Privacy Policy
Last updated: 6 March 2026
1. Who We Are
Vatter is operated by Grasshopper Surveying Services Limited trading as vatter.co.uk, based in the United Kingdom. Our registered address is Strathspey, East Road, Weybridge, KT13 0LG. We are the data controller for the personal data you provide when using this service. You can contact us at support@vatter.co.uk.
2. What Personal Data We Collect
| Category | Examples | Source |
|---|---|---|
| Account data | Email address, password hash, two-factor settings | You, on registration |
| Entity data | Business name, VAT registration number, address, contact details | You, when adding an entity |
| HMRC credentials | OAuth access and refresh tokens scoped to VAT obligations and returns | HMRC, via the Making Tax Digital authorisation flow |
| VAT financial data | VAT return figures, obligations, liabilities, and payment records | HMRC API, retrieved on your behalf |
| Billing data | Stripe customer ID, licence purchase records | You and Stripe; we never store full card details |
| Technical data | IP address, browser type, log entries, error traces | Automatically collected during use |
3. How We Use Your Data
We use your personal data to:
- Create and maintain your account and authenticate you securely.
- Connect to HMRC on your behalf to retrieve VAT obligations, liabilities, and payments, and to submit VAT returns via Making Tax Digital.
- Process licence purchases and manage your subscription through Stripe.
- Send transactional emails (e.g. purchase confirmations, important notices) via Resend.
- Monitor and improve the reliability and security of the service using Serilog and Seq.
- Comply with our legal and regulatory obligations.
We do not use your data for advertising, and we do not sell your data to any third party.
4. Legal Basis for Processing (UK GDPR)
| Processing activity | Lawful basis |
|---|---|
| Providing the core service (HMRC connectivity, VAT submissions) | Performance of a contract (Article 6(1)(b)) |
| Processing licence payments | Performance of a contract (Article 6(1)(b)) |
| Sending transactional emails | Performance of a contract (Article 6(1)(b)) |
| Security monitoring and fraud prevention | Legitimate interests (Article 6(1)(f)) |
| Compliance with tax and financial regulation | Legal obligation (Article 6(1)(c)) |
5. Data Sharing
We share personal data only with the following categories of recipient, and only to the extent necessary:
- HMRC — to authenticate your account and exchange VAT data via Making Tax Digital APIs.
- Stripe — to process payments for licences. Stripe's privacy policy applies to data they hold.
- Resend — to deliver transactional emails. Only your email address and message content are shared.
- Seq / Datalust — our structured log aggregator, which may receive technical data including IP addresses and error traces.
- Hosting provider — our infrastructure provider processes data to host the application. We use providers within the UK or EEA, or with appropriate safeguards in place.
- Law enforcement or regulators — where required by law or to protect our legal rights.
We do not sell, rent, or trade personal data with any third party for their own marketing purposes.
6. Data Retention
We retain your account and entity data for as long as your account is active and for up to 6 years after account closure, to satisfy UK tax record-keeping obligations. HMRC OAuth tokens are deleted immediately if you disconnect your entity or close your account. Billing records are kept for 7 years in line with standard accounting requirements. Log data is purged after 90 days unless retained for active security investigations.
7. Your Rights Under UK GDPR
You have the following rights in respect of your personal data:
Access — request a copy of the personal data we hold about you.
Rectification — ask us to correct inaccurate or incomplete data.
Erasure — ask us to delete your data where there is no compelling reason for its continued processing.
Restriction — ask us to restrict processing of your data in certain circumstances.
Portability — receive your data in a structured, machine-readable format where processing is based on consent or contract.
Object — object to processing based on legitimate interests.
Withdraw consent — where we rely on consent, withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, email us at support@vatter.co.uk. We will respond within one calendar month.
8. Complaints
If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk or by calling 0303 123 1113. We would appreciate the opportunity to address your concerns directly before you contact the ICO — please email us first at support@vatter.co.uk.
9. Cookies
Vatter uses only strictly necessary cookies required for the application to function, including the ASP.NET Core authentication session cookie and anti-forgery tokens. We do not use advertising or analytics cookies. No cookie consent banner is displayed because no non-essential cookies are set.
10. Security
We implement appropriate technical and organisational measures to protect your personal data, including HTTPS encryption in transit, hashed password storage, HMRC OAuth token encryption at rest, and role-based access controls. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security but we take our obligations seriously and will notify you and the ICO of any breach as required by law.
11. International Transfers
We aim to process and store all personal data within the UK or EEA. Where a third-party processor (such as Stripe or Resend) transfers data outside these areas, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or adequacy decisions.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by displaying a prominent notice in the application. The "Last updated" date at the top of this page will always reflect the most recent revision. Continued use of Vatter after changes have been published constitutes acceptance of the updated policy.