Privacy Policy

1. Who we are

Tax Sole Trader is a bookkeeping, VAT, CIS and Self Assessment app built for UK sole traders, published by Kamertonix Ltd ("Tax Sole Trader", "we", "us", "our"). We are the data controller for the personal information described in this policy.

• ✓Registered address: 13 Stilwell Close, Orpington, England, BR5 3FA
• ✓Company number: 17240499
• ✓ICO registration number: CSN6915594

2. Scope of this policy

This policy explains what information Tax Sole Trader handles, why, where it is stored, who else (if anyone) processes it, and what rights you have over it. It applies whether you use the app entirely offline or choose to enable any of its optional online features (cloud account, bank connection, HMRC connection, or a paid subscription).

It does not apply to any other product, website, or service, even if operated by us, unless linked directly from this document.

3. Information we collect

Tax Sole Trader is a bookkeeping tool, so most of what it "collects" is information you type in or import yourself, for your own records. We group it here by category, matching how it is actually used inside the app.

3.1 Personal and business identity information

• ✓Your name and business name
• ✓Business address
• ✓Email address and phone number
• ✓UK Unique Taxpayer Reference (UTR), National Insurance number (NINO), and VAT registration number, where you choose to enter them

3.2 Financial and tax information

• ✓Income and expense transactions you record or import
• ✓Invoices and the client/employer details you attach to them
• ✓VAT, CIS (Construction Industry Scheme), and Self Assessment figures calculated from your records
• ✓Mileage logs and vehicle details
• ✓Bank statement data you choose to import (CSV/PDF) or, if you connect a bank account, transaction data retrieved on your behalf (see section 7)

3.3 Files and documents

• ✓Photos of receipts, invoices, ID documents and certificates you attach
• ✓Generated PDF/CSV exports (invoices, VAT returns, Self Assessment summaries, accountant packs)
• ✓Imported bank statement files

3.4 App diagnostics and support information

• ✓Local data health and readiness indicators generated on your device (e.g. whether required settings are complete)
• ✓Export/backup history metadata (e.g. when a backup was last created)
• ✓Crash reports from release versions of the app (error message, stack trace, device model, OS and app version), sent to Sentry without personal identifiers, screen contents or financial figures (see section 12)

Tax Sole Trader does not collect your contacts, precise or approximate location, SMS/call logs, microphone or camera audio/video (only the photos you deliberately capture or select), health data, or an advertising identifier. If a future version of the app adds any of these, this policy — and the Google Play Data Safety declaration — will be updated first.

4. How we use your information

We use the information described above only to:

• ✓Perform the bookkeeping, VAT, CIS, mileage and Self Assessment calculations you use the app for
• ✓Generate the invoices, reports and exports you request
• ✓Let you back up your records and, if you choose, use the app across more than one device
• ✓Provide customer support when you contact us
• ✓Maintain the security and reliability of the app
• ✓Meet our own legal obligations, such as responding to a valid request from a regulator or law enforcement body

We do not sell your information, and we do not use it to build an advertising profile of you.

5. Local-first storage — how the app works by default

Tax Sole Trader is designed to work fully offline. By default, everything you enter — transactions, invoices, expenses, mileage, organizer items, settings — is stored only on your own device, in an encrypted database in the app's private storage. No account is required to use these core features, and nothing is uploaded anywhere unless you deliberately choose one of the optional online features described below.

Because this data lives on your device, you are responsible for keeping your device secure (e.g. using a screen lock) and for backing up your records — the app includes a manual backup/export feature for exactly this purpose.

6. Optional cloud account and sync

If you choose to create an account (for backup or to use the app on more than one device), your records are synchronised to secure cloud infrastructure operated on our behalf by our backend provider (see section 12). This is entirely optional — declining or ignoring this feature has no effect on the app's core offline functionality.

When cloud sync is active:

• ✓Your data is associated with your account and is not visible to other users of the app
• ✓Access to your records in transit and at rest is protected using industry-standard encryption and access controls
• ✓You can request deletion of your cloud-stored data at any time (see sections 15–16)

You can sign in with an email and password, or using your Google account (see section 10).

7. Optional bank connection (Open Banking)

Tax Sole Trader offers an optional bank connection feature, allowing transaction data to be retrieved directly from your bank via regulated UK Open Banking infrastructure, instead of you importing statement files by hand. This feature is opt-in: it is never activated without you explicitly choosing to connect a specific bank account.

Where this feature is used, our Open Banking provider, Enable Banking, facilitates the secure connection between your bank and the app; we never see or store your online banking password. You can disconnect a connected bank account at any time from within the app, which stops any further data retrieval from that account.

Imported bank transactions are treated the same as any other transaction in the app: stored locally (and in your cloud account, if enabled), and never shared with anyone beyond what this policy describes.

7.1 Reading a PDF bank statement with AI (optional)

If you upload a PDF bank statement and choose the AI statement reader, the file is sent to Google Cloud Vertex AI (Gemini) on a paid Google Cloud plan, which extracts the transactions and the statement's own totals so the app can check its reading. Under Google Cloud's terms the content is not used to train Google's models and is not kept after it has been read; this processing may take place outside the UK. The app does not keep the PDF — only the transactions you choose to import are saved. If you prefer, you can enter transactions manually or use a bank connection instead.

8. Connecting to HMRC (Making Tax Digital)

If you choose to connect your Government Gateway account, the app can retrieve your VAT obligations and submit VAT returns, and submit quarterly Income Tax updates, directly to HMRC, as part of the UK's Making Tax Digital service. This connection uses HMRC's own official OAuth authorisation flow — you sign in directly with HMRC (via Government Gateway), and we never see or store your Government Gateway credentials.

Where required by HMRC for this connection method, the app also collects a small set of technical "fraud prevention" details (such as device identifier, timezone, and screen dimensions) and sends them to HMRC alongside each request, exactly as HMRC's Making Tax Digital specification requires of all compliant software. These include a device identifier, your device's local and public IP addresses, screen size, window size, time zone, operating system and device model, and your app account email as the user identifier.

9. Receipt and document scanning (OCR)

When you photograph a receipt, certificate or ID document, the app reads it using on-device text recognition (Google's ML Kit, running locally on your phone). The photo is never uploaded anywhere for this purpose — recognition happens entirely on your device, with no internet connection required and no image data sent to us, to Google, or to anyone else. Any supplier, amount, date or document details the app fills in automatically are always shown to you, editable, before anything is saved.

10. Signing in with Google

If you choose to sign in using your Google account, Google shares your name and email address with us (via our backend provider's authentication system) so that we can create or recognise your account. We do not receive your Google password, and we only request the minimum access needed to confirm your identity.

11. Subscriptions and payment

Paid subscription features are billed through Google Play Billing on Android and the Apple App Store on iPhone and iPad. Google or Apple processes your payment details directly — we never see or store your card number or other payment credentials. We receive only confirmation of your subscription status (e.g. active, cancelled, expired) and the store's transaction reference so the app can unlock the relevant features. Deleting your account does not cancel a store subscription: cancel it in Google Play or the App Store.

11A. Sharing with your accountant and invoice links

If you invite an accountant, only the categories you allow (for example invoices, transactions, VAT or MTD reports, or your business profile including NINO and UTR) are copied to our cloud so that your accountant can see them in the accountant portal. You can change the categories or revoke access at any time; revoking removes their access immediately and deletes the shared copies. We keep a record of when your accountant accessed your records.

If you share an invoice by link, anyone with that link can open the invoice until you revoke the link in the app.

12. Third parties who process data on our behalf

We use a small number of specialist providers to operate the app. Each is bound by its own data processing terms and only processes data for the specific purpose described here — none of them are permitted to use your data for their own advertising or other unrelated purposes.

We do not use any advertising or behavioural-tracking SDKs, so no data is shared with advertising networks.

13. Our legal basis for processing your information

Under UK GDPR, we rely on the following legal bases, depending on the feature:

• ✓Performance of a contract — to provide the core bookkeeping features you've asked to use, including any paid subscription
• ✓Consent — for optional features you actively choose to turn on, such as cloud sync, bank connection, the AI statement reader, sharing with your accountant, or Google Sign-In; you can withdraw this consent at any time by disabling the feature
• ✓Legal obligation — the fraud prevention information HMRC requires with every Making Tax Digital request, and where we must retain or disclose information to comply with UK law (e.g. a lawful request from HMRC or a court)
• ✓Legitimate interests — for keeping the app secure and reliable (including crash diagnostics), in a way that does not override your own privacy rights

14. How long we keep your information

Records stored locally on your device remain there until you delete them, uninstall the app, or use the account/data deletion feature described in section 16 — this is entirely under your control.

For your own reference: HMRC generally requires self-employed taxpayers to keep business records for at least 5 years after the 31 January submission deadline of the relevant tax year. The app does not enforce this for you, but we recommend not deleting records you may still need for this reason.

If you use the optional cloud account, we retain your cloud-stored data for as long as your account remains active. Deleting your account in the app deletes it immediately, together with your cloud backups, shared accountant copies, HMRC and bank connections, and the record of your HMRC submissions — so export a copy first if you still need it.

• ✓Cloud backups: your latest 3 backups plus your fullest one; older backups are deleted automatically
• ✓HMRC connection: until you disconnect or delete your account; HMRC's own permission lasts up to 18 months
• ✓Bank connection: until you disconnect, your consent with the bank expires, or you delete your account
• ✓Crash reports: kept by Sentry for a limited period, then deleted automatically

15. Your rights

Under UK data protection law, you have the right to:

• ✓Access the personal information we hold about you
• ✓Correct inaccurate or incomplete information (most fields in the app can simply be edited directly)
• ✓Export your data in a portable format
• ✓Request deletion of your information, subject to any legal retention obligations described in section 14
• ✓Object to or restrict certain processing, in particular anything based on consent (see section 13) — you can withdraw consent at any time
• ✓Complain to the Information Commissioner's Office (ICO) if you believe we have not handled your information properly — see ico.org.uk

16. How to exercise your rights

For data stored only on your device, you have direct control at all times: every record can be viewed, edited or deleted from within the app, and Settings → Account & Cloud includes a dedicated data export and account/data deletion request tool.

For anything we hold on our servers (i.e. only if you have enabled a cloud account), contact us using the details in section 22 and we will respond within one month, as required by law. We may need to verify your identity before actioning a request.

If you have a question or concern specifically about how we handle your personal data, you can also contact Iulian at Kamertonix Ltd directly, using the details in section 22.

17. How we protect your information

• ✓Local records are kept in an encrypted database with a key held in the device's secure storage (Android Keystore / iOS Keychain), plus the app's own PIN lock if you set one
• ✓Cloud backups are encrypted (AES-256-GCM) before they leave your device
• ✓Cloud-stored data (if enabled) is encrypted in transit (HTTPS/TLS) and at rest, with database-level access rules ensuring one user's records are never visible to another
• ✓We do not embed any server-side secret keys inside the app itself
• ✓Bank and HMRC connections use official, regulated OAuth flows — we never see or store your banking or Government Gateway password
• ✓We maintain a documented internal process for identifying, containing and reporting any security incident to the relevant authorities within the legally required timeframes

No method of storage or transmission is 100% secure, but we design and review the app specifically to minimise risk to your data.

18. International data transfers

If you enable cloud sync, your data is processed on servers operated by our backend provider, Supabase, in their West EU (Ireland) region, and crash reports are held in Sentry's EU data centre. Transfers to the EEA are covered by the UK's adequacy regulations. If you use the AI statement reader, Google Cloud may process the statement outside the UK under its data processing terms, which include the safeguards UK law requires for international transfers.

19. Children's privacy

Tax Sole Trader is a business/tax tool intended for adult sole traders and is not directed at, or knowingly used to collect information from, children. If you believe a child has provided us with personal information, please contact us so we can remove it.

20. No advertising or behavioural tracking

Tax Sole Trader does not display third-party advertising and does not use analytics or tracking SDKs to build a profile of your behaviour across other apps or websites. Local diagnostics (see section 3.4) stay on your device; crash reports from release versions go to Sentry only to help us fix problems, without personal identifiers.

21. Changes to this policy

We may update this policy from time to time, for example if we add a new feature that changes what data the app collects. We will update the "Last updated" date at the top of this page, and where a change is significant, we will make reasonable efforts to bring it to your attention within the app before it takes effect.

22. Contact us

If you have any question about this policy or how your information is handled, contact us at:

• ✓Email: support@taxsoletrader.com
• ✓Postal address: Kamertonix Ltd, 13 Stilwell Close, Orpington, England, BR5 3FA