Privacy & what we send to HMRC

Last updated 23 July 2026.

The short version

You are in control. This software never files anything for you. You connect with your own Government Gateway account, you review your figures, and you press submit yourself.
We only send HMRC what the law requires: your income and expense figures for your quarterly updates and final declaration, plus a set of technical "fraud prevention headers" that all MTD software must send by law.
We don't sell your data and we don't share it with anyone except HMRC (and our hosting providers, who process it on our behalf).

Who we are

SmartScanit MTD is operated by SmartScanitGroup Ltd ("we", "us"), a company registered in England & Wales, registered office 66 Paul Street, London, EC2A 4NA. We are the data controller for the personal data described on this page, and we are registered with the Information Commissioner's Office (ICO registration ZC189364). Contact: automation@smartscanitgroup.co.uk, 07427 408650.

What data we process, and why

Identity and tax data — your name, National Insurance number, Unique Taxpayer Reference, business details, and the income and expense figures you provide. Purpose: preparing and letting you submit your own MTD quarterly updates, tax calculations and final declaration. Lawful basis: performance of a contract with you, and your legal obligations to HMRC.
HMRC connection tokens — when you connect with your Government Gateway login, HMRC gives this software a temporary access token (valid about 4 hours) and a refresh token. We never see or store your Government Gateway password. Lawful basis: performance of a contract.
Fraud prevention header data (legal requirement) — see the next section. Lawful basis: legal obligation (HMRC transaction-monitoring regulations).
Support records — emails or messages you send us when you ask for help. Lawful basis: legitimate interests (running a support service).

What this software sends to HMRC

Every time you use a step on this site, the software sends to HMRC:

The figures you have reviewed — turnover, expenses and adjustments for your quarterly updates; and your confirmation when you submit your final declaration.
Fraud prevention headers — technical information that all Making Tax Digital software is legally required to attach to every request under HMRC's transaction-monitoring rules. This includes things like: your device's public IP address, browser and screen details, time zone, a device identifier stored in your browser, and your username on this portal. HMRC uses this to protect taxpayers against fraud and account takeover. We cannot switch this off — software that does not send these headers is not permitted to connect to HMRC.

You can read HMRC's own explanation of these rules on the HMRC Developer Hub ("fraud prevention" guidance) and HMRC's privacy notice on GOV.UK.

Where your data lives

The website and its functions are hosted on Netlify, which runs the functions on cloud infrastructure located in the United States. Your figures and connection tokens pass through these functions to HMRC; they are not stored in a database.
Because this processing takes place in the US, any transfer is made in reliance on the UK's "data bridge" with the US (the UK Extension to the EU–US Data Privacy Framework). All transfers are encrypted in transit.
We do not use any other processor to handle your tax data. If you email us for support, that message is handled by our email provider.

How long we keep it

Access tokens expire after about 4 hours. A refresh token, if held, is kept only until you disconnect the software from your HMRC account, so you do not have to reconnect on every visit.
Records of what was submitted (dates, references and the figures you approved) are kept for up to 6 years, in line with HMRC's record-keeping expectations, then deleted.
Support correspondence is kept for up to 2 years and then deleted.

Your rights

Under UK GDPR you can ask us for a copy of your data, ask us to correct it, ask us to delete what we hold (note: we cannot delete what has already been legally submitted to HMRC), object to or restrict processing, and take your data elsewhere. To use any of these rights, email automation@smartscanitgroup.co.uk. You can also disconnect this software from your HMRC account at any time via your Government Gateway "manage authorised software" settings. If you're unhappy with how we handle your data you can complain to the Information Commissioner's Office (ico.org.uk).

This page is part of SmartScanit MTD's compliance with the HMRC Developer Hub Terms of Use: transparency about what the software sends, user access to data, and a named support contact. See also Support.