Privacy policy

DIY Accounting Submit is a lightweight web application that helps you submit UK VAT returns via HMRC's Making Tax Digital (MTD) service. We aim to collect the minimum data necessary to operate the service, comply with legal requirements, and monitor performance.

What we collect

Account and Authentication Data

• Cognito user profile: Email address, name, and unique user identifier (sub) from Google OAuth sign-in
• Authentication tokens: JWT access, identity, and refresh tokens stored in your browser's localStorage for session management
• HMRC OAuth tokens: Temporary access tokens obtained when you authorize HMRC access (not stored long-term)

VAT Submission Data

• VAT return data: The figures you enter for submission (processed but not stored beyond the request)
• HMRC submission receipts: Confirmation receipts from HMRC including form bundle number, processing date, and timestamp
• Subscription bundles: Records of your service entitlements and expiry dates

HMRC Assist

When you submit a VAT return, you can choose to send a draft return to HMRC Assist for review before filing. When you press the check button, the nine box figures and the period are sent to HMRC. HMRC returns up to five advisory messages with links to GOV.UK guidance. The messages are shown exactly as HMRC sends them.

This report is kept with the return's receipt for seven years, the same as the receipts for submitted returns. Nothing is sent to HMRC until you press the check button, and the return can be submitted whether or not the check is used.

HMRC Fraud Prevention Data

When you submit a VAT return, we are legally required to collect and transmit fraud prevention data to HMRC. See the HMRC Fraud Prevention Headers section below for full details.

Real User Monitoring (RUM)

We use Amazon CloudWatch RUM to collect performance and error data from your browser. This helps us improve the application's speed, reliability, and user experience. RUM only starts after you click "Accept" in the consent banner.

Data Collected by RUM

• Performance Metrics: Page load times, render times, interaction delays (Core Web Vitals: LCP, INP, CLS)
• JavaScript Errors: Unhandled exceptions and error messages
• HTTP Requests: API request URLs (without query parameters), status codes, durations
• Navigation Events: Pages visited, route changes
• Device Information: Browser type/version, operating system, screen resolution, viewport size
• Session Information: Anonymous session ID, hashed user ID (if logged in - we hash your identifier in the browser before sending)

Data NOT Collected by RUM

• Form input data (e.g., VAT numbers, financial figures)
• Passwords or authentication tokens
• Full URLs with query parameters or personal identifiers
• IP addresses (AWS receives them for request routing but we do not store or process them for RUM)

Google Analytics 4

We use Google Analytics 4 (GA4) to understand how visitors use our sites (diyaccounting.co.uk, spreadsheets.diyaccounting.co.uk, and submit.diyaccounting.co.uk). GA4 collects anonymized usage data to help us improve our services.

Data Collected by GA4

• Page views: Pages visited and navigation paths across our three sites
• Events: Interactions such as product downloads, donation completions, and VAT submission milestones
• Device and browser information: Browser type, operating system, screen resolution, language
• Geographic information: Approximate location derived from IP address (IP addresses are not stored by GA4)
• Referral data: How you arrived at our site (search engine, direct, referral link)

Data NOT Collected by GA4

• Personal information (names, email addresses, VAT numbers)
• Financial data (VAT figures, payment details)
• Authentication tokens or passwords

Consent and Control

Our lawful basis for analytics and advertising measurement is your consent. Until you accept the cookie banner, the GA4 and Microsoft Advertising scripts are not loaded, no request is made to Google or Microsoft, and nothing about your visit is written to your browser for these purposes. If you decline, that stays the case. You can withdraw consent at any time by clearing your browser's site data and revisiting the site.

Google Ads measurement

If you arrive from a Google or Microsoft ad, the link carries a click identifier (gclid or msclkid) and campaign tags (utm_*). With your consent we keep them in your browser for up to 90 days and send them with your session, so we can count which ads lead to sign-ups and payments. Without consent they are not kept.

Microsoft Advertising measurement

With your consent we load Microsoft Advertising's Universal Event Tracking (UET) tag from bat.bing.com. It sends your page views and the events for a purchase, a VAT return, a download and a donation to bat.bing.com and bat.bing.net, so Microsoft can count which of its ads lead to those actions. The tag may set a cookie in your browser. Microsoft Corporation is the processor; see Microsoft's Privacy Statement.

Data Retention and Processing

• Retention period: 14 months (the maximum allowed by GA4)
• IP anonymization: Enabled by default in GA4 (IP addresses are not stored)
• Data processor: Google Ireland Limited (EU data processing)
• Cross-domain tracking: Sessions are linked across our three domains to provide a unified view of user journeys

For more information, see Google's Privacy Policy and Google Analytics Data Safeguards.

Infrastructure and Operational Data

• API Gateway access logs: Request metadata including timestamps, paths, response codes, and request IDs
• CloudFront/WAF logs: Edge request logs including IP addresses for security monitoring and rate limiting. We also count the distinct visitors that bots and our own automated tests make each day: the address is turned into a one-way hash with a salt that changes every day, only the count is kept, and the hash is never stored or compared across days.
• Lambda execution logs: Structured operational logs with correlation IDs for debugging (sensitive data excluded)
• HMRC API audit trail: Masked records of API requests and responses for compliance and troubleshooting (sensitive data redacted)

Google Drive and Books

You can open a book from, or save a book to, your own Google Drive. This uses Google's sign-in and the drive.file permission, which lets the site see only the files you pick or create with it. The book stays in your browser. Only the figures you file reach Submit's servers.

Google's own privacy policy governs your Drive account.

HMRC Fraud Prevention Headers

Under Making Tax Digital (MTD) regulations, HMRC requires all software providers to collect and transmit fraud prevention data with each VAT return submission. This is a legal requirement that we cannot opt out of.

Legal Basis

The collection and transmission of fraud prevention data is mandated by HMRC under the HMRC Fraud Prevention Specification. HMRC uses this data to:

• Identify and prevent fraudulent VAT submissions
• Support criminal prosecutions for tax fraud
• Verify the authenticity of submissions
• Monitor for suspicious patterns across the MTD ecosystem

Data Points Collected

The following data is collected and transmitted to HMRC with each VAT return submission:

How Device ID Works

The device ID is not stored persistently. A new UUID is generated for each VAT return submission using your browser's cryptographic random number generator. This means:

• No cookies are used for device tracking
• No localStorage is used for device ID storage
• Each submission generates a fresh, unique device identifier

HMRC Consent

When you authorize this application to submit VAT returns on your behalf, you do so through HMRC's own OAuth authorization flow. HMRC's authorization screen explains that fraud prevention data will be collected. By completing the authorization, you consent to this data collection as required by HMRC.

For more information about HMRC's fraud prevention requirements, see the HMRC Fraud Prevention Documentation.

How and when we collect it

• Account data: Collected when you sign in with Google OAuth and stored in AWS Cognito and browser localStorage.
• VAT submission data: Collected when you submit a VAT return; receipts are stored in DynamoDB for 7 years.
• Fraud prevention data: Collected at the moment of VAT return submission and transmitted immediately to HMRC.
• RUM data: Only collected after you click "Accept" in the consent banner.
• Google Analytics and advertising measurement data: Only collected after you grant consent via the cookie banner. Nothing is sent to Google and no campaign tags are stored before consent.
• Infrastructure logs: Collected automatically by AWS services when you use the site, for security and operational reasons.

What we use it for

• VAT submissions: To submit your VAT returns to HMRC and provide you with confirmation receipts.
• Authentication: To verify your identity and manage your session.
• Entitlements: To track your subscription bundles and service access.
• Fraud prevention compliance: To fulfill our legal obligations under Making Tax Digital regulations.
• Performance monitoring: To improve site speed, reliability, and user experience.
• Error detection: To identify and fix bugs and issues.
• Security: To protect the service and users from abuse, attacks, and unauthorized access.
• Compliance auditing: To maintain audit trails for regulatory compliance.

Data retention

Application Data

Monitoring and Infrastructure Data

Cookies and browser storage

This application does not use cookies.

We use browser localStorage and sessionStorage instead:

localStorage (persistent until cleared)

• Authentication tokens: Cognito access, identity, and refresh tokens for session management
• User info: Parsed user profile from Cognito (sub, name, email)
• Sign-in details: Login provider, last auth update time, and OAuth state for CSRF protection during login
• consent.rum and consent.analytics: Your banner choice, so we do not ask again
• attribution.landing: Stored only after you accept. The click id, campaign tags and referral code from the link you arrived on, kept up to 90 days to measure which ads and referrals lead to sign-ups and payments. Deleted if you decline.
• rum.config: Monitoring configuration for CloudWatch RUM, stored only after you accept
• feedbackEngagementRegistered: Remembers that you have already answered the feedback invitation
• visitorKind.operator: Marks the site operator's browser so it is excluded from visitor counts

sessionStorage (cleared when browser tab closes)

• MFA metadata: Multi-factor authentication information for fraud prevention headers (if applicable)
• Journey state: Pending requests, OAuth state, HMRC and Companies House tokens, form drafts, and the page to return to after sign-in, so a journey survives redirects
• __diy_session__: Set after you accept, when the once-per-session visit beacon is sent, so it is sent once per tab session

RUM may use cookies or localStorage to establish session information, but only after you consent via the banner. You can clear all stored data using your browser's "Clear site data" function.

Your choices

• Analytics consent: You can decline both RUM and Google Analytics in the consent banner. No analytics data is collected until you grant consent. You can change your choice by clearing site data in your browser and revisiting.
• HMRC authorization: You can revoke HMRC access at any time through your HMRC authorized applications page.
• Account deletion: Contact us to request deletion of your account and associated data (subject to legal retention requirements).

Note: You cannot opt out of fraud prevention data collection for VAT submissions. This is a legal requirement mandated by HMRC for all MTD-compliant software.

Your data rights (UK GDPR)

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate data
• Right to erasure ("right to be forgotten"): Request deletion of your account and personal data
• Right to data portability: Request to export your data in a structured, machine-readable format (JSON or CSV) to transfer to another service
• Right to object: Object to processing of your personal data
• Right to restrict processing: Request temporary restriction of data processing

How to Exercise Your Rights

To exercise any of these rights, contact us at admin@diyaccounting.co.uk with:

• Your name and email address associated with your account
• The specific right you wish to exercise
• Any additional details to help us process your request

We will respond to your request within 30 days. For data deletion, we will delete your bundles, authentication data, and audit logs within 30 days. HMRC submission receipts will be retained for 7 years per UK tax record-keeping requirements, but will be anonymized where possible.

Data recipients

HMRC (Data Controller)

When you submit a VAT return, your VAT figures and fraud prevention data are transmitted directly to HMRC. HMRC is an independent data controller for this data and processes it according to their own privacy policy. We do not control how HMRC uses this data after transmission.

• Data shared: VAT return figures, fraud prevention headers (see above)
• Purpose: VAT return processing and fraud prevention
• Legal basis: Legal obligation (Making Tax Digital regulations)
• HMRC Privacy Notice: HMRC Data Protection Information

Amazon Web Services (Data Processor)

We use Amazon Web Services (AWS) to host and operate the website, API, and monitoring services. AWS acts as a data processor on our behalf under a Data Processing Agreement. All data is processed in the EU West (London) region unless otherwise noted.

AWS services we use include:

• Amazon Cognito: User authentication and identity management
• Amazon DynamoDB: Data storage for receipts, bundles, and audit logs
• AWS Lambda: Serverless API functions
• Amazon CloudFront: Content delivery and edge caching (global edge locations)
• Amazon CloudWatch: Logging, monitoring, and RUM
• AWS WAF: Web application firewall and rate limiting
• AWS Secrets Manager: Secure storage of API credentials

AWS is GDPR-compliant. See AWS GDPR Center for details.

Google (Authentication Provider and Analytics Processor)

If you sign in with Google, Google processes your authentication data according to their privacy policy. We receive only your name, email address, and a unique identifier from Google.

We also use Google Analytics 4 to collect anonymized usage data about how visitors use our sites. Google acts as a data processor for analytics data. Analytics data is only collected after you grant consent. See the Google Privacy Policy for details.

Stripe (Data Processor)

We use Stripe to process subscription billing. Stripe acts as a data processor on our behalf. Checkout sends Stripe your email address and a hashed identifier for your account; card details are entered directly into Stripe Checkout and never reach our systems.

Stripe is GDPR-compliant. See Stripe Privacy Policy for details.

Telegram (Data Processor)

We use Telegram to deliver operational and security alerts to our team. Alert messages carry masked email addresses and hashed account identifiers, never full account details or submission data.

See the Telegram Privacy Policy for details.

International data transfers

The majority of your data is processed in the EU West (London) region. However, the following transfers may occur:

• CloudFront edge caching: Static assets may be cached at global edge locations for performance. No personal data is cached.
• IP detection services: For fraud prevention, we may use external services (ipify.org, ipapi.co) to detect your public IP if WebRTC detection fails. Only your IP address is sent to these services.

All AWS data processing is covered by AWS's Standard Contractual Clauses for international transfers where applicable.

ICO Registration Disclosure

Security measures

We implement industry-standard security measures including:

• Encryption: TLS 1.2+ for data in transit, AES-256 for data at rest
• Access controls: JWT-based authentication with automatic token expiry
• Rate limiting: AWS WAF protection against abuse (2000 requests per 5 minutes per IP)
• Data minimization: Hashed user identifiers in database, masked sensitive data in logs
• Monitoring: Real-time security monitoring and alerting
• Backup and recovery: Point-in-time recovery enabled for critical data

Content Security Policy

We use a Content Security Policy (CSP) to protect against cross-site scripting (XSS) and other code injection attacks. Our policy restricts content sources to trusted origins with the following accepted exceptions:

• script-src 'unsafe-inline': Required for inline event handlers used in form validation and dynamic UI components. Mitigated by: strict input validation, no user-generated content in scripts, and limited scope of inline handlers.
• style-src 'unsafe-inline': Required for dynamic styling of UI components and third-party integrations (CloudWatch RUM). Mitigated by: no user-controlled style values and strict output encoding.

These exceptions are documented as accepted risks in our security compliance process. We regularly review whether these can be eliminated through code refactoring.

Security incidents

In the event of a data breach affecting your personal data, we will notify you and the Information Commissioner's Office (ICO) within 72 hours as required by UK GDPR. We will also notify HMRC within 72 hours if the breach affects HMRC-related data or OAuth credentials.

Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent changes. Material changes will be notified via email or prominent notice in the application. Continued use after changes constitutes acceptance of the updated policy.

Referral and affiliate records

These terms take effect when the first affiliate is approved.

When you make a pass, redeem one, or take part in the affiliate scheme, we keep these records.

• Redemption record: when a pass was redeemed, the pass and its type, a one-way hash of the account that redeemed it, and a one-way hash of the pass owner's account. We use it to count conversions and to stop a person using their own pass.
• Commission lines: for each payment from a referred customer, the payment, the amount, the rate, the state of the line and the date it is released. We use them to pay or credit the commission and to reverse it after a refund or dispute.
• Affiliate record: the tier, the state of the application and the Stripe account id. Stripe collects your name, address, date of birth and bank details and checks who you are. We do not hold them.

The person who made a pass sees counts of what it brought in. We withhold a count below 3, so a small number cannot point to one person. We never show the referred person's name or email. We keep the commission ledger for at least six years, as a tax record.

Contact

For privacy questions, data requests, or security concerns, contact:
Email: admin@diyaccounting.co.uk
Company: DIY Accounting Limited

For issue reports, please include your browser, approximate time, and the page you were on.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

ICO Registration: DIY Accounting Limited's ICO registration reference is ZB070902.