Privacy Policy for Invisible Accountant

Last Updated: 29 August 2026

1. Introduction

Welcome to Invisible Accountant. We are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our WhatsApp-based Making Tax Digital for Income Tax Self Assessment (MTD for ITSA) application.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Invisible Accountant acts as the Data Controller for the personal data we hold about you on our servers. Once your data is transmitted to HM Revenue & Customs (HMRC), HMRC acts as an independent Data Controller.

2. The Data We Collect

We collect and process the following data to provide our MTD for ITSA services:

Contact Information: Your mobile phone number (used for WhatsApp communication).
Tax and Identity Information: Your National Insurance Number (NINO), Unique Taxpayer Reference (UTR), and business details required by HMRC.
HMRC OAuth Tokens: Authentication tokens allowing us to securely submit data to HMRC on your behalf.
Financial Records: Images of receipts, invoices, and other income/expense data you submit via WhatsApp.

2.1 HMRC Fraud Prevention Headers (Mandatory Telemetry)

Under the Delivery of Tax Information through Software Regulations 2019, HMRC legally mandates that all third-party software collects specific device and network telemetry to detect and prevent tax fraud. Because you interact with our service via WhatsApp, we cannot collect your physical device telemetry. Instead, we act as an intermediary server. To comply with HMRC’s Fraud Prevention rules, we cryptographically hash your WhatsApp phone number to generate a secure, anonymous Gov-Client-Device-ID, which is transmitted to HMRC along with our server's IP addresses and timezone during every tax submission. This data sharing is mandatory to use the service.

3. How We Use Your Data

We process your personal data for the following purposes:

To authenticate your identity and link your account with HMRC via OAuth 2.0.
To record, categorise, and manage your income and expenses.
To submit your quarterly updates and End of Period Statements to HMRC.

4. How We Secure Your Data

Encryption at Rest: Your HMRC OAuth tokens and highly sensitive identifiers are encrypted in our database using military-grade AES-GCM encryption.
Data Transit: All data transmitted between our servers, WhatsApp, and HMRC is encrypted using strict TLS protocols.

5. OAuth Consent & Revocation

By linking your account, you grant Invisible Accountant the "Authority to Interact with HMRC on your behalf." You can revoke this OAuth consent at any time directly through your personal HMRC Government Gateway account online.

6. Contact Us

To exercise your GDPR rights, contact our Data Protection Officer at: [email protected]