Privacy Policy

1. Who we are

SimpleCompanyTax is a trading name of Infuzest Ltd (“we”, “us”, “our”), a company registered in England and Wales (Company No. 15370218) with its registered office at 167–169 Great Portland Street, 5th Floor, London, England, W1W 5PF. We provide a digital tax compliance platform designed to help UK micro companies, sole traders, and landlords meet their statutory reporting obligations, including Making Tax Digital requirements. For the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, we act as the data controller for personal data collected through our platform. If you have any data protection queries, you may contact us at: privacy@infuzest.co.uk.

Our services are intended for businesses and the individuals who run or represent them; they are not directed at individuals under 18 years of age.

2. The data we collect

We may collect and process the following categories of data:

• 2.1 Identity and contact data — Name, email address, account credentials, communication records.
• 2.2 Business and tax data — Company information (e.g. company number), tax reference numbers, financial records and accounting information, filing data required for tax submissions.
• 2.3 Financial transaction data (where connected) — If you connect a bank account, we may receive transaction data including transaction descriptions, amounts, dates, account identifiers. We do not collect or store online banking passwords or security credentials.
• 2.4 Technical data — IP address, device information, browser type, usage logs, security and audit logs.
• 2.5 Help search queries. The words you type into the search box on our support page, so we can see which questions people ask and which ones our help content fails to answer. We store the text of the query, how many results it returned, and whether a result was opened. We do not store your name, email address or IP address alongside it, we do not use it to identify you, and it is never sent to Google or any other advertising provider. Please do not type personal or financial details into the search box, as you would not into any search engine.
• 2.6 Support requests. When you contact us through the support form we keep a record of what you sent: your email address, the subject and description, the topic and urgency you chose, and any company number or tax reference you included. We use it to answer you and to see which questions come up often enough that we should write a public guide about them. Records are kept for 24 months. Attachments are not stored in this record.
• 2.7 Technical error records. When something goes wrong in the app, or when we have to stop you continuing because a return falls outside what we can file, we record what happened so we can fix it quickly instead of waiting for someone to tell us. Each record is a short, fixed set of facts we have chosen in advance: a reference for the kind of problem, the page you were on, your company number, and selected settings that were on screen at the time, because without those we cannot reproduce the problem. For a signed-in technical failure, we may also keep a capped technical error message and stack trace showing the application code, file and line where it failed. If you are not signed in, we keep only the script file addresses, function names and line numbers from that stack trace, without the error message or any web address query. These error records do not save a copy of the request or filing form your browser sent us. Structured credential fields are excluded, and credential-shaped technical text such as keyed password values, Government Gateway or Companies House authentication codes, bearer tokens and access tokens is scrubbed before it is saved. These records are visible only to our own staff, are never sent to Google or any other advertising provider, and are deleted automatically after 180 days. Our internal alerts about them contain only an error reference and a count, never your data.

Financial import diagnostics. When you import a spreadsheet, we record the parsed sheets, account names, codes, amounts, column settings, mapping choices, warnings and technical failures to investigate import problems. These financial details are not anonymised. The original CSV or Excel file is processed in your browser and is not uploaded or stored. Diagnostic records are linked to your signed-in account and import attempt, available to you and authorised staff, never sent to Google or other advertising providers, and deleted after 180 days. Credentials are excluded. Size limits and interrupted connections can prevent a diagnostic snapshot being recorded.

Private wizard usage markers. We record limited markers when you edit wizard fields, such as entering zero, another number, clearing a field or selecting an option. After you submit a filing for processing, we also try to record field-state markers from the saved figures bound to that submission. These markers contain field identifiers and states, not amounts, names, dates, notes, uploaded content or submission credentials. They are linked to your signed-in account, browser journey and filing where available, used to improve the wizard, kept privately and deleted after 180 days. They are not sent to Google or other advertising providers. Capture can be incomplete. A saved zero does not always tell us whether you entered zero or left a field blank.

3. How we use your data

We process personal data to: provide access to our platform; generate statutory tax filings and financial reports; submit authorised filings to HMRC and Companies House; maintain digital tax records; categorise financial transactions; provide tax summaries and estimates; improve system reliability and security; prevent fraud and misuse; comply with legal and regulatory obligations. We do not use financial data for advertising, credit scoring, lending decisions, or marketing profiling. We do not make decisions that produce legal or similarly significant effects about you solely through automated processing — tax estimates, transaction categorisation, and generated filings are tools prepared for your review and authorisation, not final automated determinations.

4. Open Banking and data aggregation

If you choose to connect your bank account, we use FCA-authorised Open Banking providers where applicable, or other regulated financial data providers, to retrieve financial transaction data securely and with your explicit consent. Authentication is performed directly with your bank through secure redirection flows. We use retrieved transaction data solely to maintain digital records, categorise income and expenses, generate tax summaries, and support authorised submissions to HMRC. You may revoke access at any time via your bank or within our platform settings. We do not sell, rent, or commercially exploit your financial transaction data.

5. Lawful basis for processing

Under UK GDPR, we rely on: Contractual necessity – to provide our services. Legal obligation – to comply with tax and accounting regulations. Legitimate interests – to operate, secure, and improve our platform. Consent – where required, including for Open Banking data access.

The basis we rely on depends on the activity:

6. Data sharing

We will never sell your personal data, tax information, accounting records, banking transaction data, or filing information to third parties. We may share data only where necessary with: HMRC and Companies House for authorised submissions; regulated Open Banking or financial data providers (with your consent); cloud infrastructure and hosting providers; analytics and advertising-measurement providers (Google, via Google Analytics and Google Ads); professional advisers (legal, accounting); regulatory or law enforcement authorities where required by law. All service providers are required to implement appropriate security safeguards.

Google receives usage data such as the pages you visit, your device and browser, and approximate city-level location. If you subscribe after clicking one of our adverts, we may also report that purchase to Google from our servers to measure advertising effectiveness. The report includes the plan price and currency, a subscription reference number, the time of the purchase, the advert click identifier and your cookie consent choice. It never includes your name or email address, your accounting records, your bank transactions or anything from your tax return or accounts. Google's analytics tag loads for all visitors, but until you accept analytics cookies it runs in a cookieless mode: it sets no cookies, cannot identify you or link your visits together, and sends only aggregate, non-identifying signals. Accepting analytics cookies enables its full behaviour. See our Cookie Policy for details, and you can withdraw consent at any time.

7. Data security

We implement appropriate technical and organisational measures including: encryption in transit using TLS 1.2 or higher; encryption at rest within managed cloud environments; role-based access control; multi-factor authentication for administrative access; secure environment variable management; least-privilege access policies; audit logging and monitoring. We rely on reputable managed cloud providers that maintain industry-standard security certifications.

8. Data retention

We retain personal and financial data only for as long as necessary to provide our services, comply with statutory record-keeping requirements, and meet tax and accounting obligations. Financial and tax records are retained for the period required by applicable tax and accounting laws, which will generally be at least 6 years and may be longer where legally required (for example, during an open enquiry or dispute). Where legally permissible, you may request deletion of your account and associated data.

Help search queries (section 2.5) are kept for 180 days and then deleted automatically. Support request records (section 2.6) are kept for 24 months. Technical error records (section 2.7) are kept for 180 days and then deleted automatically.

9. International transfers

Some service providers may process data outside the UK. Where international transfers occur, we ensure appropriate safeguards are in place in accordance with UK GDPR, including standard contractual clauses or equivalent protective measures.

10. Your rights

Under UK GDPR, you have the right to: request access to your personal data; request correction of inaccurate data; request erasure (subject to legal obligations); restrict or object to processing; data portability; withdraw consent (where consent is the lawful basis); lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters (ico.org.uk).

11. Contact

For any privacy-related questions: privacy@infuzest.co.uk.

12. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date above reflects the most recent revision.