Privacy Policy
Last updated: 11 July 2026
Version: 1.4
1. About this policy
This Privacy Policy explains how EMBR Tax Ltd ("EMBR Tax", "we", "us", or "our") collects, uses, shares, and protects your personal data when you visit embrtax.com or use any of our services, including our salary calculator, family calculator, guides, and paid Pro subscription.
We are committed to protecting your privacy and handling your personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).
If you have any questions about this policy or how we handle your data, please contact us using the details in Section 13.
2. Who we are (the data controller)
The data controller responsible for your personal data is:
EMBR Tax Ltd
Registered in England & Wales — Company Number 17262680
Registered office: 128 City Road, London, EC1V 2NX, United Kingdom
ICO Registration: ZC181272
Email: embrtax@gmail.com
A "data controller" is the organisation that decides how and why your personal data is processed.
3. What personal data we collect
Depending on how you use the site, we may collect the following categories of personal data:
3.1 Information you give us directly
- Contact form submissions — your name, email address, and the content of your message.
- Account registration — your email address and password (passwords are stored as a one-way hash, we never see your actual password). If you sign up via Google, we receive your name, email, and Google account ID.
- Marketing preferences — whether you have opted in to receive marketing communications from us.
- Subscription and payment data (Pro tier — £7.99/month or £69/year) — billing name, billing address, and payment card details. We do not store your full card number — this is handled directly by our payment processor (Stripe). We receive only a tokenised reference, the card brand, and the last four digits.
- Calculator inputs — figures you enter into the salary and family calculators (e.g. income, pension contributions, family circumstances). Where you are signed in, these may be saved to your account to allow you to return to your figures later. Where you are not signed in, they are processed only in your browser session and not stored by us.
- Correspondence — any other information you choose to send us by email or through any of our forms.
3.2 Information we collect automatically
- Technical data — IP address, browser type and version, device type, operating system, time zone, and referring URL.
- Usage data — pages you visit, links you click, time spent on pages, and similar interaction data.
- Cookies and similar technologies — see our Cookie Policy for full details.
We only collect this automatic data through analytics or tracking technologies after you have given us consent via our cookie banner. Strictly necessary technical data (such as basic server logs for security and to deliver the website to you) is collected without consent under our legitimate interests basis (see Section 5).
3.3 Special category data
We do not intentionally collect special category data (such as data about health, religion, or political views). Please do not include such information in messages or calculator inputs. If we do receive special category data, we will delete it unless you have asked us to keep it for a specific purpose.
4. How we collect your data
We collect personal data through:
- Direct interactions — when you fill in a form, create an account, subscribe to Pro, or contact us by email.
- Automated technologies — cookies, server logs, and analytics tools (with consent where required).
- Third parties — for example, Google when you sign in using your Google account, and Stripe when you pay for a subscription.
5. Why we use your data and the lawful basis for doing so
Under UK GDPR we must have a lawful basis for processing your personal data. We rely on the following:
| Purpose | Personal data used | Lawful basis (UK GDPR Article 6) |
|---|---|---|
| To respond to enquiries you send via the contact form | Name, email, message content | Legitimate interests — responding to people who contact us |
| To create and operate your account | Email, hashed password, Google account ID (if applicable) | Performance of a contract — providing the account services you signed up for |
| To deliver the paid Pro subscription | Account details, billing data, payment token | Performance of a contract |
| To process payments and prevent fraud | Billing data, payment token, IP address | Performance of a contract and Legitimate interests (fraud prevention) |
| To save your calculator inputs against your account | Calculator data, account ID | Performance of a contract |
| To send you marketing emails about tax tips, product updates, and offers | Email, marketing preference | Consent — you ticked the marketing opt-in box at sign-up; you can withdraw at any time |
| To improve the site through analytics or session replay, if we enable these in future — we would only do this with your consent via the cookie banner. | IP address, device data, usage data, session recordings | Consent — via the cookie banner |
| To comply with legal obligations (tax records, fraud prevention, court orders) | Any of the above as required | Legal obligation |
| To defend or bring legal claims | Any of the above as required | Legitimate interests — protecting our legal position |
Where we rely on legitimate interests, we have carried out a balancing test to make sure our interests do not override your rights and freedoms. You have the right to object — see Section 9.
Where we rely on consent, you have the right to withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
6. Who we share your data with
We do not sell your personal data. We share it only with the following categories of recipients, and only where necessary:
| Recipient | What they do | Where they process data |
|---|---|---|
| HubSpot | CRM and marketing email platform | EU (Frankfurt — EU1 region); some metadata may transit via the US |
| Stripe | Payment processing for the Pro tier | UK, EU, US |
| Google Workspace and Google Sign-In — email hosting and account sign-in (Google Sign-In) and OAuth authentication | UK, EU, US | |
| Lovable | Website platform and hosting | EU, US |
| Tinybird | Website analytics (subject to consent) | EU |
| Cloudflare | Security, DDoS protection, bot management | Global edge network |
| Cookiebot (by Usercentrics) | Consent management platform | EU |
| Professional advisers | Lawyers, accountants, auditors, insurers — when necessary | UK, EU |
| Regulators and law enforcement | Where legally required (e.g. HMRC, ICO, court orders) | UK |
All of our processors are bound by written data processing agreements that require them to handle your data only on our instructions, keep it secure, and not use it for their own purposes.
7. International data transfers
Some of our processors are based outside the UK, primarily in the European Economic Area (EEA) and the United States. When we transfer your data outside the UK, we rely on one of the following safeguards required by UK GDPR:
- UK adequacy regulations — where the UK government has decided the destination country provides an adequate level of protection (this includes the EEA).
- UK International Data Transfer Agreement (IDTA) or EU Standard Contractual Clauses with the UK Addendum — for transfers to the US and other "third countries".
- UK extension to the EU-US Data Privacy Framework — where our US-based processors are self-certified under the framework.
You can request a copy of the safeguards in place for any specific transfer by emailing us at embrtax@gmail.com.
8. How long we keep your data
We keep personal data only for as long as we need it. Our standard retention periods are:
| Data type | Retention period | Reason |
|---|---|---|
| Contact form messages | 2 years from last contact | To respond to follow-ups |
| Account data (inactive accounts) | 3 years from last sign-in, then deleted | To allow you to return; reasonable inactivity threshold |
| Account data (active accounts) | For as long as your account is open | To deliver the service |
| Paid subscription and billing records | 6 years after the end of the relevant tax year | Required by HMRC under the Companies Act 2006 and Taxes Management Act 1970 |
| Marketing email opt-ins | Until you unsubscribe, then suppression list retained indefinitely | To honour your unsubscribe request |
| Cookie consent records | 12 months from when you gave consent (then we ask again) | ICO guidance |
| Server logs | 90 days | Security and troubleshooting |
| Analytics and session replay data (if enabled in future) | 14 months | Site improvement |
At the end of the retention period we securely delete or anonymise the data.
9. Your rights
Under UK GDPR you have the following rights in relation to your personal data:
- Right of access (Article 15) — to be told what personal data we hold about you and to receive a copy.
- Right to rectification (Article 16) — to ask us to correct inaccurate or incomplete data.
- Right to erasure / "right to be forgotten" (Article 17) — to ask us to delete your data in certain circumstances.
- Right to restriction (Article 18) — to ask us to limit how we use your data.
- Right to data portability (Article 20) — to receive your data in a structured, machine-readable format, or to have it transferred to another controller.
- Right to object (Article 21) — to object to processing based on legitimate interests, and to object to direct marketing at any time.
- Right to withdraw consent (Article 7(3)) — where we rely on consent, you can withdraw it at any time, including by clicking "unsubscribe" in any marketing email or by changing your preferences in the cookie banner via the "Cookie Settings" link in our footer.
- Rights related to automated decision-making (Article 22) — we do not currently make any decisions about you using solely automated means.
To exercise any of these rights, email us at embrtax@gmail.com. We will respond within one month. There is no charge for most requests, but we may charge a reasonable fee or refuse if a request is manifestly unfounded or excessive.
We may ask you to verify your identity before responding, to protect your data from being disclosed to the wrong person.
Right to complain to the ICO
If you are unhappy with how we have handled your data, please contact us first so we can try to resolve it. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk
10. How we keep your data secure
We use appropriate technical and organisational measures to protect your data, including:
- Encryption in transit — all traffic to embrtax.com uses HTTPS (TLS).
- Encryption at rest — account data and subscription records are stored in encrypted databases.
- Password security — passwords are hashed using industry-standard algorithms; we never see or store your plain-text password.
- Access controls — only authorised personnel have access to personal data, on a need-to-know basis.
- Vendor due diligence — we use established, security-vetted processors (Stripe, HubSpot, Google).
- Bot and abuse protection — provided by Cloudflare.
No method of transmission or storage is 100% secure. While we work hard to protect your data, we cannot guarantee absolute security. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify affected individuals.
11. Cookies
We use cookies and similar technologies on this site. For full details of which cookies we use, what they do, and how to manage your preferences, please see our Cookie Policy.
You can change your cookie preferences at any time by clicking "Cookie Settings" in the footer of any page on the site.
12. Children's data
Our services are intended for adults aged 18 or over. We do not knowingly collect data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.
13. How to contact us
For any questions about this policy, or to exercise any of your rights, please contact us:
EMBR Tax Ltd
Email: embrtax@gmail.com
Post: 128 City Road, London, EC1V 2NX, United Kingdom
14. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top will reflect the most recent change. Where changes are significant — for example, a new use of your data or a new processor — we will notify you by email or by a prominent notice on the site before the changes take effect.
Where you have given consent to a specific processing activity, we will not extend that consent to materially new purposes without asking again.
This policy is provided in plain English. If anything is unclear, please contact us — we are happy to explain.