Privacy notice

Who we are

All Signed Off Limited, trading as TaxPost, is the controller of the personal data described here. Registered office: 3rd Floor, Old Stock Exchange, St Nicholas Street, Bristol, United Kingdom, BS1 1TG.

Email hello@taxpost.uk with any question about this notice or about your data.

Our registration with the Information Commissioner's Office: ZC261913.

What we collect, why, and on what basis

The site has no accounts, and one form: the waitlist. It handles personal data in four ways. The following sections explain enquiries, waitlist records, optional website and application measurement, and hosting records. The website also counts clicks on links to the customer portal as anonymous totals.

Enquiries you send us

When you email us we receive your name, your contact details and whatever you tell us about yourself and the company. We use it to answer you and to decide whether we can take the company on.

Lawful basis: our legitimate interest in answering the people who contact us. Where the enquiry is a step towards buying the service, it is also the steps you ask us to take before entering a contract.

The waitlist

If you join the waitlist we hold your email address, which emails you asked for, the words you were shown and the version of this notice, and when you joined, confirmed or withdrew. We email you once to check the address is yours. Nothing else is sent until you confirm.

To stop the form being misused we also keep a scrambled form of the address your connection comes from, used only to limit repeated signups and deleted shortly afterwards.

Lawful basis for the launch email, one email when our first accounts package opens for orders: your consent. For marketing email, only if you tick its box: your consent, given separately. You can withdraw either at any time, from the link in any email we send you or by emailing us.

Lawful basis for the confirmation email, for the record of what you agreed to, and for the record not to email you after you withdraw: our legitimate interest in checking the address is yours, showing we have your consent and respecting your choice.

Measuring website and application use

If you accept analytics, Vercel measures page views and speed. PostHog receives named page and action events with approved page, campaign and button names, plus a random visit code kept by this site in your browser tab for up to 30 minutes. An approved campaign code may be kept with it across pages for that visit. A link carrying the visit code expires after 30 minutes. We use that code to connect a consenting site visit to consenting application steps. These events do not include your name, filing contents, typed answers or full page address.

Google Analytics receives approved website page categories, campaign and action names, environment and synthetic-test labels. Our page events use fixed addresses without query strings, fragments, article slugs or referring addresses. Google’s enhanced measurement also records supported website interactions, such as scrolling, outbound links, downloads, form interactions and search terms when present. Form interaction events do not include the values you type. Google also receives browser and device information and processes connection information to derive approximate location; it does not log or store UK visitors' IP addresses. We do not send typed fields, contact details, documents, financial values, account identifiers or the PostHog visit code. Advertising purposes, Google signals and advertising personalisation are disabled. Google is not installed in the application.

After Analytics acceptance, Google uses the cookies taxpost_ga and taxpost_ga_9D721ZMH4Y on this website host only. They hold browser and session identifiers, expire after 30 minutes and renew with activity. Withdrawing Analytics stops collection of new activity and clears these cookies. Google may finish sending events it recorded while your permission was on; withdrawal does not delete data already received. Google browser totals differ from PostHog's tab visits; neither count proves a unique signup. Google's accepted waitlist request event does not mean email confirmation.

If you accept application analytics, the application keeps the transferred anonymous visit code in its browser tab for up to 24 hours, or until the tab closes, you withdraw analytics or sign out.

Application analytics records approved screen and action names, loading times and categorical outcomes such as whether checkout succeeded or payment was confirmed. We do not send names, contact details, company or filing identifiers, typed answers, documents or financial values. The random visit code is a pseudonymous identifier; it is not your account identifier, and we do not create a PostHog person profile.

Optional session replay

If you accept session replay, PostHog records how you move through the website or application, including clicks and scrolling. Fields, private page text and identifying element attributes are masked before transmission. Approved public interface styling is kept so clicks line up with the controls. Approved fixed interface labels and public consent instructions remain readable. Forms and media are blocked where needed. Recorded page addresses exclude query details and customer or filing identifiers. We do not record console logs or network request contents.

Analytics and replay are optional. Accept all allows both in one click; Reject all declines both. Settings lets you choose each separately. You can change either using the website's analytics controls or the application's Privacy choices. Withdrawing a choice stops new collection for that purpose. It does not automatically delete data already received; contact us about deletion. Declining does not prevent you from using the service.

Lawful basis: your consent. You can withdraw it at any time on the analytics and cookies page, and new events stop immediately.

Serving and protecting the site

The hosting provider records the details of each request, including the address your connection comes from, in order to deliver the page and to keep the site running and secure.

Lawful basis: our legitimate interest in running a working, secure website.

Counting clicks to the portal, with no personal data

When you follow a link from this site to the customer portal, the site counts the click on its own server as part of an anonymous total for that page and that link. The count uses no cookie, stores no identifier and reads nothing from your device, so it contains no personal data and happens whether or not you accepted measurement.

Who receives your data

We do not sell personal data and we do not share it for anyone else's marketing. The following organisations process it on our behalf.

• Vercel Inc. hosts the site, serves the measurement script from this site's own address, receives the events it sends, and runs the redirect that counts portal clicks. That redirect runs in Vercel's London region.

• PostHog Inc. processes named website and application events after analytics consent, and masked session replay after replay consent. You can give both choices together through Accept all or choose each in Settings. We use its EU Cloud service and pseudonymous visit and session codes, with person profiles disabled. PostHog processes the connection IP and may derive approximate location; anonymising the IP does not remove location already derived. Access is limited to authorised TaxPost reviewers; continuous agent access and PostHog AI replay analysis are not enabled by these choices.

• Google provides Google Analytics for consented website measurement, with browser and session identifiers. This uses the same Analytics choice as Vercel and PostHog; it does not provide session replay.

• Our mailbox provider holds the email you send to hello@taxpost.uk. Provider: Google Workspace.

• Supabase holds the waitlist records: your address, your choices and the record of what you agreed to.

• Resend sends the waitlist's emails and tells us when one bounces or you unsubscribe.

The site sends email only for the waitlist, through Resend. It loads no advertising, social-media code or embedded content.

Transfers outside the UK

Vercel is a United States company, and the aggregate measurement data is processed on its infrastructure, which may be outside the UK. The safeguard is Vercel's data processing agreement, which incorporates the standard contractual clauses and the UK international data transfer addendum. Vercel is also certified under the EU-US Data Privacy Framework and its UK extension.

Email you send us is held in the UK or under the same kind of safeguard, depending on our mailbox provider.

PostHog measurement is sent to its EU Cloud service, hosted in Germany. Some support and traffic-routing processing may take place outside the UK or EU. Its data processing agreement provides the applicable international-transfer safeguards, including standard contractual clauses and the UK addendum.

Google Analytics can process measurement data outside the UK. Google publishes data processing terms and international-transfer safeguards for the service; UK data is collected through regional servers before further processing. This is not a promise that all Google processing stays in the UK or EU.

Supabase holds the waitlist records in London, in the United Kingdom.

Resend is a United States company and processes your email address in the United States. The safeguard is Resend's data processing agreement, which includes the standard contractual clauses with the UK Addendum, and Resend's certification under the UK Extension to the EU-US Data Privacy Framework.

How long we keep it

• Enquiries: for as long as we need them to deal with what you asked, and no longer than 12 months after our last exchange, unless you ask us to delete them sooner or we need them to deal with a complaint.

• Waitlist signups you do not confirm: deleted 30 days after you sign up.

• If you asked for the launch email only: deleted 3 months after the launch email is sent.

• If you asked for marketing email: kept until you unsubscribe.

• The record of what you agreed to: kept for 2 years after our last email to you.

• If you unsubscribe or our email to you bounces: a minimal record not to email you, kept for as long as we need it to respect that.

• Measurement data: this website's visit code expires from its browser tab after half an hour. Named event data currently has no automatic expiry in our PostHog project. We review whether it is still needed to understand conversion, usability and performance, and arrange deletion when it is no longer needed.

• Google browser cookies expire after 30 minutes, renewed with activity. Data already received by Google is retained under the property's retention settings; this browser expiry does not delete it. Google's event and user retention controls do not set an expiry for standard aggregate reports. Contact us about access or deletion.

• If you accept application analytics, the application keeps the transferred anonymous visit code in its browser tab for up to 24 hours, or until the tab closes, you withdraw analytics or sign out.

• Session recordings are scheduled for deletion after 30 days; the provider may take additional time to complete deletion.

• Portal click counts: aggregate totals with no identifier, kept for as long as we use them.

• Hosting request records: briefly, under Vercel's own retention policy, then deleted.

Your rights

Under UK data protection law you can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict how we use it, object to our use of it, and ask for it in a portable form. Where we rely on your consent, you can withdraw it at any time.

Before we show, change or delete waitlist records, we email a one-time code to the address to check the request is yours.

To exercise any of these rights, email hello@taxpost.uk. We will respond in the time the law allows, and we will not charge you unless the law lets us.

Complaining to the ICO

If you are unhappy with how we have handled your data, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, by telephone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Changes to this notice

When this notice changes, the date at the top changes with it. A change that affects what we do with your data is explained here rather than made quietly.