Privacy

LodgeHQ is operated by Lodge HQ Ltd, a company registered in England and Wales. This policy explains what personal data we collect, why we collect it, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have questions about this policy, contact us at privacy@lodgehq.co.uk.

---

1. Who we are

LodgeHQ is a mobile-first application that helps self-employed tradespeople in the UK comply with HMRC's Making Tax Digital for Income Tax. The app handles bank transaction categorisation, receipt capture, quarterly submissions to HMRC, and end-of-year Final Declarations.

Data controller: Lodge HQ Ltd Company number: [To be added] Registered address: [To be added] Contact: privacy@lodgehq.co.uk

---

2. What data we collect

2.1 Account data

When you create a LodgeHQ account, we collect your name, email address, and a password (stored as a salted hash, never in plain text). If you provide a phone number for account recovery, we store that too.

2.2 Trade and tax identifiers

During onboarding, we collect information about your self-employment: your trade type, the date you started trading, your accounting method (cash basis or accruals), and whether you are registered under the Construction Industry Scheme (CIS). When you connect to HMRC, we receive your National Insurance Number (NINO) and Unique Taxpayer Reference (UTR) via HMRC's OAuth process. We store these to identify your HMRC records.

2.3 HMRC connection

We connect to HMRC on your behalf using their OAuth 2.0 process. You sign in to HMRC's Government Gateway directly — we never see or store your Government Gateway password. HMRC provides us with an access token and refresh token, which we store securely to maintain the connection. These tokens allow us to submit returns and retrieve your tax status on your behalf.

2.4 Bank transaction data

If you connect a bank account, we receive transaction data (date, amount, merchant name, and reference) via a regulated Open Banking provider. We do not have access to your bank login credentials, your account balance, or the ability to move money from your account. The Open Banking connection is read-only. Your bank controls which data is shared and you can revoke access at any time through your bank's app.

Our Open Banking provider is authorised and regulated by the Financial Conduct Authority (FCA). Their own privacy policy applies to the data they process on our behalf.

2.5 Transaction categorisation and records

We store the categories you assign to transactions (business expense, personal, income), any categorisation rules the app learns from your decisions, and any manual transactions you add (cash income, personal-card expenses). This data forms your digital tax records.

2.6 CIS deduction records

If you are a CIS subcontractor, we store records of CIS deductions reported on your income: the gross amount, the deduction amount, the deduction rate, and the contractor's details. These are used for year-end reconciliation with HMRC.

2.7 Mileage and use-of-home data

If you use LodgeHQ's mileage tracking, we store journey records (date, distance, purpose). If you claim use-of-home simplified expenses, we store your monthly working hours. We do not track your GPS location.

2.8 Receipts and documents

If you photograph or upload receipts, we store the image and any data extracted by OCR (date, amount, merchant name). If you upload CIS deduction statements, we store those images.

2.9 Submissions to HMRC

We store a record of every submission made to HMRC on your behalf: quarterly updates, annual summaries, and Final Declarations, along with HMRC's confirmation references and any error responses.

2.10 Device and technical data

To comply with HMRC's fraud prevention requirements (mandated by the Taxes (Digital Requirements) Regulations 2019), we collect and transmit technical data with every HMRC API call. This includes your device type, operating system, browser, IP address, screen resolution, and timezone. HMRC requires this data by law and we are legally obligated to send it. This data is transmitted directly to HMRC and is subject to HMRC's own privacy notice.

2.11 Payment data

If you pay for a submission, your payment is processed by Stripe. We do not store your full card number. Stripe provides us with the last four digits of your card, card brand, and payment status. Stripe's own privacy policy applies to the card data they process.

---

3. Why we collect this data and our lawful basis

---

4. Who we share your data with

We share your data only where necessary to provide the service or where required by law.

HMRC. We submit your quarterly updates, annual summaries, Final Declarations, and CIS deduction data to HMRC via their APIs. We also transmit fraud prevention headers (device and technical data) as required by law.

Open Banking provider. Your bank transaction data is transmitted via our Open Banking provider, who is FCA-authorised. They process data as our data processor.

Stripe. Payment processing is handled by Stripe. They receive your card details directly — we do not handle or store full card numbers.

Hosting and infrastructure. Your data is stored on servers provided by Vercel Inc. and their underlying infrastructure providers. These providers act as data processors under contract with us. Vercel's data processing is governed by their Data Processing Addendum.

We do not sell your personal data. We do not share your data with advertisers. We do not use your data for marketing by third parties.

---

5. How we store and protect your data

All data is stored in the UK or EEA. Data is encrypted in transit (TLS 1.2+) and at rest. HMRC tokens and tax identifiers are stored with additional encryption at application level. Passwords are hashed using bcrypt. Access to production systems is restricted to authorised personnel only.

---

6. How long we keep your data

While your account is active: We retain all data necessary to provide the service.

After you close your account: HMRC recommends keeping self-employment income records for 5 years after the 31 January submission deadline of the relevant tax year. For example, records for the 2026/27 tax year (submitted by January 2028) should be kept until January 2033. We retain your submission records and supporting transaction data for this period in a locked, read-only state. After the retention period expires, we delete the data.

Fraud prevention data: Device and technical data sent to HMRC is retained by HMRC under their own retention policy, not by us.

Payment records: Retained for 7 years to comply with accounting and tax obligations.

---

7. Your rights

Under UK GDPR, you have the right to:

Access your personal data — request a copy of everything we hold about you.

Rectification — ask us to correct any inaccurate data.

Erasure — ask us to delete your data, subject to our legal retention obligations (section 6 above). We cannot delete data that we are legally required to retain.

Data portability — receive your data in a structured, machine-readable format. LodgeHQ provides a full data export (JSON + files) from the Settings screen at no cost.

Restrict processing — ask us to limit how we use your data in certain circumstances.

Object — object to processing based on legitimate interests.

Withdraw consent — where processing is based on consent (none of our core processing currently is), you can withdraw it at any time.

To exercise any of these rights, contact privacy@lodgehq.co.uk. We will respond within 30 days.

---

8. Cookies

LodgeHQ uses essential cookies only — session tokens and CSRF protection. We do not use analytics cookies, advertising cookies, or third-party tracking cookies. No cookie consent banner is needed because we only use strictly necessary cookies.

---

9. Children

LodgeHQ is not intended for anyone under 16. We do not knowingly collect data from children.

---

10. Changes to this policy

If we make material changes to this policy, we will notify you by email and/or an in-app notice before the changes take effect. The "last updated" date at the top of this page will always reflect the current version.

---

11. Complaints

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO):

Website: https://ico.org.uk/make-a-complaint/ Helpline: 0303 123 1113

---

LodgeHQ is operated by Lodge HQ Ltd, registered in England and Wales. Company number: [To be added].

Contact: privacy@lodgehq.co.uk