Privacy notice
This notice explains what personal data Savy processes, why, the lawful basis for doing so, who we share it with, how long we keep it, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
Savy is Savy Solutions Limited, company number 15479653, registered at Huckletree, 9 Great Ancoats St, Manchester, M4 5AD. We are the data controller for the personal data described here. We are responsible for protecting your data. Our data-protection contact is privacy@savy.tax.
What Savy does with your data
Our terms of service describe the service itself; this notice covers the personal data it uses.
Savy helps you manage your tax. That includes finding out whether HMRC owes you a refund and claiming it, keeping your tax code right year to year, preparing and submitting tax returns, and sending HMRC the other documents it needs from you. To do that we need to know who you are, what you earn, what tax you pay and how HMRC can reach us about you.
The data we collect and why
| What | Where it comes from | Why we use it | Lawful basis |
|---|---|---|---|
| Your name, date of birth, contact details (WhatsApp number, email) | You | To run your account and talk to you | Contract |
| National Insurance number, Unique Taxpayer Reference | You, or HMRC records you authorise us to read | To identify you to HMRC and act as your agent | Contract; legal obligation (HMRC agent rules) |
| Employment, income and tax records (P60s, P45s, payslips, HMRC records) | You, your employer documents, HMRC with your authorisation | To work out whether you are owed a refund, keep your tax code right, and prepare returns and other HMRC submissions | Contract |
| Bank account details | You | To check that a refund has arrived and to take our fee | Contract |
| Bank transaction data (only if you connect a bank account) | Your bank, through an FCA-regulated open banking provider, with your consent | To spot refund payments automatically and to help manage your tax and savings on an ongoing basis | Consent for the bank access, which you can withdraw at any time; legal obligation to keep records that support advice and claims |
| Your messages with Savy, including voice notes and call recordings where you have been told a call is recorded | You | To answer you, keep a record of what was agreed, and improve the service | Contract; legitimate interest |
| Signed agent authority | You | So HMRC accepts Savy acting for you | Contract; legal obligation |
| How you found Savy and which pages you used | Your browser | To measure our marketing | Legitimate interest |
| Technical details of the device and connection you use when you connect Savy to HMRC | Your browser and our servers | HMRC requires software that uses its systems to send these fraud-prevention details with every request | Legal obligation |
We do not use your data to make solely automated decisions that have a legal or similarly significant effect on you. Savy uses AI systems to read documents and draft messages; a decision to submit a claim to HMRC is made with the refund calculation shown to you and your confirmation. Identifiers such as your National Insurance number are replaced with placeholders before text is sent to AI models.
Your HMRC sign-in details
Savy never asks for, sees or stores your Government Gateway user ID or password. When you connect Savy to HMRC you sign in on HMRC's own website, and HMRC gives Savy a limited access token for the permissions you approved. You can remove that permission at any time in your HMRC online account, and it expires on its own after 18 months.
Who we share it with
- HMRC, to act as your agent and claim your refund.
- Service providers that process data for us under contract: hosting and database (Supabase, Vercel), WhatsApp messaging (Meta), email (Resend), telephone and SMS (Twilio), voice assistant (ElevenLabs), payments (Stripe), open banking (Plaid, Credit Canary), accounting (Xero), and AI models used to read documents and draft replies (OpenAI).
- Professional advisers and regulators where the law requires.
Some providers process data outside the UK. Where they do, transfers are covered by the UK International Data Transfer Agreement or an adequacy decision.
How we keep it safe
Data is encrypted in transit and at rest. Identifiers and bank details are encrypted again at the field level with keys held in a separate vault. Each customer's records are isolated in our database, staff access is limited by role and logged, and staff must use multi-factor authentication. Our security page explains how to report a concern and what we do if something goes wrong.
How long we keep it
| Data | Kept for | Because |
|---|---|---|
| Conversation content | 6 years after our relationship ends | Records of advice given and instructions received, for HMRC enquiry and audit |
| Identity and tax records supporting a claim | 6 years after the end of the tax year or submission | HMRC and money-laundering record-keeping rules |
| Fee and payment records | 6 years | Companies Act and VAT rules |
| Open banking data | 6 years from the end of the tax year | Records supporting refunds and tax advice, for HMRC enquiry and audit |
| HMRC connection tokens | 18 months at most | HMRC authorisation validity |
| Marketing measurement | 2 years | Legitimate interest |
Your rights
You can ask us to: give you a copy of your data; correct it; delete it; restrict or object to how we use it; or give it to you in a portable, machine-readable form. Message Savy on WhatsApp or email privacy@savy.tax. We will confirm your identity, then answer within one month. Where we must keep something by law (for example claim records within HMRC's enquiry window), we will tell you what we are keeping and why.
You can withdraw consent for open banking at any time; we will disconnect the account and stop collecting. Transaction data already used to support a claim or advice is kept for the audit period above and then reviewed.
If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk.
Changes
We will tell you on WhatsApp or by email if this notice changes in a way that affects you.