dough

Privacy Policy

1. Introduction

This Privacy Policy explains how DOUGH TAX LTD ("we," "us," "our," or "dough") collects, uses, and protects your personal data when you use our mobile app and website (the "Service").

We take your privacy seriously and are committed to being transparent about how we handle your information. This Privacy Policy applies to all users of dough in the United Kingdom.

Registered company details:

  • Legal entity: DOUGH TAX LTD
  • Company number: 17306534
  • Registered address: 20 Wenlock Road, London, England, N1 7GU
  • ICO registration number: ZC185129

Data Protection Officer / Privacy contact:

  • Data Protection Officer: not appointed — we are not a public authority and our core activities do not require one under UK GDPR Article 37. Privacy enquiries go to the address below.
  • Email: privacy@dough.tax

2. What Personal Data We Collect

We collect the following personal data from you:

Account Information

  • Email address
  • Full name
  • Password (hashed and encrypted; we cannot access it)

Financial and Business Data

  • Invoices (client names, amounts, dates, descriptions)
  • Expenses (category, amount, date, description)
  • Income records
  • Mileage records
  • Receipt images (photos you upload)
  • VAT returns and CIS (Construction Industry Scheme) data
  • Tax estimates and calculations

AI Chat Interactions

  • Messages you send to our AI chat assistant, whether typed or spoken via Voice Mode
  • Questions, prompts, and the assistant's responses

Voice Mode

  • Microphone access: If you use Voice Mode, we access your device's microphone so you can speak to the assistant instead of typing.
  • On-device speech-to-text: Your speech is recognised on your device, using its built-in on-device speech recognition. The audio is never transmitted off your device — not to dough, and not to any cloud speech-recognition service — and is discarded once it has been converted to text. Only the resulting text (and the assistant's reply) is sent to dough, exactly the same as a typed message. If your device cannot recognise speech on-device, Voice Mode shows an error and stops rather than sending your audio elsewhere.

Bank and Transaction Data

  • Bank account information you connect via TrueLayer Open Banking
  • Transaction history (only with your explicit consent)

Technical Data

  • Push notification tokens (to send you reminders and alerts)
  • Crash and diagnostic reports (error logs, device type, app version)
  • IP address and device identifiers (for security and troubleshooting)

Data You Choose to Share

  • Information you provide in customer support requests or feedback

3. How We Use Your Data

We use your personal data for these purposes:

  1. To provide the Service: Creating and managing your account, storing your financial records, generating invoices, calculating tax estimates, and delivering the tax and bookkeeping features.
  1. AI Chat Assistant: Your messages — typed, or spoken and converted to text on your device via Voice Mode (the audio never leaves your device) — are sent to Amazon Bedrock (AWS's AI service) to generate responses. These messages are processed to answer your tax and bookkeeping questions. We keep the text of your conversations for up to 90 days for service operation, debugging and quality review, then delete it automatically (see "How Long We Keep Your Data" below); it is never used to train or improve any AI model.
  1. Tax and Legal Compliance: Processing your financial data to help you meet UK tax obligations, including Self Assessment and Making Tax Digital (MTD) requirements. We may retain some records to comply with HMRC and UK law.
  1. Service Improvement: Analysing crash reports and diagnostic data to fix bugs, improve stability, and enhance the app.
  1. Notifications: Sending you push notifications about tax deadlines, reminders, and service updates (you can disable these in app settings).
  1. Customer Support: Responding to your questions and providing technical support.
  1. Security and Fraud Prevention: Protecting your account and detecting misuse.

4. Legal Basis for Processing

We process your personal data on these legal grounds (under the UK GDPR):

  • Contract: To provide the Service under our terms with you.
  • Legal obligation: To comply with UK tax law, company law, and HMRC requirements.
  • Legitimate interest: To improve the Service, prevent fraud, and ensure security.
  • Consent: For specific uses (e.g., Open Banking; you opt in via TrueLayer).

5. Who We Share Your Data With

We share your personal data only as necessary with:

Third-Party Service Providers (Sub-Processors)

  • Amazon Web Services (AWS): Hosts the app and our servers in the EU (eu-west-2, London). Your data is stored on AWS infrastructure. AWS also powers our AI assistant via Amazon Bedrock. AWS is certified under the Standard Contractual Clauses for data transfers.
  • Sentry: Receives crash and error diagnostic reports to help us fix bugs. Sentry's privacy policy is available at https://sentry.io/privacy/.
  • Stripe: Processes subscription payments. Stripe handles payment card data directly; dough does not store card details. See Stripe's privacy policy at https://stripe.com/privacy.
  • TrueLayer: Provides Open Banking connectivity to your bank account. TrueLayer processes your bank credentials and transaction data with your explicit consent. See TrueLayer's privacy policy at https://www.truelayer.com/privacy.
  • Apple and Google: Receive push notification tokens to deliver reminders and alerts. They do not receive your financial or personal data beyond the token.

Legal Requirements

We may disclose your data to law enforcement or government agencies if required by UK law (e.g., court order, HMRC investigation, or to prevent fraud).

No Selling or Advertising

dough does not sell, rent, or trade your personal data. We do not use advertising or analytics tracking SDKs. We do not track you across other apps or websites.

6. International Data Transfers

Your data is primarily stored and processed in the UK and the EU (AWS, eu-west-2). Where data is transferred outside the UK, we ensure it is protected under the UK GDPR via Standard Contractual Clauses or other lawful mechanisms.

7. How Long We Keep Your Data

While your account is active:

  • We keep your account details, financial records, and files for as long as you use dough.

After you delete your account:

  • Your account, personal data, and files are deleted within 30 days.
  • Exception: Some financial records may be retained to meet UK tax obligations (e.g., HMRC Self Assessment, VAT, or CIS records). These are retained for the period required by UK law (typically up to 6 years after the end of the tax year to which they relate) and are not associated with your deleted account.

Crash and diagnostic data: Retained for up to 90 days.

AI chat and Voice Mode conversation transcripts: The text of your conversations with the AI assistant is retained for up to 90 days for service operation, debugging and quality review, then automatically deleted. Voice Mode audio is recognised on your device, is never transmitted off it, and is discarded after transcription — so it is never received or stored by dough at all; see "Voice Mode" above.

8. Your Rights

Under the UK GDPR and Data Protection Act 2018, you have the right to:

  • Access: Request a copy of your personal data (via in-app data export or by emailing us).
  • Rectification: Correct inaccurate data.
  • Erasure: Request deletion of your data, including AI chat and Voice Mode conversation transcripts (delete your account in-app or contact us; subject to legal retention obligations).
  • Portability: Receive your data in a portable format (in-app export available; or contact us).
  • Restrict processing: Ask us to limit how we use your data.
  • Object: Opt out of certain processing (e.g., marketing emails).
  • Withdraw consent: For optional processing (e.g., Open Banking), you can withdraw consent at any time.

To exercise these rights:

  1. Use the in-app Account Settings → Data & Privacy to export or delete your account.
  2. Email us at privacy@dough.tax with your request, and we will respond within 30 days.

9. Data Security

We take data security seriously:

  • Your password is hashed and encrypted; we cannot see it.
  • Bank access tokens (from TrueLayer) are encrypted at rest and in transit.
  • All data in transit is encrypted using SSL/TLS (HTTPS).
  • We use AWS security best practices, including encryption, firewalls, and access controls.
  • Our team undergoes data protection training.

However, no system is 100% secure. If you believe your data has been compromised, contact us immediately at privacy@dough.tax.

10. Age Restrictions

dough is not intended for users under 18 years old. We do not knowingly collect data from children. If we become aware that a child has created an account, we will delete it immediately.

11. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

  • Website: https://ico.org.uk
  • Phone: 0303 123 1113
  • Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

  • Posting the updated policy in the app and on our website
  • Updating the "last modified" date below
  • Sending you an email notification if the change is significant

Your continued use of dough after changes constitutes your acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact:

  • Email: privacy@dough.tax
  • Mailing address: 20 Wenlock Road, London, England, N1 7GU

Last modified: 24 September 2026

Back to dough.tax