Privacy policy

The short version

• Your financial data exists to compute your tax position — nothing else.
• CSV files are parsed in your browser; nothing is stored until you confirm an import.
• Our analytics never contain amounts, holdings or file contents.
• You can download everything or delete everything, yourself, at any time, from Settings.
• We never sell data or share it with advertisers.

What we collect

Account data: your email address and authentication records, used to sign you in and send transactional email (e.g. import confirmations, tax-year reminders).

Financial data you import: transactions, accounts and instruments from files you upload or enter manually. Files parse in your browser first; on confirmation the transactions and the original file are stored in your workspace, access-controlled at the database row level so only your workspace's members can read them.

Usage analytics: feature-level events only (e.g. “viewed CGT summary”). Events never include amounts, tickers, holdings or file contents.

What we do with it

Compute your Capital Gains Tax position, ISA allowance use and Self Assessment estimates; show them to you; and generate the exports you request. Figures are informational estimates — never advice — and we don't make decisions about you with them.

Who processes it

Infrastructure providers acting under contract: Vercel (hosting), Supabase (database and authentication), Stripe (payments — card details never touch our servers) and Resend (transactional email). We do not share your data with advertisers or data brokers, and we do not sell it.

Cookies and local storage

Essential authentication cookies only. Preferences such as theme and table density live in your browser's local storage and never leave your device. No advertising or cross-site tracking cookies.

Your rights

Under UK GDPR you can access, correct, export and erase your data. The export (full workspace JSON) and hard delete are self-service in Settings — no request forms, no waiting period. Deletion is permanent. You can also complain to the ICO (ico.org.uk) if you believe we've mishandled your data.

Retention and security

Data is kept while your workspace exists and removed on deletion. Everything is encrypted in transit and at rest; imported files live in private storage with signed, expiring access; transaction contents are excluded from application logs.

Contact

Privacy questions: privacy@pooled.tax.