← Back to home

Privacy Policy

Last updated: July 2026

Who We Are

BetterCallSam is an AI-powered tax submission service for UK self-employed sole traders with a single self-employment business, subject to Making Tax Digital for Income Tax Self Assessment (MTD ITSA). We do not handle property income, VAT, partnerships, or limited company data. We act as the data controller for the personal data processed through our service. BetterCallSam is operated from the United Kingdom and all our servers are located in the UK. You can contact us at paul@better-call-sam.co.uk.

What Personal Data We Process

To provide our tax submission service, we process the following personal data:

  • National Insurance Number (NINO) — used to identify you with HMRC
  • HMRC OAuth tokens — used to authenticate API requests to HMRC on your behalf
  • Business details — trading name, business ID, and accounting period dates as registered with HMRC
  • Self-employment financial records — self-employment income and expense data from files you upload for quarterly submissions
  • Tax calculations — obligation status, income summaries, and tax breakdowns retrieved from HMRC
  • Chat messages — conversations with our AI assistant during the submission process
  • Device information — browser type, screen size, timezone, and device ID collected for HMRC fraud prevention header compliance
  • Usage data — pages visited and basic device information collected via analytics cookies (see Cookies & Analytics below)

Why We Process Your Data

We process your personal data for the following purposes:

  • Tax submission — submitting your quarterly updates and final declaration to HMRC via the MTD ITSA APIs
  • AI-assisted categorisation — processing your financial records through an AI model to categorise income and expenses into HMRC-compliant categories
  • Fraud prevention — collecting device information as required by HMRC to comply with their fraud prevention header specification
  • Service delivery — displaying your obligations, tax position, and submission history, and letting you resume a session where you left off
  • Service improvement — understanding how the service is used so we can fix problems and improve it

Lawful Basis for Processing

We rely on the following lawful bases under UK GDPR:

  • Contract (Article 6(1)(b)) — processing is necessary to perform the tax submission service you have signed up for
  • Legal obligation (Article 6(1)(c)) — HMRC requires us to collect and transmit fraud prevention headers as a condition of using their APIs
  • Legitimate interests (Article 6(1)(f)) — keeping the service secure and understanding how it is used so we can improve it

Third-Party Data Processors

Your data is shared with the following third parties solely for the purpose of delivering our service:

  • HMRC — your financial data, NINO, and fraud prevention headers are transmitted to HMRC via their MTD APIs to fulfil your tax obligations
  • relaxAI — your chat messages and uploaded financial data are processed by an open-source AI model (DeepSeek) hosted by relaxAI on infrastructure located in the United Kingdom, in order to categorise transactions and provide guidance
  • Civo — our application and database are hosted on Civo, a UK cloud provider, in their London data centre
  • Google Analytics — we use Google Analytics to understand how visitors use our public pages; Google processes usage data such as pages visited and approximate location (see Cookies & Analytics below)

We do not sell, rent, or share your personal data with any other third parties for marketing or any other purposes.

How We Protect Your Data

  • HMRC OAuth tokens are encrypted at rest using AES-256-GCM
  • All data is transmitted over encrypted connections (TLS), including all traffic to HMRC and to our AI provider
  • We send the fraud prevention headers HMRC requires for our type of application
  • No passwords or HMRC credentials are stored by our application
  • Authentication is handled via HMRC's own OAuth 2.0 flow — we never see your Government Gateway password
  • All data is stored on servers located in the United Kingdom

Data Retention

We store your account details, chat history, uploaded financial data, and submission records in a database hosted in the UK. This lets you resume a session where you left off and keeps a record of what was submitted to HMRC on your behalf.

  • HMRC OAuth tokens are stored encrypted and are deleted when you disconnect your HMRC account or ask us to delete your data
  • Your other data is retained while your account is active, so your submission history remains available to you
  • You can ask us to export or delete your data at any time by emailing paul@better-call-sam.co.uk — we will respond within one month, and usually much sooner

Cookies & Analytics

We use a small number of cookies and similar technologies:

  • Essential — used to keep you signed in and to maintain your session; the service cannot work without these
  • Analytics (Google Analytics) — used to measure how our public pages are used. Google sets cookies and receives usage data such as pages visited, browser type, and approximate location. Your tax data, chat messages, and financial records are never shared with Google.

You can block or delete cookies in your browser settings; blocking analytics cookies does not affect the service.

Your Rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Object to or restrict processing of your data
  • Data portability — receive an export of your data
  • Withdraw consent at any time (where consent is the lawful basis)
  • Lodge a complaint with the Information Commissioner's Office (ICO)

To exercise any of these rights, email paul@better-call-sam.co.uk. We will respond within one month.

Data Breaches

If a security incident affects your personal data, we will report it to HMRC and to the Information Commissioner's Office within 72 hours of becoming aware of it, and we will inform affected users without undue delay.

Changes to This Policy

We may update this policy from time to time. The “last updated” date at the top of this page shows when it last changed, and we will notify you of significant changes.

Contact Us

For any questions about this privacy policy or to exercise your data rights, contact us at:

paul@better-call-sam.co.uk

For security concerns, see our security page.