Privacy policy
This policy explains what personal data MTD Gateway collects when you use this service, why we collect it, how long we keep it, and what you can ask us to do with it.
Geater Ltd, a company registered in England and Wales (company number 10751550), trading as MTD Gateway, is the data controller for the information described here. We are not part of HM Government or HMRC.
What we collect about you
Account information
When you create an account we store your username, a hashed version of your password, your account type (individual or agent), and the date you last signed in. If you sign up as an agent we also store your agent reference number (ARN). We never store your password in a form we can read.
Bookkeeping records
We store the records you enter or import: your businesses, their accounting periods, your income and expense transactions, the categories you assign, any notes you add, and any documents you upload as evidence. We also store the quarterly updates and other submissions you send to HMRC through this service, and what HMRC replied.
Tax identifiers and your HMRC connection
To send anything to HMRC we need your National Insurance number and the business identifiers HMRC holds for you. When you connect to HMRC we receive an access token and a refresh token that let this service act for you. Those tokens are encrypted before they are stored. You can disconnect from HMRC at any time in Settings, which stops us using them.
If you use this service as an agent, we store the same kind of information about each client you add: their name, National Insurance number, postcode, and the state of their authorisation with HMRC.
Fraud prevention data we send to HMRC
HMRC legally requires every piece of Making Tax Digital software to send information about the device and connection used to make a submission. This is set out in HMRC's terms of use for the Making Tax Digital APIs, and it applies to all recognised software, not only to us. HMRC uses it to detect fraudulent filings made in someone else's name.
We collect the following from your browser and send it to HMRC with every request we make on your behalf:
- a device identifier we generate the first time you use the service, and keep in your browser's local storage so the same browser reports the same identifier next time
- your time zone, as an offset from UTC
- your screen width, height, scaling factor and colour depth, and the width and height of the browser window
- the names of the browser plugins installed in your browser
- your browser's user agent string, which identifies the browser and operating system
- whether you have turned on your browser's "do not track" setting
- the public IP address and port your connection reaches us from, and the time we observed it
- the private IP addresses your device holds on your local network, which we ask the browser for using WebRTC. Many browsers hide these, and when they do we send nothing
We also send information about our own software: its name, version, licence identifier and the public IP address of our server.
We do not use any of this for advertising, profiling or analytics. We do not sell it or share it with anyone other than HMRC. It is collected only when you are signed in and only for requests that go to HMRC.
Cookies and browser storage
This service sets no cookies and uses no advertising or analytics trackers. It does store a small amount of data in your browser's local storage, all of it strictly necessary for the service to work:
- your sign-in token and your username, so you stay signed in between pages
- which business, and for agents which client, you are currently working on
- the fraud prevention device identifier described above
Because all of it is strictly necessary, we do not ask for consent to store it. Signing out clears your token and username. Clearing your browser storage removes the rest, including the device identifier, which we will then generate again.
Why we are allowed to use your data
We process your account and bookkeeping data to perform our contract with you, which is to provide this service. We process your tax identifiers and the fraud prevention data to comply with a legal obligation, because HMRC requires it of Making Tax Digital software. We keep a limited record of submissions for our legitimate interest in being able to show what was sent, when, and by whom, if a filing is later disputed.
Where your data is stored
Your records are held in a managed MySQL database on Amazon Web Services (AWS RDS), and documents you upload are held on our application server. Both are in the United Kingdom or the European Economic Area. Data is encrypted in transit, and access tokens are encrypted at rest.
Who else sees your data
- HMRC, when you send a submission or we read your obligations, business details or calculations on your behalf
- Amazon Web Services, as our hosting and database provider
- SendGrid, which sends our service emails, such as password reset messages. SendGrid receives your email address and the content of the message only
We do not sell your data and we do not share it with anyone else unless we are required to by law.
How long we keep it
We keep your bookkeeping records and submission history for as long as your account is open, and for six years after the end of the tax year they relate to. That matches the period HMRC expects you to be able to produce your records for.
If you close your account, we delete your account details and any data we are not required to retain within 30 days. Where we must keep submission records for the six-year period, we keep only what is needed to show what was filed.
Your rights
You can ask us to:
- give you a copy of the personal data we hold about you
- export your businesses, transactions, submissions and attachments in a usable format
- correct anything that is wrong
- delete your account and your data, subject to the retention period above
- restrict or object to how we use your data
Email support@mtdgateway.co.uk with the request and the username on your account. We respond within one month.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk.
Changes to this policy
If we change what we collect or why, we will update this page and change the date below.
Last updated: 25 July 2026