Privacy notice

1. Who is responsible for your information?

Legal name

Iter Automation Consulting LTD

Address

75 Avondale Road, CR2 6JF, United Kingdom

Contact

support@vatrail.uk

Registration number

17541073

Registered in

England and Wales

VatRail is the trading name of Iter Automation Consulting Ltd. Email support@vatrail.uk for privacy requests, support or complaints. The app's feedback form is intended to send reports to this inbox; delivery through the app is still being verified.

When we use information to run accounts, manage billing, protect the service or answer support requests, the company decides why and how that information is used. When an accounting firm or its client asks us to process accounting records for a VAT workflow, that customer will generally decide why those records are used and we will process them on its instructions. The final data-processing agreement will set out the parties' responsibilities.

2. What information do we use and where does it come from?

We use information that you or your organisation provide, information retrieved from an accounting or HMRC connection you authorise, and technical information created when you use the service. Depending on the features used, this can include:

• names, business email addresses, password hashes, workspace roles and account security records;
• organisation and VAT details, accounting transactions, invoice references, supplier or customer details, VAT calculations, return history and submission evidence;
• accounting connection identifiers, encrypted access credentials, sync status and related audit events;
• support messages, feedback, billing status and service notifications; and
• limited financial or evidence details and resulting suggestions when an authorised user requests AI-assisted review.

Imported descriptions or documents may contain personal information about your customers, suppliers or staff. Do not import information you do not need for the VAT task. Special-category information is not requested; if it appears incidentally in an imported record, the organisation that supplied it must assess whether it should be removed.

Some account and organisation details are needed to create a workspace, and accounting data is needed for the VAT features that use it. If required details or access are not provided, the related account or feature may not work.

3. Why do we use it?

• Provide VatRail: create accounts and workspaces, connect authorised accounting services, import and organise records, prepare VAT working papers, support exports and provide requested features.
• Protect and operate the service: authenticate users, prevent abuse, investigate security issues, keep audit evidence and troubleshoot faults.
• Communicate: send verification, password-reset, invitation, service and support messages, and respond to requests.
• Manage billing: administer a paid plan and related invoices if paid subscriptions are enabled.
• AI-assisted review: return suggestions when a user requests an AI review. AI does not perform VAT arithmetic or submit a return by itself; a person must review and approve any action.
• Meet legal obligations: retain or disclose information where the law requires it.

For account administration and requested service features where we act as controller, the expected lawful basis is performance of a contract or steps requested before entering one. For security and service operation, the expected basis is legitimate interests, subject to the documented assessment. Legal record-keeping uses the applicable legal obligation. For accounting records processed on a customer's behalf, that customer decides and documents the lawful basis and gives us instructions under the data-processing agreement.

We do not make decisions about an individual that have legal or similarly significant effects solely by automated processing. AI output is advisory and requires human review.

4. Who may receive information?

We share only the information needed for the feature or purpose. The project records the following services as used or planned; the live accounts, contracts and exact data flows still need verification before this list can be treated as final:

• AWS Lightsail and Cloudflare: hosting, network delivery and protection, subject to confirmation of the active hosts and settings.
• Neon: managed database hosting. The project documentation identifies a London database, but the production connection and backup settings have not been confirmed.
• Microsoft 365: support mailbox for messages sent to VatRail Support. The tenant's Data Location card reports the United Kingdom as the committed geography for certain Microsoft 365 Core Online Services customer data at rest; this does not cover every Microsoft service or support access.
• Resend: application email delivery, including authentication and feedback paths, if configured for production. Resend Support confirmed on 10 November 2026 that its pre-signed GDPR Article 28 DPA applies to the VATrail Resend account from signup. Resend says the account itself is the customer and does not identify a company in that agreement. Whether Resend is configured for live delivery, and its applicable processing locations, retention and transfer safeguards, remain under verification.
• Anthropic or another configured AI service: limited data needed for an AI review requested by a user. The active provider and account settings must be confirmed.
• Stripe: subscription and payment administration if paid billing is enabled.
• Upstash: queue or cache service only if configured for the live service; production use has not been confirmed.

If you authorise an accounting connection, VatRail exchanges information with that accounting provider to provide the connection. The initial HMRC integration is documented as sandbox-only. These services are not automatically our subprocessors; their role depends on the particular data flow.

5. AI-assisted review

When a user requests an AI review, the feature may send limited transaction or evidence details to the AI provider configured for the service and receive suggestions in return. The software performs the VAT calculations. AI suggestions may be incomplete or wrong and are not tax advice. They do not alter source accounting records or submit a VAT return without the product's required human approval.

An AI review is processed only on the customer's instruction under an accepted data-processing agreement. In production, the model gateway blocks AI processing while the legal/provider approval flag is false. We will not enable it for customer data until the active provider, data-use and retention settings, applicable contract, and any required transfer safeguards are confirmed. The code's default provider is not proof of the live configuration.

6. Where is information processed?

The documented hosting plan uses AWS in London, and project records identify a London Neon database. These records do not prove the locations used by the live service, backups or all vendors. The Microsoft 365 Admin Center Data Location card states: “Microsoft stores certain Customer Data for Microsoft 365 Core Online Services at rest in United Kingdom — your Committed Geography.” That commitment is limited to the specified Microsoft 365 Core Online Services data at rest; it does not establish other Microsoft processing or support-access locations. Some named providers may process information outside the UK. Before customer onboarding, we will verify the active providers and locations, identify any restricted transfers, and put in place the required safeguards. The final provider and transfer schedule is not yet complete.

7. How long do we keep information?

Our target schedule is: account and workspace administration for up to 12 months after closure; support messages for up to 24 months after resolution unless needed for an open complaint, security incident or legal claim; security and operational logs for up to 12 months; and billing records for the period required by law. Customer VAT data, including AI prompts and findings attached to VAT work, is available while the workspace is active. On closure, the target is to return or delete processor-held copies within 90 days, subject to documented legal holds. Customers remain responsible for their own VAT records; HMRC generally requires them to keep VAT records for at least 6 years, or 10 years for OSS/MOSS records. Our proposed backup expiry is 35 days.

These are target periods, not verified production deletion timers. The current account-deletion code revokes sessions and invitations, removes connected-account credentials, deletes feedback records for the workspace, and anonymises the user and organisation. It retains VAT transactions, returns, submissions and an audit record. Timed deletion for those retained records, provider copies and backups is not yet verified, so do not rely on the target timetable as an implemented guarantee.

Export records you need before closing an account and keep your own statutory VAT records independently. We will update this notice when the deletion and backup timetable is implemented and verified.

8. Your rights and how to contact us

Depending on the circumstances and the lawful basis, you may ask for access to your personal information, correction, deletion, restriction or a copy in a portable format. You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it. Rights can be limited in some circumstances, including where information must be kept by law.

Email support@vatrail.uk. We respond without undue delay and normally within one calendar month. If a request is complex or we receive several requests, the law may allow up to two extra months; we will tell you within the first month and explain why. If the information is held for an accounting customer, we may refer your request to that organisation and assist it as required by our agreement. You can complain to the Information Commissioner's Office.

9. Security and changes

We use technical and organisational safeguards intended to protect information, including access controls, encrypted connection credentials, tenant separation and protected connections. These describe safeguards in the product design; the live production configuration still needs verification. No online service can guarantee absolute security.

We will update this notice when our use of information, providers, AI features or retention practices materially change. The current page remains a review draft until the provider, transfer, lawful-basis and retention details above are confirmed.