Privacy Policy
Last updated: 28 October 2026
Who we are
Headroom Tax (headroomtax.com) is operated by HOOMA LTD, a company registered in England and Wales, company number 17148060. Registered office: 167-169 Great Portland Street, Fifth Floor, London, England, W1W 5PF. HOOMA LTD is the data controller for the personal data described in this policy.
Contact: hello@hooma.studio
What this policy covers
This policy explains what personal data we collect when you use headroomtax.com, why we collect it, how long we keep it and what your rights are. It applies to the website, the early access form, the quiz and the tool at headroomtax.com/app.
What the quiz sends and what stays in your browser
The quiz works out your result in your browser. Your answers are stored in your browser's session storage so that a page refresh does not lose them. When you close the browser tab, they are gone. The result is produced automatically from your answers. It is general information and has no legal or similar effect on you.
As you go through the quiz, your browser sends us usage events: which question you answered and which option you chose, which result you saw and which buttons you pressed. For the question about where you are moving, the event includes the country. Each event carries a random number that exists only while the page is open. It is not stored on your device, and reloading the page creates a new one. The events do not contain your name, your email address, your company number or anything you type, and we do not link them to your email address. If your browser sends a Global Privacy Control or Do Not Track signal, no usage events are sent.
If you write an answer to the open question, it is sent to us on its own and stored without your email address or any other identifier.
If you ask for your result by email, your browser sends us the result that was shown to you, so that we can write the email. We use it to send that one email and keep only your situation type.
If you enter a company number, your browser asks our server to look the company up on the public Companies House register. We pass the number to Companies House and return the public filing dates to your browser. We do not keep a record of which company numbers were looked up.
The tool: what you give it and what we keep
The tool at headroomtax.com/app is for people who sign in. It keeps what you put into it so that you can come back to it: your account, your companies, the sources you connect and their transactions.
Signing in. You sign in with a link we send to your email address, or with Google. For the link, we keep your email address and the link in a form that cannot be turned back into the link. The link works once, for 20 minutes. If you sign in with Google, the sign in window is Google's. Google tells us your email address, and also your name and picture, which we do not keep. We ask Google to delete its record of that sign in from our project as soon as the sign in is finished. We never see your Google password. Either way, your account with us is your email address.
Companies. When you add a UK company by its number, we read it from the public Companies House register and keep its name, number, status, incorporation date and filing dates, the names, roles and appointment dates of its directors, and the names of its people with significant control with what the register says they control. We do not keep their dates of birth, nationalities or addresses. For a US company we keep the name, state and company type you enter. You can edit the list of director names. We use it to recognise transfers between the directors and the company.
Shareholders, dividends, decisions and the director's loan account. If you enter them, we keep the names of the company's shareholders with their numbers of shares and share class; the dividends you record (date, the directors present, the country where the meeting was held, the amount and the payment date); other decisions you record (date, country, the directors present and your note); and entries in the director's loan account (costs you paid for the company and an opening balance, with a date, an amount and a short description). We do not keep shareholders' addresses: an address typed for a dividend voucher is used on the page to print it and is never sent to us. The minutes and vouchers are made in your browser.
Bank statements. The file you choose is read in your browser and is not uploaded. Your browser sends us the rows: the date, the amount, the currency, the description and, where the file has them, the payee or payer, the reference and the type. These rows can contain the names of people and businesses the company paid or was paid by.
Stripe. You give us a restricted key with read access to your balance. We refuse full secret keys. With the key we read your balance transactions: amounts, fees, types, dates and the description Stripe holds for each one. We do not ask Stripe for your customers or their cards. A description can still contain text that you or your checkout put there.
App Store Connect. You give us an API key and your vendor number. With them we read Apple's monthly financial reports and daily sales summaries: proceeds and prices by app, country and currency. These reports do not name your customers.
Keys. The keys you give us are stored encrypted. Only our server uses them, only to read the data described here, and they are never sent back to your browser.
Categories. The tool sorts transactions into categories with a fixed list of rules, and keeps the corrections you make. If you press the button for suggested categories, our server sends the transactions that are still not sorted to Anthropic, a language model provider. For each one it sends the description with email addresses and long numbers removed, whether it is money in or money out, and a rounded amount. The description can still contain the name of a person or a business. Nothing is sent unless you press the button.
Exchange rates. To convert other currencies we ask a public exchange rate service for monthly rates. The request contains currency codes and dates only.
Sharing with your accountant. If you invite someone to a company, we email them a link and keep their email address with the invitation until it is used or expires 14 days later. When they use it, they get an account with that email address and can read the company's figures, transactions and brief and download them. They cannot change anything. You can see who has access and remove it at any time in the company's settings.
Reminders. If reminders are on for a company, we email you 30 days and 7 days before each of its filing dates, and keep a record of which reminders were sent so that each goes once. Before sending, we read the company again from Companies House. Each person turns reminders on or off for themselves on the Deadlines page.
A log of actions. We keep a log of actions in a company, such as a source being added or a statement being imported, with counts and without the contents of transactions.
Analytics in the tool. If you allow it, the tool uses Google Analytics to count which screens are used. We tell it the screen without your company's id, and never the contents of the tool. If you do not allow it, or your browser sends a Global Privacy Control or Do Not Track signal, Google Analytics is not loaded. You can change your answer at any time with Cookie settings at the bottom of the tool.
Deleting. You can remove a source, delete a company or delete your whole account in the tool. Each deletes what belongs to it straight away: keys, transactions, corrections and the log. Sign in links and sessions that have ended are removed within two days.
Judgments from Find Case Law
For a reference of tax cases, we use judgments and tribunal decisions published on Find Case Law, the service of The National Archives. We take them only from Find Case Law, as it publishes them. A judgment can contain personal data about the people in the case, such as their names, what they did and what the court found.
What we keep. We keep the text of each judgment we use in our database, with short summaries of it and quotes from it. We keep the names of the parties and the judges only to check that our summaries do not contain them.
How we describe people. Our summaries name the parties by their role, such as the appellant, the company, the director or HMRC, and not by name. We do not try to find out who an anonymised party is, and we do not link the people in a judgment with any other data we hold, including what we read from Companies House.
Who sees it. Nothing from a judgment is shown before a person at HOOMA LTD has checked it against the judgment, and then only to people signed in to the tool, with a link to the full judgment on Find Case Law. It is not open to search engines.
Language model. To make the summaries, our server sends the text of a judgment to Anthropic, a language model provider, which processes it for us as our processor.
Withdrawn judgments. Every day we check the judgments we hold against Find Case Law, starting with those checked longest ago. If a judgment has been withdrawn, we delete it and everything we made from it. If Find Case Law publishes a new version, we replace our copy, and our summary is checked again by a person before it is shown again.
What we collect
| Data | When | Why | Legal basis | How long |
|---|---|---|---|---|
| Email address | You submit the early access form, ask for your quiz result by email, or leave your email to hear about the full report, the beta, early access for accountancy firms, an introduction to a specialist, or cases we do not cover yet | To send you the result you asked for, or one message when the thing you asked about is ready | Consent | Up to 12 months after we send the message you asked for, and no longer than 24 months from when you gave it. You can ask us to delete it at any time |
| Situation type and the place where you left your email | You leave your email in the quiz | So the message we send matches your situation and your request | Consent | Same as your email address |
| The result shown to you | You ask for your quiz result by email | To write and send that email | Consent | Not kept by us once the email is sent. A copy of the email stays in our email provider's sending log for 30 days |
| Free text you type in the quiz | You type an answer in the open question | To understand what people want from the tool | Legitimate interest in improving the service | Up to 24 months, stored with your situation type and without your email address or other identifiers |
| Usage events | You use the quiz | To see which questions people stop at, which results they see and which buttons they press | Legitimate interest in improving the service | Kept for up to 24 months and not linked to your email address |
| Email address of your account in the tool | You sign in to the tool | To sign you in and keep your companies with your account | Contract: to provide the tool you asked to use | Until you delete your account |
| Company details, including the names of directors and people with significant control from the public register | You add a company to the tool | To show the company and to recognise transfers between the directors and the company | Contract, and for the names of other people our legitimate interest in showing you your own company's public record | Until you delete the company or your account |
| Transactions, your corrections and the keys of the sources you connect | You connect a source in the tool | To show you your company's figures | Contract, and for the names of other people in transactions our legitimate interest in showing you your own company's records | Until you remove the source, delete the company or delete your account |
| Judgments and decisions published on Find Case Law, which can contain the names of the people in a case and what the court found about them | We prepare our reference of tax cases | To show people signed in to the tool how courts and tribunals decided tax questions, with a link to the full judgment | Legitimate interest in providing information about published tax decisions | Until the judgment is withdrawn from Find Case Law or we stop using it. What we made from it is deleted with it |
| Which screens of the tool you open, with details of your browser and device and your approximate location | You allow analytics cookies in the tool | To see which screens of the tool are used | Consent | Up to 14 months at Google. You can withdraw your consent at any time with Cookie settings |
On the website and in the quiz we do not collect your name, your company's financial data or any payment details. The tool keeps the company data described above, because that is what it is for. Your individual quiz answers reach us only as the usage events described above and are never stored with your email address. When you ask for your result by email, the result itself is sent with your email address so that we can write the email, and afterwards we keep only your situation type. If we add a paid report, this policy will be updated before any payment is taken.
What we do not do
- We do not sell or share your email address with anyone.
- We do not send marketing. You will receive the message you asked for and nothing else unless you ask.
- We do not use advertising cookies or tracking pixels.
- We do not build a profile of you for advertising.
- We do not use what you put into the tool for anything other than showing it to you in the tool.
Cookies and similar technologies
The website and the quiz do not set cookies. The quiz uses your browser's session storage to keep your answers while the tab is open. This is needed for the quiz you asked to use to work, so we do not ask for consent for it. The random number used for usage events is held in the page's memory only and is not stored on your device.
The tool sets one cookie, called hr_session, when you sign in. It keeps you signed in for up to 30 days, cannot be read by scripts on the page and is removed when you sign out. It is needed for the tool you asked to use to work, so we do not ask for consent for it.
If you allow analytics in the tool, Google Analytics sets its own cookies, _ga and one whose name starts with _ga_, which last up to two years. Your answer to that question is kept in your browser's local storage, so that we do not ask again. If you say no, these cookies are not set.
When you sign in with Google, the sign in window belongs to Google, and Google uses its own cookies there under its own privacy policy.
Who processes data on our behalf
We use a small number of service providers to run the site:
- Vercel Inc. (United States) hosts the website and runs our server functions: the company number lookup, the saving of email addresses and open answers, the forwarding of usage events, and the server of the tool. Vercel processes standard server logs, including IP addresses, for security and operation of the service. It also tells our server which country a request comes from. We pass that country on with usage events, and not the IP address.
- Neon (Neon, LLC, a Databricks company, United States) hosts the database where we keep email addresses and answers to the open question, and the accounts, companies, encrypted keys and transactions of the tool.
- Resend (Plus Five Five, Inc., United States) sends the result email, the sign in link, invitations and filing date reminders.
- Amplitude, Inc. (United States) receives the usage events from our server and gives us reports on them. The events are stored in the United States.
- Google (Google LLC, United States, and its group companies) provides sign in with Google through Firebase Authentication and, if you allow it, Google Analytics in the tool.
- Anthropic, PBC (United States) receives the transaction descriptions described above when you ask for suggested categories, and returns a category for each one. It also receives the text of the published judgments we use, to make the summaries described above.
Each provider acts under a contract that limits what it can do with the data. Where a provider is outside the United Kingdom, the transfer is covered by the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, or otherwise by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as set out in each provider's data processing agreement.
Companies House is not a processor for us. It is a public register operated by the UK government, and the company number you enter is sent to it as a public lookup. Stripe and Apple are not processors for us either: you give us a key to read your own data from them. The exchange rate service receives no personal data.
Your rights
Under UK data protection law you can ask us to:
- tell you what personal data we hold about you;
- correct it;
- delete it;
- stop using it;
- object to our use of it where we rely on legitimate interests;
- give it to you in a portable format;
- withdraw your consent at any time, which does not affect anything done before you withdrew it.
To use any of these rights, email hello@hooma.studio. We will reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.
Children
Headroom Tax is for people who run or plan to run a company. It is not aimed at anyone under 18 and we do not knowingly collect data from them.
Changes to this policy
When we change this policy we will update the date at the top. If a change affects how we use data you have already given us, we will email you before it takes effect.