MTDLite Privacy Policy

*Last updated: 14 July 2026

1. Who we are

MTDLite is provided by Tricept Limited, a company registered in England and Wales (company number 6534450), registered office at Imperial House, Harley Place, Bristol, BS8 3JT. We are the "data controller" for the personal data described in this policy — in plain English, that means Tricept Limited is legally responsible for protecting your data and for how it's used, not any third party we work with.

Contact: [email protected]

ICO registration reference: C1982728

2. What data we collect

  • Account information: email address, passwordless login is built in so we use login-link history — for account holders.
  • Profile information: name/label you give a profile, National Insurance number, contact email (if you invite someone else to authorise their own HMRC connection), Quarterly Date Choices.
  • HMRC connection data: OAuth access and refresh tokens obtained when you or a linked profile authorises MTDLite against HMRC via Government Gateway. These are encrypted at rest. We never see or store your Government Gateway password.
  • Filing data: the income and expense figures you submit for each quarterly update, and HMRC's response to each submission.
  • Payment data: processed by Stripe on our behalf — we do not store your card details. We retain the amount paid, credits purchased, and Stripe's own transaction/session identifiers for reconciliation.
  • Technical data: IP address and device information, collected as part of HMRC's mandatory fraud-prevention header requirements for all MTD-connected software, and standard web server logs.

3. Why we process this data, and our legal basis

  • To provide the service you've asked for (submitting your quarterly MTD updates to HMRC on your instruction) — legal basis: performance of a contract with you.
  • To meet HMRC's fraud-prevention requirements — legal basis: legal obligation, as a condition of our HMRC software recognition.
  • To process payments — legal basis: performance of a contract; Stripe processes card details directly under its own terms.
  • To send you filing deadline and re-authorisation reminders — legal basis: performance of a contract (this is a core part of the service, not marketing).
  • To keep records for tax/audit purposes — legal basis: legitimate interest (Article 6(1)(f)). The legal duty to retain tax records belongs to you, the taxpayer, not to us as your software provider — we retain filing records for seven years as a matter of caution, to support you in meeting that duty and to maintain a reliable audit trail of what was submitted on your instruction.
  • To share your data with an account holder, if you're a linked profile — legal basis: consent (Article 6(1)(a)). This is a distinct legal basis from the others above: it applies specifically to another person on the platform (the account holder) being able to see and act on your data, and only applies once you've explicitly agreed to it. See Section 5 for how and when this consent is obtained, and how to withdraw it.

4. Who we share data with

  • HMRC — necessarily, since submitting your filing is the entire point of the service.
  • Stripe — for payment processing.
  • Resend — for sending reminder and account emails.
  • Railway — our hosting provider, storing the underlying database.

We do not sell your data, and we do not share it with anyone for marketing purposes.

5. Linked profiles — consent to sharing with your account holder

Some MTDLite accounts are used by an account holder ("the Client," in our own terminology) to manage MTD filing on behalf of other people or businesses — for example, a spouse, or an accountant's clients — as "linked profiles."

If you are added as a linked profile, before your HMRC authorisation begins MTDLite asks you to give explicit, informed consent confirming you agree to your data being managed, edited, and shared with the account holder through MTDLite. This is separate from, and in addition to, the general processing described elsewhere in this policy — it specifically concerns another person on the platform (the account holder) being able to see and act on your data, not just Tricept processing it on your behalf. We record the date, time, and IP address at which this consent is given, so we can demonstrate it was genuinely obtained.

Where you are both the account holder and the profile — managing your own filing, with no one else involved — the same consent step appears before HMRC authorisation begins, but it simply confirms your agreement to MTDLite's own processing of your data; no third party is involved in that case.

You can withdraw consent given as a linked profile at any time by contacting [email protected]. Withdrawing means the account holder can no longer manage your profile through MTDLite, and your HMRC authorisation for that purpose would need to be reconsidered.

If you're a linked profile without your own MTDLite login, you can request a copy of your data by emailing [email protected].

6. How long we keep data

  • Filing records (submitted figures and HMRC responses): seven years, retained as a matter of caution to support your own tax record-keeping obligations and to maintain a reliable audit trail — see Section 3.
  • Account and profile data: for as long as your account is active, plus a reasonable period after closure for legitimate interest/audit purposes.
  • HMRC OAuth tokens: until the connection is revoked or the token naturally expires and is not renewed.

7. Your rights

Under UK GDPR, you have the right to: - Access the personal data we hold about you - Correct inaccurate data - Request deletion of your data (subject to our retention of tax-related records for the periods described above, which we keep as a matter of legitimate interest — see Section 3) - Restrict or object to certain processing - Receive your data in a portable format - Complain to the Information Commissioner's Office (ico.org.uk) if you believe we've mishandled your data

To exercise any of these rights, contact [email protected].

If you're an account holder, you can download a copy of any profile's data (details and full filing history) directly from your dashboard at any time. If you're a linked profile without your own MTDLite login, you can request a copy of your data by emailing [email protected].

8. Security

HMRC access and refresh tokens are encrypted at rest. We follow HMRC's mandatory fraud-prevention header requirements on every connected API call.

9. Children

MTDLite is not intended for use by anyone under 18.

10. Changes to this policy

We may update this policy from time to time. Material changes will be notified to account holders by email.

11. Contact

MTDLite Team Tricept Limited Imperial House Harley Place Bristol, BS8 3JT Company Number: 6534450 [email protected]

Back