How we handle your data.

This notice covers the Pippa app and the pippa.tax website. It replaces our previous waitlist-only privacy notice. Some features described here (for example filing with HMRC and paid subscriptions) arrive when the app launches; where that matters we say so. We've tried to write it in plain English — if anything is unclear, email privacy@pippa.tax.

1. Who we are

“Pippa” is operated by Pippa Money Ltd, a private limited company registered in England & Wales (company number 17189960), registered office Suite RA01, 195-197 Wood Street, London E17 3NU. We are the data controller for the personal data described here, registered with the Information Commissioner's Office (ICO registration ZC136982).

Pippa is a tax app for UK sole traders and landlords, offered in the UK only. It connects to your bank through Open Banking, helps you categorise your income and expenses, and (when the filing feature launches) prepares and submits your figures to HMRC under Making Tax Digital for Income Tax. We provide the Open Banking part as an agent of Finexer, an FCA-authorised Open Banking provider.

We have assessed whether we must appoint a Data Protection Officer and concluded we do not need one; data-protection queries are handled by our CTO at privacy@pippa.tax.

2. The short version

• We use your bank and financial data for one purpose: to prepare and file your tax. We do not sell it, and we never use it for advertising.
• You connect your bank yourself, and you can disconnect at any time.
• Our AI helps categorise your transactions, but you review and can correct every figure before anything is filed with HMRC.
• You have strong rights over your data, set out in section 12.

3. What personal data we collect

• Account and sign-in: your email address, name, and the identifier from your sign-in method. Today you can sign in with an email one-time passcode, or with Google on the web app; Google sign-in on mobile and Sign in with Apple are coming soon.
• Your tax profile: details you give us during onboarding, such as the kind of work you do, whether you are a sole trader or landlord, and your tax residency.
• Bank and financial data: when you connect a bank account through Open Banking, we retrieve up to 24 months of your transaction history — enough to prepare your tax for the current tax year or the previous one — and keep it up to date while connected. We receive your transactions, balances, and your account identifiers, including your full account number, sort code and IBAN where your bank provides them. You see only a masked version in the app (for example, ending 1234); the full identifiers are held encrypted and are never displayed. We also receive details of who you paid or were paid by.
• Bookkeeping data: if you connect FreeAgent or Xero, we import the income and expense records you choose to share.
• Documents: receipts and documents you upload, and the information our system extracts from them.
• Tax data: the figures we derive and, once the filing feature launches, the updates and returns submitted to HMRC.
• Subscription and payments: when you subscribe, we receive your subscription status and payment references from Stripe or from Apple or Google in-app purchase. We do not receive or store your card number.
• Support: the messages you send us.
• Device and usage data: your IP address, device and app information, and product-analytics data about how you use Pippa (see section 14).

4. Do you have to give us this data?

Some data is necessary to use Pippa. To create an account we need your email address. To use the bank-connection and tax features we need you to connect a bank through Open Banking; without that, the core service cannot work. Connecting FreeAgent or Xero is optional. Once you have prepared and filed tax figures, we keep those records for the legal retention window (see section 11), even if you later close your account — tax law requires you to keep them, and keeping them safe for you is part of our service.

5. People you pay (“silent party” data)

Your bank transactions include limited information about the people and businesses you transact with, who are not Pippa users — typically a name, a payment reference, and sometimes account identifiers (which we hold encrypted). We receive this only as part of your transaction records and use it to categorise your transactions for tax, to detect transfers between your own accounts, to de-duplicate payouts, and to keep audit-defensible records. We scrub these identifiers from our logs and analytics, and we never contact or market to those people. Our lawful basis is our legitimate interest in providing you an accurate tax service, balanced against their interests. Because we must keep your tax records for 7 years (see section 11), we cannot fully delete this information during that window; the banking identifiers are held encrypted, and the data is hard-deleted at the end of the period. Those people have the same rights set out in section 12 and can contact us at privacy@pippa.tax. Because it is not practical to notify each such person individually, we provide this information through this public notice (UK GDPR Article 14).

6. Sensitive information

Occasionally a transaction may reveal sensitive information about you, for example a payment to a health provider or a donation. We do not ask for this and we do not use it to profile you or make decisions about you; it is processed only as an unavoidable part of showing and categorising your own transactions, and we minimise and protect it. Our lawful basis under Article 6 is our contract with you (the same as for all transaction data, see section 7). Our position is that this incidental processing does not engage the special-category rules in Article 9. We keep this position under review and will update this notice if it changes.

7. How we use your data and our lawful basis

• To provide the Pippa service (your account, categorisation, tax estimate, and processing your bank transactions): performance of our contract with you (UK GDPR Article 6(1)(b)).
• To access your bank data through Open Banking: performance of our contract (Article 6(1)(b)). Before we can connect, you complete an authorisation in your bank's own app or website — a requirement of the Payment Services Regulations 2017, separate from our data-protection lawful basis.
• To process limited data about people you pay (section 5): our legitimate interest in providing you an accurate tax service (Article 6(1)(f)).
• To categorise your transactions using AI: our legitimate interest in providing an accurate, low-effort tax service (Article 6(1)(f)), always with your review and correction (section 9).
• To prepare your figures for HMRC and, when the filing feature launches, submit them: performance of our contract (Article 6(1)(b)); we then keep the resulting tax records for the statutory window under our contract with you and our legitimate interests (your own tax-law duties and possible HMRC enquiries).
• To keep Pippa secure and prevent fraud and misuse: our legitimate interest in protecting you and our service (Article 6(1)(f)).
• For product analytics (website and app) and error monitoring: our legitimate interest in understanding and improving Pippa and keeping it stable (Article 6(1)(f)), with a simple opt-out for analytics — on the website, the footer switch; in the app, an opt-out control is coming before launch, and until then you can opt out by emailing privacy@pippa.tax (see section 14).
• For the early-access waitlist and product-update emails: your consent (Article 6(1)(a)).
• To meet our own legal and regulatory obligations: legal obligation (Article 6(1)(c)).

8. Open Banking and your bank data

We provide the Open Banking connection as an agent of Finexer, an FCA-authorised Account Information Service provider. When you connect an account, you authorise access through your bank's own secure flow. We use the data only to prepare your tax. Open Banking access is time-limited and renewed only with your agreement, and you can disconnect a bank at any time in the app, which stops further access. What we have already used to prepare your tax is kept as part of your tax records (see section 11).

9. AI and automated decisions

Pippa uses AI (Google Vertex AI, in the UK) to suggest an expense or income category for each of your transactions, based on the transaction description, the merchant, and the amount. Because these suggestions can affect your tax, we build safeguards around them, even though they are not solely automated decisions (you review and approve everything before it counts): you see and can change every suggested category; nothing is filed with HMRC until you have reviewed and approved your figures; and you can ask a member of our team to review any automated categorisation, and challenge it, by emailing privacy@pippa.tax. These rights are protected under UK data-protection law, including the automated-decision rules updated by the Data (Use and Access) Act 2025.

10. Who we share your data with

We do not sell your data and we do not share it with advertisers or ad-tech. We use a small set of trusted providers to run the service: Google Cloud (hosting and AI categorisation; UK, London region; not used to train Google's models), Google Identity Platform / Firebase (sign-in), Upstash (short-lived sign-in and session data, hosted in the EU), Cloudflare (security and content delivery), Resend (email delivery; US, see section 16), PostHog (product analytics; EU, Frankfurt), FreeAgent and Xero (only if you choose to connect them), and Stripe, Apple and Google Play (subscription payments, when you subscribe; they handle your card details, not us).

The providers that process data on our instructions (Google, Cloudflare, Resend, PostHog, Upstash and Finexer) are bound by data-processing agreements. Finexer is also our FCA-authorised Open Banking principal: it retrieves your bank data on our instructions under a data-processing agreement, and it separately has its own legal duties (and its own privacy notice) for the parts of the service it must operate as a regulated provider. When the filing feature launches, we share your tax figures with HMRC because UK law requires it. If the law otherwise requires us to disclose data (for example, a court order), we will, and we will tell you where we are legally allowed to.

11. How long we keep it

• Tax records (bank transactions used for tax, derived figures, and HMRC submissions once filed): 7 years from the end of the relevant tax year — tax law requires records to be kept, and HMRC can open enquiries (and legal claims can arise) for years afterwards.
• Account and profile data: deleted within 30 days of you closing your account, except tax records within the period above.
• Bank access: removed when you disconnect, close your account, or ask us to.
• Support messages: 2 years, or longer if needed to resolve a dispute.
• Server and application logs, including your IP address: 30 days.
• Audit and security records: up to 6 years.
• Waitlist email: deleted after 12 months if you have not created an account.
• Product analytics: up to 14 months.

The full schedule is in our Data Retention & Deletion Policy, available on request.

12. Your rights

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erase your data. We will delete what we can, but we keep tax records for the retention window in section 11 even if you ask us to erase them — your own tax-law duties and possible HMRC enquiries mean deleting them early could seriously harm you — and we will explain what we have kept and why.
• Restrict our processing.
• Data portability: receive, in a portable format, the data you gave us that we process by automated means on the basis of consent or contract (you can get a copy of everything else through your right of access).
• Withdraw consent at any time where we rely on it (for example, product-update and marketing emails). Your bank connection runs on our contract with you rather than on consent; you can disconnect it at any time in the app. For analytics, use the opt-out described in section 14.

Right to object. Where we rely on our legitimate interest (for example, AI-assisted categorisation, processing data about people you pay, or security monitoring), you can object at any time by emailing privacy@pippa.tax. We will stop unless we have compelling legitimate grounds that override your interests, or we need the data for legal claims.

To exercise any of these, email privacy@pippa.tax. We will respond without undue delay and within one month; for complex or numerous requests we may extend this by up to two further months and will tell you if we do. We acknowledge any data-protection complaint within 3 working days (and in any event within the 30 days required by law) and aim to give you a substantive answer within 30 days. You can also complain to the ICO at ico.org.uk/make-a-complaint or on 0303 123 1113.

13. How we protect your data

We encrypt your data in transit and at rest, hold the connection credentials and account identifiers we keep (such as your bookkeeping tokens and your bank account number, sort code and IBAN) under additional encryption, restrict access to the people who need it, and host in the UK and EU. For your bank connection, the bank's own access token is held by our Open Banking provider, Finexer, not by us; we hold only a reference identifier that lets us retrieve your transactions through Finexer, and it is deleted when you disconnect. More detail is in our Information Security Policy, available on request.

14. Cookies and analytics

On the pippa.tax website, we use one privacy-friendly analytics tool, PostHog (hosted in the EU, Frankfurt), to collect usage statistics that don't identify you by name (pages viewed, links clicked), solely to improve the site. UK law (PECR Schedule A1, introduced by the Data (Use and Access) Act 2025) permits first-party, statistics-only analytics without a consent banner, provided we tell you clearly and give you a simple, free way to object — the “Usage analytics” switch in the footer. Turn it off and no analytics data is collected or stored on your device; we keep only a small record of your choice. We never use session recording. Separately, if the site hits a technical error we send a scrubbed error report to PostHog so we can fix it; this runs on our legitimate interest in keeping the site working and contains no analytics or browsing data (when you have opted out, error reporting continues without using cookies or device storage). We do not run advertising pixels, retargeting, or third-party trackers.

In the Pippa app, we use PostHog for product analytics and error monitoring. We are adding an in-app control that lets you opt out of product analytics (until it ships, email privacy@pippa.tax); error monitoring that keeps the app stable and secure runs on the basis of our legitimate interest. We never use in-app analytics for advertising.

15. Children

Pippa is not intended for anyone under 18, and we do not knowingly collect data from children.

16. Sending data outside the UK

Your data is stored and processed mainly in the UK (Google Cloud, London) and the EU (PostHog, Frankfurt). Where a provider is based in or transfers data to the United States, we rely on an approved safeguard: Resend, Google and Cloudflare are covered by the UK-US Data Bridge (the UK Extension to the EU-US Data Privacy Framework), with standard contractual clauses incorporating the ICO-approved UK Addendum standing as a fallback under their data-processing agreements. PostHog is US-headquartered but hosts our data in the EU with no US replication, and also holds a UK Extension certification. Some short-lived sign-in and session data is held by Upstash on servers in the EU (Belgium); the UK treats the EU as adequate, so no extra safeguard is needed. Before launch this moves to Google Cloud's UK region. You can check the participant list at dataprivacyframework.gov, and you can request a copy of the standard contractual clauses we rely on by emailing privacy@pippa.tax.

17. Changes to this notice

We may update this notice from time to time as the service develops. The “Last updated” date at the top shows when. If we make a material change to how we use your data, we will tell you.

18. How to contact us

For any privacy question or request, email privacy@pippa.tax, or write to Pippa Money Ltd (company no. 17189960), Suite RA01, 195-197 Wood Street, London E17 3NU, United Kingdom.