Privacy Policy

This policy explains how PowerStone Accountants Ltd ("we", "us") handles personal data when you use TaxChad (the "Service") at taxchad.com. This page is maintained by us to answer common privacy questions about the Service; it is app-owned editable content and is not an independent certification.

1. Data controller

PowerStone Accountants Ltd, 15 Westbury Court Road, Bristol BS9 3BU, United Kingdom. Contact: clients@powerstoneaccountants.co.uk.

2. What we collect

• Account data: name, email address, hashed password, workspace/firm details.
• Client & bookkeeping data: data you enter about your clients or business, including company names, addresses, company numbers, invoices, transactions, bank imports, VAT records, and supporting documents.
• Tax identifiers (where provided): National Insurance number, UTR — access is restricted to the client owner and their appointed accountant.
• Billing data: subscription and payment metadata handled by Stripe.
• Usage data: basic logs (IP, timestamps, error traces) needed to operate and secure the Service.

3. How we use your data

• To provide bookkeeping, invoicing, VAT and accounting features.
• To submit VAT returns to HMRC on your instruction (Making Tax Digital).
• To look up UK company information from Companies House when you search for a client.
• To bill you and manage your subscription.
• To secure the Service, prevent fraud and comply with legal obligations.

Legal bases under UK GDPR: performance of a contract, legitimate interests (security, service improvement), legal obligation (tax/accounting records), and consent where required.

4. Sharing & subprocessors

We do not sell personal data. We share data only with the following processors and authorities:

• Lovable Cloud — application hosting and infrastructure.
• Supabase — managed Postgres database, authentication and file storage that sits behind Lovable Cloud.
• Lovable AI Gateway (Google Gemini) — when you use the "Import PDF statement" or "Capture receipt" features, the PDF file or receipt image you upload is sent to the Lovable AI Gateway, which routes the request to Google's Gemini 2.5 Flash model, to extract transaction or receipt fields. We do not send data to the AI provider for any other feature.
• Stripe — subscription payments and billing.
• HMRC — VAT/MTD submissions you initiate.
• Companies House — public UK company register lookups when you search for a client.

5. International transfers

Where personal data is transferred outside the UK, we rely on adequacy decisions or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

6. How long we keep your data

We keep your accounting records for as long as your account is active.

After your account closes, we do not delete your records automatically. UK companies are generally required to keep accounting records for at least six years for tax purposes, and those records are yours — we keep them so that you can continue to meet that obligation.

You can ask us for a copy of your data, or ask us to delete it, at any time by emailing privacy@taxchad.com. We will respond within one month. If you ask us to delete your data, we will delete everything we are not legally required to keep, and we will tell you what we are keeping and why.

We do not run automated deletion. Deletion happens when you ask for it.

7. Security

Access is controlled by authentication and row-level security so that users can only see data belonging to their own workspace. Sensitive credentials (such as HMRC access tokens) are encrypted at rest. Payments are handled by Stripe and we do not store card numbers.

8. Your rights

Under UK GDPR you have the right to access, correct, delete, restrict, port or object to processing of your personal data, and to withdraw consent. To exercise these rights, email clients@powerstoneaccountants.co.uk. You can also complain to the UK Information Commissioner's Office (ico.org.uk).

9. Cookies

We use strictly necessary cookies to keep you signed in and to remember basic preferences. We do not use advertising cookies.

10. Changes

We may update this policy from time to time. Material changes will be notified in-app or by email.