for example, under a court order or a valid HMRC information notice).

7. How long we keep it

Filed submissions, source transactions and the iXBRL we transmitted, kept for six years from the end of the accounting period to which they relate, then deleted, in line with HMRC's record-keeping rule for limited companies (s.388 Companies Act 2006 and Sch.18 para 21 FA 1998).
Your account and contact details, for as long as you have an account. When you delete your account we remove them from it straight away; the copy kept in your account identity history (below) is kept for six years, then deleted.
Account identity history, a log of changes to the name and email address on your account, including the values held at the point an account is deleted, kept for six years from the change (or from the day the account is deleted), then deleted, so we can maintain an accurate record for regulator and audit queries.
Payment records, kept for six years from the payment date, then deleted, for HMRC/VAT-record purposes.
Activity and security logs, the audit trail of what happened on each return, together with authentication metadata (when and from where you signed in), kept for six years alongside the filing it relates to, then deleted, so we can answer regulator and audit queries. The one exception is the repeated "is it done yet?" checks we make while waiting for HMRC's answer, which we clear out; the outcome HMRC gave is kept with the filing.
Support correspondence, the messages you send us through the support chat or by email, kept for six years from your last message, then deleted.
Backups and server logs, encrypted copies of our database and our server logs, which hold some of the data above. We keep every day's copy for 30 days, then one a week, one a month and one a year, and the last copies are deleted after about 7 years. Data removed from your account stays in older copies until they are deleted.
Account-creation usage counts are kept for 90 days and may remain until that limit after account deletion. Because we do not retain a link to the account, we cannot identify which aggregate count came from a particular deleted account.

8. International transfers

Our database and application servers are in the UK. The encrypted copies of our backups and server logs are held on Google Drive, which does not let us choose the country, so they may be stored outside the UK, including in the United States; they are encrypted before they leave our server. Some of our processors (Google, Telegram and certain Stripe sub-processors) process data outside the UK, including in the United States. Where transfers leave the UK, they rely on the UK International Data Transfer Agreement (or the equivalent EU Standard Contractual Clauses recognised under the UK GDPR), plus additional technical safeguards (in-transit encryption, the redaction described in section 5). The named processors are listed in section 6 above; changes are notified per section 13.

9. Your rights

Under the UK GDPR you have the following rights over your personal data:

Right of access, a copy of the personal data we hold about you.
Right to rectification, correction of inaccurate or incomplete data.
Right to erasure ("right to be forgotten"), deletion of your data where there's no overriding legal basis to keep it. Filed tax returns and supporting records may need to stay on file for the retention periods in section 7 even after account deletion, because we are legally obliged to keep them.
Right to restriction of processing.
Right to data portability, your data in a structured, machine-readable form.
Right to object to processing based on legitimate interests.
Right to withdraw consent, where we relied on consent. We rely on it for one thing, the advertising click reference in section 2, and section 10 has a button that withdraws it. Nothing you need the service to do depends on consent.
Right not to be subject to a decision based solely on automated processing, our wizard's AI suggestions are not solely-automated decisions; you review and confirm everything before submission.

You can delete your account yourself at any time from Settings. When you do, we anonymise your personal details (we blank your name and replace your email with a non-identifying placeholder) and disable sign-in, and we delete your HMRC connection. We retain the filed returns, supporting records and the account identity history described in section 7 for the legally required period, because we are obliged to keep them.

To exercise any of these rights, email [email protected]. If you're not happy with how we handle your request, you have the right to lodge a complaint with the Information Commissioner's Office. We'd ask you to come to us first, but it isn't a precondition.

10. Cookies and similar technologies

We do not use advertising cookies, social-media trackers, or behavioural-analytics cookies anywhere on this site. The only cookies we set are needed to sign you in and are short-lived: two that last ten minutes, one stopping your Google sign-in from being tampered with and one tying that sign-in attempt to our security log, and a third that keeps a member of our own team signed in to our internal tools. A cookie banner is not legally required for these under PECR.

Separately, we keep some things in your browser's own storage rather than in a cookie: what keeps you signed in as you move between screens, the return you are part-way through so that closing the tab does not lose it, which company you last worked on, a few reminders of what you have already seen so we do not show it twice, and, if you arrived from one of our ads, Google's click reference described in section 2.

While you are filing, your Companies House Authentication Code and your Government Gateway sign-in are held in your browser too, for that browsing session only, so we do not have to ask you for them again on the next screen. Your browser erases them when you close the tab.

The advertising click reference is the one thing on that list we ask about first, because it is the only one not needed to run the service. If you arrived from one of our ads we show a short question at the bottom of the page, and we keep your answer so we do not ask again. The answer expires after a year, and you can change your mind here at any time:

We have no answer from you, so nothing is stored.

11. Security

All data in transit uses HTTPS (TLS 1.2 or higher). Daily Postgres backups are encrypted with AES-256-GCM on our own server, kept there, and also copied to Google Drive (see section 8). Sensitive identifiers (Companies House Authentication Codes, session tokens) are stored in our UK database under restricted application-level access. Access to production systems is limited: only a small number of named engineers can reach our live servers. You are responsible for keeping your magic-link email inbox and your Companies House Authentication Code confidential, see section 6 of the Terms.

12. Children

SimpleReturns is intended for UK company directors and so is not marketed at children. We do not knowingly collect data about anyone under 18.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page with a new "last updated" date, and where the change is material we will email you in advance. Continued use of the service after a change takes effect is acceptance of the new policy.

14. Contact

Any question about this policy, including a request to exercise one of the rights in section 9, should go to [email protected]. General support enquiries go to [email protected].