Privacy Policy

DoneSE is a product of DoneLabs Ltd, a company registered in England and Wales, company number 17056937. We provide Making Tax Digital for Income Tax software for the UK self-employed, enabling quarterly income tax submissions to HMRC.

For the purposes of UK data protection law, DoneLabs Ltd is the data controller for personal data collected through DoneSE.

Contact: hello@donese.co.uk

ICO Registration Number: ICO-0001353294

We collect and process the following categories of personal data:

• Identity data: Your name, email address, and National Insurance Number (NINO).
• HMRC data: Your Making Tax Digital ID, self-employment business ID, and encrypted HMRC connection tokens.
• Financial data: The income and allowable expenses you enter, and bank transactions only if you connect a bank, which is not available yet.
• Submission data: Your quarterly updates and year-end tax returns submitted to HMRC.
• Technical data: IP address, device ID, browser information, and session data.
• Accountant activity: If an accountant invites you, asks you to authorise them at HMRC, files for you or is disconnected, a short in-app alert recording that event. An invitation or authorisation alert names the practice.
• Early access: If you ask for early access before opening an account, your name, email address and whether you are self-employed or an investor or member of the press.

We process your data on the following lawful bases:

• Contractual necessity: Providing the DoneSE service, recording and categorising your income and expenses, and submitting your quarterly updates and tax return.
• Legal obligation: HMRC required fraud prevention headers (IP, device ID, etc.).
• Legitimate interests: Managing your subscription via Stripe and improving our application.
• Consent: Contacting you about DoneSE if you ask for early access. You can withdraw it at any time.

DoneSE uses OAuth 2.0 to connect to your HMRC account. We never store your Government Gateway password. HMRC connections use encrypted tokens to manage your tax records.

Bank connection is not available yet. When it is, it will be optional and provided by Finexer Ltd, an FCA-authorised open banking provider (FRN 925695), with read-only access to your transaction history. DoneSE will never be able to move money from your account.

We share your personal data only where necessary to run the service:

• HMRC, to submit your quarterly updates and tax return.
• Stripe, for subscription payments.
• Supabase, our database provider (London).
• Vercel, application hosting.
• Amazon Web Services (CloudFront), the network layer every request to DoneSE passes through.
• Resend, for sign-in links and service emails.
• Upstash, for rate limiting and service markers (your IP address and, on some routes, your email address or account ID, held briefly; a marker that an accountant is connected or files for you, or that DoneTax+ has been told of your tax return, is kept until you delete your account, or for up to 400 days).
• Anthropic, when you use the in-app assistant: your questions only. Your questions and the assistant's answers are also stored in DoneSE.
• DoneTax+, only if you connect an accountant (section 8).
• Finexer, once bank connection is available and only if you connect a bank.

Your HMRC connection tokens are encrypted with AES-256-GCM; all data is encrypted at rest by our database provider and in transit with HTTPS/TLS. We do not sell or share your data for marketing purposes.

Under UK GDPR, you have the right to access, erase, or rectify your data. You can delete your account and all associated data from your Account page, in the Your Data section.

Early access: if you ask for early access, or joined our earlier waitlist, we keep the details you gave us (your name, email address and role, or your email address) until 12 months after DoneSE launches, then delete them. To be removed sooner, email privacy@donelabs.co.uk.

Retention: data is kept while your account is active. When you delete your account, your data is deleted immediately and permanently. Our payment provider, Stripe, deletes your customer record at the same time; Stripe keeps its own records of past payments, as the law requires of it. Records of any data protection complaints are kept in anonymised form, with your email and message removed. If you sent figures to an accountant through DoneTax+, those copies are not removed automatically: email hello@donese.co.uk and we will remove them. HMRC expects you to keep your records for at least five years after the 31 January deadline for each tax year, so download them from your History first.

We use strictly necessary cookies only for authentication and HMRC fraud prevention compliance. No advertising or tracking cookies are used.

Complaints can be lodged with the Information Commissioner's Office (ICO) at ico.org.uk.

If you accept an invitation from an accountant's practice, your DoneSE account is connected to that practice through DoneTax+, our platform for accountants, run by DoneLabs Ltd. Each time you send a quarter to your accountant, DoneSE passes to DoneTax+ your National Insurance Number, Making Tax Digital ID and HMRC business ID, a current HMRC connection token, and the income and expenses for that period. To show whether an accountant is connected, DoneSE checks with DoneTax+ using your National Insurance Number.

Connecting is voluntary and needs your acceptance. To end accountant access, use Disconnect on your Account page; any authorisation you gave your accountant at HMRC is withdrawn through your HMRC online account. DoneLabs Ltd is not responsible for how your accountant uses the figures you send them.

You have the right to raise a formal data protection complaint if you are unhappy with how DoneLabs Ltd handles your personal data. This right is established under the Data (Use and Access) Act 2025 and UK GDPR.

To raise a complaint, sign in to your DoneSE account, open Account, and use the complaint form in the Data Protection section. If you are unable to access your account, you can email us directly at privacy@donelabs.co.uk with the subject line 'Data Protection Complaint'.

We aim to acknowledge your complaint within 3 working days, and always within 30 days, and will keep you informed of progress and expected timeframes for resolution.

If you are not satisfied with our response, or if we have not responded within a reasonable time, you have the right to escalate your complaint to the Information Commissioner's Office (ICO). The ICO can be contacted at ico.org.uk or by calling 0303 123 1113.