Privacy Policy

1. Introduction

COGA AI Limited ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services at tax-is-hard.com (the "Service").

We are the data controller for the personal data we process. Our registered address is available on Companies House, and you can contact our data protection team at privacy@tax-is-hard.com.

2. Information We Collect

2.1 Information You Provide

We collect information you voluntarily provide, including:

• Account Information: Email address, sign-in identifier and any name you provide. Existing email/password accounts use Amazon Cognito. Where enabled, new sign-in sessions use our self-hosted authentication service. Passwords are not stored as plaintext. Google sign-in supplies your account identifier, email and basic profile; we request only openid, email and profile, with no access to Gmail or Google Drive.
• Account Security: If you enable our authenticator, we store its secret encrypted, hashes of recovery codes, verification timestamps and a limited history of security changes. Recovery codes are shown when generated; we cannot retrieve their original values later. These records protect your account and help prevent unauthorised access.
• Financial Data: Income figures, business revenue, costs, and other financial information you enter for tax calculations
• Payment Information: Billing address and payment card details (processed securely by Stripe; we do not store full card numbers)
• Deadline reminders: Operational tax and payroll email reminders are enabled by default. We store your reminder preferences, planning dates and delivery records to provide the service. You can change dates, select relevant reminders or turn them off in Profile → Reminders. These messages are separate from marketing consent.
• Communications: Messages you send us via email or contact forms. We use Resend for delivery and receiving. Messages may be forwarded to our support team and added to internal review tasks so we can follow up.
• Saved Scenarios: Tax calculation scenarios you choose to save
• Local recovery copy: Company calculator inputs are temporarily stored in your browser for crash recovery and automatically expire after 7 days. They are not encrypted; you can dismiss the recovery prompt to delete them sooner.

2.2 Information Collected Automatically

When you use our Service, we automatically collect:

• Device Information: Browser type, operating system, device type
• Usage Data: Pages visited, features used, time spent on pages
• Log Data: IP address, access times, referring URLs
• Cookies: See our Cookie Policy for details

2.3 Information from Third Parties

We may receive information from:

• Payment Processors: Transaction confirmation from Stripe
• Authentication Providers: If you sign in via social login

2.4 Analytics & Session Replay

With your analytics consent, we record interactions on public pages to improve usability. Recordings show clicks, scrolling and layout changes, with form values and calculated text masked. A small allowlist of standard interface labels remains readable. Images, charts, embedded media, account, sign-in, document, contact and admin pages are excluded. We do not record console logs, network payloads, account identifiers or IP addresses in recordings. Recordings are stored on our own servers for up to 30 days and are accessible only through our authenticated admin tools. No replay data is sent to PostHog or another analytics provider. Public pages visited in the same tab can share a random recording ID for up to 15 minutes, held in sessionStorage after consent and not linked to your account. Recording stops when analytics consent is withdrawn, Do Not Track or Global Privacy Control is enabled, or the heat map opt-out below is selected. Use Privacy settings in the footer to change your choice at any time.

2.4.1 Anonymous usage heat map (first party, no cookies)

To see which parts of the calculators people use and where they get stuck, our own servers record an anonymous heat map: where on a page a click landed, a short description of the button or link clicked (with any numbers masked), how far down the page a visit scrolled, the page address without any query string, and whether the screen is phone, tablet or desktop sized. It is collected by a small script we host ourselves; no third party is involved.

It never records what you type, any figures you enter (salaries, profits and so on), form contents, your IP address, an account or session identifier, or anything that could single you out. It sets no cookies and stores nothing on your device. Records are kept for up to 180 days and only viewed in aggregate by our team. Because the data is anonymous and aggregated it is not linked to you; we rely on our legitimate interest in improving the site.

It switches off automatically if your browser sends Do Not Track or Global Privacy Control. You can also turn it off for this browser here (this stores a single hm_optout flag so we remember your choice):

2.5 Optional Ads / Boosts

Free users may opt to watch a rewarded ad to receive extra usage. Ads are never shown unless you explicitly start them. Partner/affiliate offers are off by default and will only run if you opt in.

2.6 Bank statement and financial data

If you use our Finances features, we collect and store:

• Manually entered data: balances, expenses, and transactions you type in yourself
• Statement-derived data: transactions and balances you explicitly confirm after importing a bank statement (CSV or PDF)

What we never store:

• Raw statement files (CSV or PDF) — they are processed and discarded
• Raw text extracted from statements — it is deleted once parsing completes

Statement parsing runs on our own servers using deterministic methods. If automatic parsing cannot handle an unusual PDF layout, an optional fallback is available: only if you explicitly tick a consent box for that upload, the extracted text — never the file itself — is sent to Moonshot AI (Kimi) for parsing. Before any text leaves our servers, account numbers, sort codes, IBANs, postcodes and email addresses are automatically redacted. You can use the Service fully without this optional processing.

Storage and security: financial data is encrypted at rest in our production environment and hosted on servers in the UK/EU. We retain it until you delete it or delete your account.

Your controls: you can view and export your financial data within the app, delete any individual item or everything from the Finances page at any time, and deleting your account deletes all associated financial data. The lawful basis for storing this data is contract performance; the basis for the optional AI fallback is your explicit consent, which you may withhold or withdraw at any time.

Planning assistant document review

For the experimental planning assistant, document text extraction and image recognition (OCR) run on our own server. Uploaded originals and temporary raster images are discarded after processing. Extracted financial evidence, short supporting quotes and pending scenario comparisons are encrypted in a shared review cache. Reviews expire after 30 minutes; expired records are removed by the next minute cleanup cycle while the service is running, or on restart. Clear assistant session removes your pending reviews. Changes you explicitly apply and save become part of your saved plan.

Local processing is the default. Where optional AI interpretation is available, a separate consent control lets you send only the message you type to Anthropic through its commercial API. That message may contain personal or financial information you include. Uploaded files, extracted document text, the calculator scenario and earlier conversation history are not sent by this feature. You can keep using local processing without consenting. AI responses are for review and never apply changes automatically.

We retain request counts and cost metadata for abuse prevention and budget accounting, without message text or model responses. The assistant area is excluded from session recordings. Local document processing is necessary to provide the review you request; optional external interpretation is based on your per-request consent. Anthropic processing may involve international transfers under its commercial data-processing terms; it is activated only for approved test accounts while this feature is being evaluated.

Reviewed bank-history imports

If you explicitly save an accounting-export or connected bank-history review draft, we retain its normalized transaction rows, source labels, reconciliation results and review status encrypted in your account until you delete the draft. These saved drafts are separate from the assistant’s 30-minute temporary review cache; Clear assistant session does not delete them. An authenticated read-only provider connection stores encrypted authorization credentials and a resumable download job so you can request bank-history pages. Provider data is not sent to AI interpretation. Sage reads booked company bank-ledger postings, which require reconciliation to bank records; these are not a bank feed or bank statement. QuickBooks currently reads bank-account metadata only and uses reviewed CSV exports for history. Intuit requires a broad accounting read/write grant, disclosed before you choose to authorize; our QuickBooks accounting requests only read metadata and do not write to QuickBooks. Company/account identifiers and encrypted credentials remain until disconnection or account deletion; temporary OAuth state expires after ten minutes. Provider rate and security counters remain for abuse prevention after disconnection.

Only your explicit reviewed import saves bank/cash transactions and any chosen historical opening balance into Finances. This does not automatically create calculator forecasts or write to the source accounting provider. Imported history remains in Finances until you delete it there or delete your account. Deleting the review draft or disconnecting a provider does not delete previously imported transactions. A reviewed workbook import also retains an encrypted import receipt and source-posting evidence for duplicate protection and audit history. These remain after the saved review or an individual transaction is deleted; financial-data erasure or account deletion removes them. Workbook statement balances are checks only, not balance writes, and newly imported workbook transactions start unconfirmed for further review in Finances. Disconnecting removes local credentials and unfinished jobs; revoke the app with the provider as well to withdraw its authorization.

2.7 Imported CT600 company tax returns

If you upload a CT600 (a filed Company Tax Return) in the company calculator, we read it on our own servers using deterministic text matching. No AI service is used for CT600s, and the file is never sent to a third party. Before anything is applied you review the extracted figures.

• What we keep: the figures you confirm (company name, company number, UTR, accounting period, turnover, profits, Corporation Tax, R&D credits, associated companies), stored with the plan in your workspace and subject to that workspace's sharing settings. Anyone you share the plan with can see these figures; the original PDF is only available to people who can edit the plan.
• The PDF itself: unlike bank statements, an encrypted copy of the CT600 PDF is stored with the plan by default (a tick box on upload, ticked by default, which you can untick before uploading). It is shown in the app as "Stored securely, encrypted" with a Delete button. If you untick the box, the file is discarded after reading. If encrypted storage is unavailable we do not store the file and tell you so. An upload you never confirm is deleted automatically within 24 hours.
• Deleting it: you can delete the stored PDF, or remove the whole CT600 record, at any time from the company calculator. Deleting a plan or workspace, or your account, deletes its CT600 records and any stored PDFs. Bank statement files remain never stored.

The lawful basis is contract performance (providing the calculator you asked for) and, for keeping the PDF copy, the tick box on upload (ticked by default), which you can withdraw at any time by deleting the copy.

3. How We Use Your Information

We use your information for the following purposes:

4. Data Sharing and Disclosure

We may share your information with:

4.1 Service Providers

• Hetzner: Application hosting, including our account and financial record stores
• AWS (Amazon Web Services): Amazon Cognito for existing email/password accounts, and cloud storage where configured
• Google: Identity verification when you choose Google sign-in; only basic identity scopes are requested
• Resend: Transactional email delivery and receiving, including account and support messages
• Stripe: Payment processing
• Analytics providers: To understand service usage
• Moonshot AI (Kimi): Optional, consent-gated AI parsing of redacted statement text when automatic parsing fails. No files or raw data are sent; only redacted extracted text; only with your explicit per-upload consent. Moonshot AI is an international processor; transfers are limited to redacted text and made only with your explicit consent.

4.2 Legal Requirements

We may disclose your information if required by law, court order, or government request.

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any such change.

4.4 We Do NOT

• Sell your personal data to third parties
• Share your financial data with advertisers
• Use your data for automated decision-making that affects you

5. Data Retention

We retain your data for the following periods:

• Account data: Until you delete your account, plus 30 days
• Security records: Authenticator secrets are retained while enrolled and replaced when you change the factor. Recovery codes are stored as hashes and removed when used or replaced. Verification expires after up to 12 hours. We keep the most recent 50 security-change events with the account. Incomplete setup expires after 10 minutes; expired pending data is discarded on the next security access.
• Finances data (balances, expenses, transactions): Until you delete the items or your account; deleting your account deletes all of it
• Calculation history: 7 years (for tax record purposes)
• Browser recovery copy: Up to 7 days on the device you use
• Payment records: 7 years (legal requirement)
• Marketing preferences: Until you unsubscribe
• Interaction recordings: Up to 30 days. Anonymous heat map records are kept for up to 180 days.

You can request deletion of your data at any time, subject to legal retention requirements.

6. Data Security

We implement appropriate security measures including:

• HTTPS for data in transit and encryption for stored financial records and authenticator secrets
• Provider-managed password authentication and hashed recovery codes
• Account access controls and additional verification for protected features
• Rate limits, single-use authenticator codes and expiring verified sessions

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

7. International Data Transfers

Account and financial records are stored on our application servers. Authentication, payment, email and optional AI providers may process information in other locations. If we transfer data outside the UK/EEA, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the ICO
• Adequacy decisions by the UK government

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

8.1 Right of Access

You can request a copy of all personal data we hold about you. We will respond within one month.

8.2 Right to Rectification

You can request correction of inaccurate or incomplete data.

8.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your data in certain circumstances. Note that we may need to retain some data for legal compliance.

8.4 Right to Restrict Processing

You can request that we limit how we use your data.

8.5 Right to Data Portability

You can request your data in a structured, machine-readable format (JSON or CSV).

8.6 Right to Object

You can object to processing based on legitimate interests, including direct marketing.

8.7 Right to Withdraw Consent

Where we process data based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

8.8 How to Exercise Your Rights

To exercise any of these rights, contact us at privacy@tax-is-hard.com. We may need to verify your identity before processing your request.

9. Children's Privacy

Our Service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

10. Cookies and Tracking

We use cookies and similar technologies. For detailed information, please see our Cookie Policy.

11. Third-Party Links

Our Service may contain links to third-party websites. We are not responsible for the privacy practices of these sites. We encourage you to read their privacy policies.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on our website. The "Last updated" date at the top indicates when the policy was last revised.

13. Complaints

If you have concerns about how we handle your data, please contact us first at privacy@tax-is-hard.com.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113
• Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

14. Contact Us

For privacy-related inquiries:

• Email: privacy@tax-is-hard.com
• Data Protection Officer: dpo@tax-is-hard.com
• Address: Available on Companies House
• Company number: 16036396
• ICO registration reference: ZC103238