Privacy Policy

Last updated: 7 September 2026

1. Who we are

TaxPilot ("we", "us", "our") is a UK-based Chrome extension and service that helps individuals file their HMRC Self Assessment tax return. The service is operated by Phil Vamplew.

Contact: support@tax-pilot.co.uk

2. What data we collect

When you use TaxPilot, we collect:

• Google account information — your name and email address, obtained via Google Sign-In when you authenticate.
• Chat messages — the questions you type into the TaxPilot sidebar are sent to our backend server and then to Google's Gemini AI to generate a response. We do not permanently store your individual chat messages.
• Usage counts — we track how many messages you have sent (for free tier enforcement). This is a simple counter stored against your account.
• P60/tax document data — if you upload a P60 or tax document, it is sent to our server, processed by AI to extract figures, and the extracted figures are returned to your browser. We do not permanently store uploaded documents or their contents.
• Tax profile data — information you enter into TaxPilot (tax code, income sources, employer name) is stored locally in your browser using Chrome's local storage. This is not transmitted to our servers.
• Payment information — if you subscribe to TaxPilot Pro, your payment is processed by Stripe. We do not store your card details. We receive a Stripe customer ID and subscription status.

3. How we use your data

• To authenticate you and maintain your account
• To answer your tax questions using AI (via Google Gemini)
• To enforce the free message limit and Pro subscription
• To process payments via Stripe
• To monitor service health and prevent abuse

4. Third-party services

TaxPilot uses the following third-party services to operate:

• Google Gemini AI — your questions are sent to Google's Gemini API to generate answers. Google Privacy Policy →
• Google Sign-In (OAuth) — used for authentication. Google Privacy Policy →
• Stripe — payment processing for Pro subscriptions. Stripe Privacy Policy →
• Railway — cloud hosting for our backend server and database. Data is stored in EU-region servers.

5. Data storage and security

Your account data (name, email, plan status, usage count) is stored in a PostgreSQL database hosted on Railway. The database is not publicly accessible and connections are encrypted.

Your local tax profile data (tax code, income sources, P60 figures) is stored in Chrome's chrome.storage.local on your own device and is never transmitted to our servers.

6. Data retention

• Account data is retained for as long as your account is active.
• Token usage logs are retained for 90 days for billing and monitoring purposes.
• You can request deletion of your account at any time by emailing us.

7. Your rights (UK GDPR)

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to processing
• Data portability

To exercise any of these rights, email support@tax-pilot.co.uk. We will respond within 30 days.

8. Cookies

TaxPilot does not use cookies. Authentication tokens are stored in Chrome's local storage, not in browser cookies.

9. Children's privacy

TaxPilot is intended for adults filing UK tax returns. We do not knowingly collect data from anyone under the age of 18.

10. Changes to this policy

We may update this privacy policy from time to time. Material changes will be communicated via the extension or by email. Continued use of TaxPilot after changes constitutes acceptance of the updated policy.

11. Contact

For any privacy-related questions or requests, contact us at:
support@tax-pilot.co.uk

---

This policy applies to the TaxPilot Chrome extension and associated backend service at taxpilot-backend-production-5b67.up.railway.app.