Privacy Policy

Last updated: July 2026

Quarterly Filer ("we", "us", "our") provides software that helps self-employed people and landlords meet their Making Tax Digital for Income Tax obligations with HMRC. This policy applies to our website and the Quarterly Filer service.

Who is responsible for your data

Quarterly Filer is the data controller for the personal information described in this policy. That means we decide what we collect and how it's used, and we're responsible for keeping it safe under UK data protection law, including the UK GDPR and the Data Protection Act 2018.

If you have any questions about how we handle your data, or you want to make a request about it, contact us using the details at the end of this policy.

What information we collect

We collect only what we need to run the service and file your tax updates. In practice this is:

• Account details. Your email address, which you use to sign in and which we use to contact you about your account and submissions.
• HMRC connection tokens. When you connect Quarterly Filer to HMRC, we store the secure authorisation tokens that let us send your updates on your behalf. We never see or store your HMRC password.
• Submission records. The income, expenses and tax figures you enter or import, together with the quarterly updates and final declarations we file for you.
• Payment information. Enough to take your £49 annual plan, or your £18 one-off single submission, if you choose it. Card payments are handled by our payment provider; we don't store your full card number on our systems.
• Technical information. Basic data such as your device and browser type and log records, which help us keep the service secure and working properly.

Why we use your information, and our legal basis

We use your information for clear, limited purposes, and each has a legal basis under the UK GDPR:

• To provide the service. Preparing and filing your quarterly updates and final declaration, and connecting to HMRC. This is necessary to perform our contract with you.
• To take payment. Collecting your annual plan or one-off submission fee. This is also part of performing our contract.
• To contact you. Sending you reminders about deadlines, confirmations of submissions and important service messages. This is necessary for the contract and our legitimate interest in running the service well.
• To keep the service secure and meet the law. Preventing fraud, fixing problems and keeping records HMRC or the law requires. This rests on our legal obligations and legitimate interests.

We do not use your data for advertising, and we never sell it.

How and where we store your data

Your data is stored on secure, well-established cloud infrastructure. Our database is hosted on Neon (a managed PostgreSQL service), and our application runs on Vercel. Both are reputable providers with strong security practices.

Information is encrypted in transit and at rest, and access is restricted to the systems and staff that genuinely need it to run the service. Your HMRC tokens are held with particular care, as they authorise submissions on your behalf.

Some of these providers may process or store data outside the UK. Where that happens, we make sure appropriate safeguards are in place so your information receives the same protection as it would under UK law.

Sharing your information

We share your information only where it's needed to provide the service or required by law. This means:

• HMRC, to file your quarterly updates and final declaration, which is the whole purpose of the service.
• Our service providers, such as our hosting (Neon and Vercel) and payment processor, who act on our instructions and are bound to keep your data secure.
• Authorities, where we're legally required to disclose information.

We never sell your personal information or share it for marketing.

How long we keep your data

We keep your information for as long as you have an account with us, and afterwards only for as long as we need to. Tax and financial records are kept for the period HMRC and UK law require, which is typically several years, so that your filings can be verified if needed.

When we no longer need your data, we delete it securely or make it anonymous.

Your rights

Under UK data protection law you have a number of rights over your personal information. You can:

• Access your data. Ask for a copy of the personal information we hold about you.
• Correct your data. Ask us to fix anything that's wrong or incomplete.
• Delete your data. Ask us to erase your information, where we're not required to keep it (for example by tax law).
• Port your data. Ask for a copy of the data you gave us in a common, machine-readable format, or ask us to send it to another provider.
• Restrict or object. Ask us to pause or stop certain uses of your data in some circumstances.
• Withdraw consent. Where we rely on your consent, withdraw it at any time.

To exercise any of these rights, contact us using the details below. We'll respond within the timeframe the law allows, normally one month. There's no charge for a reasonable request.

Cookies

Our website uses a small number of cookies to make the service work and to understand how the site is used. You can control cookies through your browser settings. Where any non-essential cookies are used, we'll ask for your consent first.

Our public marketing pages are cookieless. We measure site usage with Vercel Web Analytics, which does not set cookies and does not track you across other websites, so there is no cookie banner to accept. The only cookies we set are the essential ones needed to keep you signed in once you have an account.

Changes to this policy

We may update this policy from time to time, for example if the service changes or the law does. When we make a significant change, we'll let you know by email or through the service. The date at the top shows when it was last updated.

Complaints

If you're unhappy with how we've handled your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk.

Contact us

If you have any questions about this policy or your personal information, contact us and a real person will help. We'll always aim to give you a clear, straight answer.