PactTax logoPactTaxBack to home

Privacy Policy

Last updated: October 2026

Who we are

PactTax Ltd ("PactTax", "we", "us") provides accounting and tax software for UK sole traders, landlords and limited companies. This policy explains how we handle your personal data when you use our website and mobile app.

Data we collect

We may collect:

  • Account details (name, email address)
  • Tax identifiers such as National Insurance number and UTR
  • Bank transaction data via open banking (read-only)
  • Usage data and device information for security and support

How we use your data

We use your data to provide the service, classify transactions, prepare quarterly submissions to HMRC, process subscriptions, and comply with legal obligations. We do not sell your personal data.

Where processing happens

Your data is stored and processed in London. Two things run outside the UK. The AI features (reading a receipt, suggesting a category, the assistant) use Amazon Bedrock on its EU inference profile, so that processing stays in the EU. And a business that joins the Peppol network sends and receives e-invoices through Storecove, which processes them in the EU. A business's owner can choose UK only in Settings, Security: both are then off for that business.

Sub-processors we rely on, and where they work:

  • Amazon Web Services: Hosting the app and API, the database (Aurora PostgreSQL), files, sign-in (Cognito), email (SES), queues and logs. UK: London (eu-west-2).
  • Amazon Bedrock (Amazon Web Services): AI: reading receipts, suggesting categories, the assistant and the unusual spending scan. EU: called from Ireland on the EU inference profile, which runs only in EU regions. Off for a business that chooses UK only.
  • Amazon Bedrock AgentCore (Amazon Web Services): The assistant: running it, its calculations and its reading of GOV.UK; keeping each person's conversation for 30 days and what it learns from them; scoring a sample of its answers. UK: London (eu-west-2); its memory and scoring models run within the EU. Off for a business that chooses UK only.
  • Storecove: E-invoicing: carrying the e-invoices a business sends and receives over the Peppol network, and listing it in Peppol's directory. EU. Only for a business that has joined Peppol; off for a business that chooses UK only.
  • Stripe: Subscriptions, and card payments of your invoices. As described in Stripe's terms.
  • TrueLayer: Read-only bank connections. UK.

Not sub-processors, but they see your data:

  • Xero, QuickBooks Online and FreeAgent: Only when you connect one to move your books to PactTax: PactTax reads from it. Your provider's own terms.
  • HMRC and Companies House: The returns and accounts you file, which they receive in law. UK.

Security & retention

Sensitive fields are encrypted at rest. Bank access is read-only. We retain data only as long as needed to provide the service and meet regulatory requirements.

PAM, our AI assistant

PAM ("Ask PAM" in the app) is an AI assistant. This is how it works with your data.

What PAM can see

Only what you can see. When you ask a question, PactTax gives PAM a short-lived permission, signed by our database, for that business and for the parts of the books your role lets you see. Our database checks that permission on every read, so PAM cannot read another business, or anything your role does not show you, even if it were asked to. It never sees bank account numbers, National Insurance numbers, dates of birth, home addresses or email addresses. It opens a receipt or invoice only through a link that lasts five minutes.

What PAM can do

PAM never changes anything by itself. It can prepare a draft invoice or bill, categories for your transactions, a payment reminder, or a return to file. Nothing happens unless you approve it. A return is only sent to HMRC from PactTax's confirmation page, after you check the figures and confirm HMRC's declaration yourself.

Where your data goes

  • PAM runs on Amazon Bedrock AgentCore, in London. The AI model (Amazon Nova) is called through Amazon Bedrock's EU inference profile, so that step runs in the EU. Amazon does not use your data to train its models.
  • Calculations run in a sealed sandbox, with no internet access.
  • PAM looks things up on GOV.UK, legislation.gov.uk and Companies House only. It never puts your details into a search.

What PAM remembers

Your conversations are kept for 30 days. From them PAM learns how you like answers and what you tell it about your business, separately for each business. It never remembers figures; it reads them afresh. You can see, correct or delete what it remembers from Memory in PAM's panel. It is deleted when you leave the business or your account is erased, and someone who no longer has access to a business gets nothing of it.

How we check PAM's quality

Before every release, PAM must pass a fixed set of UK tax questions, must send complex questions to an adviser, and must refuse instructions hidden in receipts, invoices and web pages. Once it is live, an automated evaluation (Amazon Bedrock AgentCore Evaluations) scores about one conversation in ten. It reads the question and the answer from our service logs in London; its scoring models run in the EU. Our headline measure is faithfulness: the share of scored answers that agree with what PAM actually read from your books and from GOV.UK.

Your choices

A business's owner can turn the AI features off, or choose UK only in Settings, Security: PAM is then off for that business. Each answer has a button to tell us it was wrong; that sends us the question, the answer and your note. PactTax is not endorsed by HMRC.

Your rights

Under UK GDPR you may request access, correction, deletion, or portability of your data. Contact pacttax@rinegansolutions.com to exercise these rights.

This is a placeholder policy for the PactTax prototype. A full legal review will be completed before public launch.