Privacy Policy

Last updated: 28 September 2026 · ICO registration: in progress

1. What data we collect

2. Legal basis for processing

• Contract — To provide the service you signed up for (UK GDPR Art. 6(1)(b))
• Legal obligation — Financial records retained for our standard 7-year period, which exceeds HMRC's minimum requirement to keep self-employed records for at least 5 years after the 31 January submission deadline (Art. 6(1)(c))
• Legitimate interests — Security, fraud prevention, service improvement (Art. 6(1)(f))
• Consent — Optional features you switch on, such as push notifications (you can withdraw at any time in Profile settings)

3. How we use your data

• Calculate your UK Self Assessment tax and show you estimates
• Submit updates to HMRC through Making Tax Digital, only when you connect your HMRC account and ask us to
• Send you notifications (deadline reminders, HMRC results, team activity) in the app and, if you allow them, as push notifications
• Send you emails you need: verifying your address, resetting your password, security alerts, team invitations and replies to messages you send us
• Process subscription payments through Stripe
• Detect and prevent fraud and unauthorised access, and fix errors
• Improve the service

4. Who we share data with

We never sell your data.

5. Data retention

• Financial records — Retained for 7 years after the relevant tax year (our standard policy, exceeding HMRC's 5-year minimum for self-employed records)
• When you delete your account — your name, email, contact details, photo, NI number, HMRC connection, two-factor settings, notifications, sign-in history, Face ID / fingerprint keys and team access are removed straight away, and your subscription is cancelled. Financial records are kept for the 7-year period above, then deleted.
• Messages you send us — 12 months
• Audit logs — 12 months for security and compliance purposes
• Backups — Encrypted backups retained for 30 days

6. Your rights under UK GDPR

• Access — Request a copy of all data we hold about you. "Export my data" in Profile gives you everything straight away: your profile and tax details, income, expenses, mileage, vehicles, assets, HMRC submissions, notifications, team access, sign-ins and billing. Receipt images aren't in the file; contact us for copies and we'll provide them within one month, as the law requires
• Erasure — Request deletion of personal data (use "Delete My Account" in Profile — financial records are retained for our 7-year policy period regardless)
• Rectification — Correct inaccurate data via your Profile page
• Portability — Export your data as JSON at any time
• Objection — Object to processing based on legitimate interests
• Restriction — Request we limit processing while a dispute is resolved

To exercise any right or to complain, email contact@fisely.com. You also have the right to lodge a complaint with the ICO at ico.org.uk.

7. Security

• Data transmitted over HTTPS/TLS 1.2+
• UTR and NI numbers encrypted at rest using AES-256
• Passwords hashed with PBKDF2-SHA256 (600,000 iterations)
• Sign-in tokens expire after 60 minutes; Face ID / fingerprint sign-in keys expire after 90 days, or 30 days unused
• Rate limiting on authentication endpoints
• Optional multi-factor authentication (TOTP)

8. Cookies and local storage

We don't use cookies for sign-in, analytics or advertising. Signing in stores a token in your browser's local storage (web) or your phone's secure storage (apps), along with a few preferences such as your theme. It's removed when you sign out.

9. Children

Fisely is a tax tool for self-employed adults. It is not directed at anyone under 18, and we do not knowingly collect data from children. If you believe a child has provided us with personal data, contact contact@fisely.com and we will delete it.

10. Changes to this policy

We will notify you by email of any material changes to this policy at least 14 days before they take effect. Continued use of the service after that date constitutes acceptance.