Privacy Policy

Last updated: 14 August 2026

1. Who we are

Relevy is a software service that helps sole traders and landlords keep digital records and file their Income Tax updates with HM Revenue & Customs (HMRC) under Making Tax Digital for Income Tax (MTD ITSA).

The service is provided by Relevy Ltd, a company registered in England and Wales (company number 17313884), registered office 20 Brawton Grove, Darlington, DL3 0GL, United Kingdom. In this policy, "Relevy", "we", "us" and "our" mean Relevy Ltd.

Relevy Ltd is the data controller for the personal data described in this policy, and is registered as a data controller with the Information Commissioner's Office (ICO), registration reference ZC222642.

If you have any questions about this policy or your data, contact us at privacy@relevy.co.uk.

2. What this policy covers

This policy explains what personal data we collect when you use Relevy, why we use it, who we share it with, how long we keep it, how we protect it, and the rights you have over it. It applies to the Relevy web application and website at relevy.co.uk.

3. The personal data we collect

Account and business details you give us:

• Your name and email address
• Your trading name and business address
• Your Unique Taxpayer Reference (UTR), National Insurance number (NINO), and VAT number where applicable

We need your UTR and NINO because HMRC's Making Tax Digital system identifies taxpayers by them; we cannot file on your behalf without them.

Business records you enter into the service:

• Details of your own customers or tenants (names, addresses, email addresses)
• Quotes, jobs, invoices, expenses, and the income and expenditure figures that make up your tax records

Data created when you connect to HMRC:

• OAuth access and refresh tokens issued by HMRC when you authorise Relevy to interact with your tax account on your behalf. We never see or store your HMRC (Government Gateway) sign-in details. You enter those directly on HMRC's own website.

Payment data:

• When you subscribe, your card and billing details are collected and processed by our payment provider, Stripe. Relevy does not store your full card number.

Technical data:

• Standard information your browser sends (IP address, browser type, device information) and information required by HMRC's fraud-prevention rules, which we are legally obliged to transmit with each submission to help prevent tax fraud.

4. How and why we use your data, and our lawful basis

We do not use your data for automated decision-making that produces legal or similarly significant effects about you.

5. HMRC and Making Tax Digital

The purpose of Relevy is to transmit your tax records and updates to HMRC when you choose to submit them. When you do, we send the relevant figures to HMRC using the access you have authorised, together with the fraud-prevention data HMRC requires. HMRC is a separate data controller for the data it receives; its handling of your data is governed by HMRC's own privacy notice.

6. Who we share your data with

We do not sell your personal data, and we do not share it with anyone for their own marketing.

We use a small number of trusted service providers ("processors") who handle data only on our instructions and under contract, solely to run the service:

• HMRC: to file your updates (as above)
• Stripe: to process subscription payments
• Resend: to send service emails
• Railway: to host the application and database (servers located in the European Economic Area, Amsterdam)
• Cloudflare: for our domain, DNS and email routing

We may also disclose data if required by law, court order, or to establish, exercise or defend legal claims.

7. Where your data is stored

Your data is hosted on servers located in the European Economic Area (EEA), in Amsterdam. Some of our processors (for example Stripe) may process limited data outside the EEA; where they do, they do so under appropriate safeguards such as UK/EU adequacy decisions or standard contractual clauses.

8. How long we keep it

We keep your personal data for as long as you have an active Relevy account. If you close your account, we will delete or anonymise your personal data, except where we need to retain certain records to meet legal, tax or accounting obligations (for example, HMRC's record-keeping requirements), after which it is securely deleted. You can ask us to delete your data at any time (see section 10).

9. How we protect your data

• All data is encrypted in transit using HTTPS/TLS.
• HMRC access tokens are encrypted at rest; all stored data sits on infrastructure with encryption at rest.
• Each customer's data is strictly isolated. You can only ever access your own records.
• Passwords are stored using strong one-way hashing; we can never see them.
• Access to production systems is limited to those who need it to run the service.

No system can be guaranteed completely secure, but we take these measures to protect your data and keep them under review.

10. Your rights

Under UK data protection law you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten")
• Restrict or object to our processing in certain circumstances
• Data portability: receive your data in a common, machine-readable format
• Withdraw consent at any time, where we rely on consent

To exercise any of these, email privacy@relevy.co.uk. We will respond within one month. Exercising your rights is free.

If you are not happy with how we handle your data, you can complain to the ICO at ico.org.uk, though we would appreciate the chance to put things right first.

11. Cookies

Relevy uses only essential cookies needed to keep you signed in securely and to protect against cross-site request forgery. We do not use advertising or third-party tracking cookies.

12. Changes to this policy

We may update this policy from time to time. If we make significant changes, we will notify you by email or through the service. The "last updated" date at the top shows when it was last revised.

13. Contact

Relevy Ltd · 20 Brawton Grove, Darlington, DL3 0GL, United Kingdom · privacy@relevy.co.uk