Affordable MTD is a product of Nesbitt Web Ltd, company number 09417982, registered in England and Wales at 27 Old Gloucester Street, London, WC1N 3AX.
For the purposes of UK data protection law (UK GDPR and the Data Protection Act 2018), Nesbitt Web Ltd is the Data Controller for personal data collected through affordablemtd.com.
Questions about this policy: support@affordablemtd.com
Data We Collect and Why
| Category | Data | Source |
|---|---|---|
| Account | Email address, account creation date, and your name if you choose to add it in Settings | You provide this on registration. We use passwordless (magic link) sign-in, so no password is created or stored. |
| Tax identity | National Insurance number, tax year | You provide this; used to connect to your HMRC account via OAuth |
| Business data | Business name, business type (self-employment / property), business ID | Retrieved from HMRC's Business Details API after you authorise the connection |
| Financial data | Income and expense figures you enter or import via CSV/spreadsheet | You provide this directly |
| HMRC tokens | OAuth access and refresh tokens for your HMRC account | Issued by HMRC after you authorise the connection; stored encrypted (AES-256-GCM) |
| Fraud prevention | IP address, browser type and version, screen resolution, device time zone, and other headers required by HMRC's fraud prevention specification | Collected automatically from your browser while you are signed in to the Service, so it can be sent to HMRC with each API call |
| Usage data | Pages visited, time on page, errors encountered | Collected automatically via our hosting infrastructure |
| Support messages | Emails you send to our support address, questions you ask in the in-app support chat, and our replies | You provide this when you contact us |
| Feedback | Feedback you send from within the app, including any screenshot you choose to attach (which may show figures on your screen) | You provide this |
| Referrals | Your referral code, and which account referred you, if you signed up through a referral link | Generated when you use the referral feature, or from the referral link you signed up through |
| Accountant waiting list | Email address, if you register interest in our accountant and bookkeeper service | You provide this on our For Accountants page |
| Payment data | Subscription status, payment date. We do not store card numbers — these go directly to Stripe | Stripe (our payment processor) |
How We Use Your Data
We use your data only to:
- Provide the Service — connect to HMRC on your behalf, submit quarterly updates, and display your obligations and submission history
- Process your subscription payment via Stripe
- Send service emails — sign-in links, submission confirmations, subscription receipts, upcoming deadline reminders, and reminders to finish setting up your account or a submission you have started (you can unsubscribe from setup reminders using the link in each one)
- Email you about our accountant and bookkeeper service, if you have registered interest in it
- Comply with HMRC's fraud prevention header requirements (see below)
- Diagnose bugs and improve the Service
- Meet our legal and regulatory obligations
HMRC Connection and Fraud Prevention Headers
When you authorise Affordable MTD to connect to HMRC on your behalf, we act as an MTD-registered software provider under HMRC's Making Tax Digital programme. This involves:
- Storing OAuth tokens that allow us to call HMRC's APIs on your behalf. These are encrypted at rest and in transit. You can revoke this access at any time via your HMRC Business Tax Account.
- Sending fraud prevention headers with every API call to HMRC. HMRC requires all MTD software providers to transmit device and connection data (IP address, browser fingerprint, screen dimensions, time zone, and similar) as part of their fraud detection framework. This is a mandatory requirement — we cannot submit data to HMRC without it.
Your income and expense data is transmitted to HMRC when you make a quarterly submission, and to our AI provider when you use AI-assisted features (see below). Outside of this, your financial data is stored only in our database and is not shared with any other party.
How We Use AI
Some features of the Service use AI. When you use them, the following data is sent to Anthropic, our AI provider:
- Spreadsheet import: your column headings and a few sample values from each column, to suggest how columns map to HMRC categories; and, for per-transaction files, each transaction's description, amount and any category you gave it, to suggest a category.
- Pre-submission check: this runs automatically when you submit a quarterly update. It sends the figures you are about to submit, the business type (self-employment or property) and the period dates, to flag possible errors. It never changes your figures or stops you submitting.
- Support chat and support emails: the messages you send, to help answer or route them. Your message text is also sent to Voyage AI to find similar questions we have answered before.
We never send your name, email address, National Insurance number, address, business names, HMRC business IDs or HMRC login details to our AI providers with your tax data. Transaction descriptions are sent exactly as they appear in your file, so any text you have written in them is included. Support messages are sent as you write them.
If we mark a support exchange as a useful reference, the question and our reply may be kept in our internal knowledge base to help answer similar questions in future.
Our Legal Basis for Processing
| Processing activity | Legal basis (UK GDPR) |
|---|---|
| Running your account and delivering the Service | Contract (Article 6(1)(b)) — necessary to perform the subscription agreement |
| Submitting data to HMRC on your behalf | Contract (Article 6(1)(b)) and your explicit authorisation via OAuth consent |
| Sending fraud prevention headers to HMRC | Contract (Article 6(1)(b)) — required as a condition of our access to HMRC's APIs under the subscription agreement |
| Service emails (sign-in links, confirmations, receipts, deadline reminders) | Contract (Article 6(1)(b)) |
| Reminders to finish setting up your account or a submission | Legitimate interests (Article 6(1)(f)) — helping you complete what you started. You can unsubscribe at any time. |
| AI-assisted features and handling support messages | Contract (Article 6(1)(b)) where you use a feature of the Service; legitimate interests (Article 6(1)(f)) for handling support messages |
| Accountant waiting list emails | Consent (Article 6(1)(a)) — you can unsubscribe at any time |
| Retaining records for legal and tax compliance | Legal obligation (Article 6(1)(c)) |
| Improving the Service and diagnosing errors | Legitimate interests (Article 6(1)(f)) |
Who We Share Data With
We use the following sub-processors to operate the Service. All are bound by data processing agreements and comply with UK GDPR.
Vercel Privacy Policy →
Hetzner Privacy Policy →
Resend Privacy Policy →
Sentry Privacy Policy →
Supabase Privacy Policy →
Stripe Privacy Policy →
Anthropic Privacy Policy →
Voyage AI Privacy Policy →
Kit Privacy Policy →
We do not use any analytics platforms, advertising networks, or remarketing services. We do not use Google Analytics or equivalent.
We may also disclose data where required by law — for example, in response to a valid court order or request from a regulatory authority.
If Nesbitt Web Ltd is involved in a merger, acquisition, or asset sale, your data may be transferred as part of that transaction. We will give you reasonable notice before your data becomes subject to a different privacy policy.
How Long We Keep Your Data
| Data | Retention period |
|---|---|
| Account and financial data | While your account is open. If you delete your account, see below. |
| HMRC OAuth tokens | Until revoked by you or until your account is deleted |
| Fraud prevention data | The most recent set only, replaced each time it is refreshed, until your account is deleted. HMRC retains what it receives under its own policies. |
| Support messages | Kept as a record of your support history. You can ask us to delete them at any time. |
| Accountant waiting list | Until you unsubscribe, or until we stop running the waiting list |
| Payment records | 7 years, in line with HMRC's financial record-keeping requirements |
| Usage/diagnostic data | Up to 90 days |
If you delete your account, we immediately delete your login, your HMRC connection (including your HMRC tokens and National Insurance number) and your fraud prevention data, cancel any subscription, and remove your name and business names. A record of the quarterly updates and other submissions made to HMRC through the Service, including the transaction details behind them, is kept for up to 7 years, in line with HMRC's record-keeping periods, but is no longer linked to your email address or login. You can ask us to delete this record sooner by emailing support@affordablemtd.com, unless we are required to keep it by law.
Your Rights Under UK GDPR
You have the following rights regarding your personal data:
- Access — request a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — request deletion of your data (subject to legal retention obligations)
- Restriction — ask us to restrict processing of your data in certain circumstances
- Portability — receive your data in a structured, machine-readable format
- Object — object to processing based on legitimate interests
- Withdraw consent — where processing is based on consent, you may withdraw it at any time (this does not affect the lawfulness of processing before withdrawal)
To exercise any of these rights, email us at support@affordablemtd.com. We will respond within one month. We may ask you to verify your identity before processing your request.
If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
Cookies
The Service uses the following cookies and browser storage:
| Name | Purpose | Duration |
|---|---|---|
| Login cookies | Keep you signed in. Strictly necessary. | Until you sign out, and at most 400 days |
| Device ID (browser storage) | A random identifier for your browser that HMRC's fraud prevention rules require us to send with each HMRC API call. Strictly necessary. | Until you clear your browser storage |
| Referral cookie | Remembers the referral link you arrived from so the referral can be credited when you sign up | Up to 30 days, removed once you sign in |
| App preferences (browser storage) | Remembers things like your progress through a final declaration and messages you have dismissed | Until you close the tab, or until you clear your browser storage |
We do not use advertising cookies, tracking pixels, or third-party analytics cookies. You can control cookies and browser storage through your browser settings, but blocking login cookies will prevent you from signing in.
Children's Privacy
The Service is intended for adults managing their own tax affairs. We do not knowingly collect personal data from anyone under the age of 18. If you become aware that a child has provided us with personal data, please contact us at support@affordablemtd.com and we will delete it promptly.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email at least 14 days before they take effect. The "last updated" date at the top of this page will always reflect the current version. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.
Contact Us
For any questions about this Privacy Policy or to exercise your data rights:
Nesbitt Web Ltd
27 Old Gloucester Street, London, WC1N 3AX
Company number: 09417982
support@affordablemtd.com
For complaints: Information Commissioner's Office (ICO) · 0303 123 1113