Legal
Plain English, no surprises. This explains what we collect, why, and your rights.
Doddletax is a product of IT All Figures Limited, a company registered in England & Wales (company number 08097120), registered office 14 Coningsbury Lane, Shortstown, Bedfordshire, MK42 0PW. For data we decide how to use (your Doddletax account, the early-access list, this website), we are the data controller. Contact us at hello@doddletax.com.
Doddletax is used by accountancy firms to view and manage their clients' tax positions. For the client records and tax data a firm brings into Doddletax, the firm is the data controller and we act as their data processor, handling that data only on the firm's instructions, under a data processing agreement available to every firm. If you are a client of a firm that uses Doddletax and want to exercise your data rights over that information, your accountant is the right first contact; we will help them respond.
| Data | Why | Lawful basis |
|---|---|---|
| Account details: your name, work email, firm name, password (stored hashed) and multi-factor authentication settings (stored encrypted) | To create and secure your account | Contract |
| Client records a firm syncs or uploads: names, contact details, tax references (e.g. UTR, VAT number), entity details | To provide the service to the firm | Processed for the firm (controller); the firm's basis is typically legitimate interests or contract |
| Tax position data from HMRC: liabilities, payments, obligations, penalties for the firm's authorised clients | To show each client's live position and power reminders | Processed for the firm, using the firm's own HMRC agent authorisations |
| Early-access / waitlist details: firm name, size band, work email | To contact you about early access (nothing else) | Legitimate interests / consent |
| Usage and audit logs: who accessed what and when | Security, support and accountability | Legitimate interests |
| Device and connection data sent to HMRC (see section 4) | Legally required fraud prevention | Legal obligation |
When Doddletax communicates with HMRC's APIs, UK law (The Delivery of Tax Information through Software (Ancillary Metadata) Regulations 2019) requires us to send HMRC certain information about the device and connection used to trigger that activity. This includes your browser's user-agent, screen and window dimensions, timezone, a device identifier, your public IP address and port, your Doddletax user identifier, and the time and type of your multi-factor sign-in (as a one-way reference, not your actual codes). This data goes to HMRC only, exists to protect taxpayers against fraud, and we cannot offer an opt-out. It is a condition of using HMRC's services.
The platform runs on Microsoft Azure infrastructure in the UK (UK South region) with managed database services. Sensitive credentials and tokens are encrypted at rest; all connections are encrypted in transit. Each firm's data is isolated from every other firm's, access is role-based, and every access to client data is logged.
We do not sell personal data, and we do not share it with advertisers.
If a firm chooses to connect a Google (Gmail / Google Workspace) mailbox so that client emails send from their own address, Doddletax requests only the send-email permission (gmail.send) plus the firm user's basic profile (name and email) to confirm which mailbox is connected. We use this access solely to send the emails the firm has configured, such as automated birthday greetings, on the firm's behalf. We never read, search, download, store, modify or delete any message in the mailbox, and we do not use Gmail data for advertising or any other purpose. The connection token is stored encrypted and the firm can disconnect at any time.
Doddletax's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Account data is kept while your account is active and deleted or anonymised within 90 days of account closure, except where the law requires longer. Records of VAT returns filed through Doddletax (including HMRC's submission receipts) are retained for the period required by tax law. Audit logs are kept for up to 6 years. Waitlist details are deleted on request or once no longer needed.
We use only essential cookies: a session cookie to keep you signed in, a security cookie during sign-in flows, and a device identifier cookie that exists solely to meet HMRC's fraud prevention requirements (section 4). No advertising or cross-site tracking cookies.
Under UK GDPR you can ask us for access to, correction of, deletion of, or a portable copy of your personal data, and you can object to or ask us to restrict certain processing. Email hello@doddletax.com and we will respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk, though we'd appreciate the chance to put things right first.
If a personal data breach occurs that puts people at risk, we will notify the ICO within 72 hours, notify HMRC where their data is involved, and tell affected firms without undue delay so they can inform their clients.
If we change this policy materially we will tell account holders by email and update the date at the top. The current version always lives at doddletax.com/privacy.html.