Privacy Notice

1. Controller

South Media OÜ, Peterburi tee 22-12, 11411 Tallinn, Estonia, registry code 14439805. Privacy contact: [email protected].

We have assessed that Article 27 UK GDPR does not require us to appoint a UK representative: our processing of UK residents' data is occasional, does not include special category or criminal-offence data, and is unlikely to create a risk to your rights and freedoms. We will revisit this if that changes.

2. Website delivery and security

Cloudflare provides the site, security and server functions and necessarily processes connection and HTTP security data. We rely on legitimate interests in a secure and reliable service, and on steps requested by you where a function is expressly invoked.

3. CSV processing on your device

Airbnb and Booking.com files are read in your browser. The original file, raw rows, guest names, contact details, booking references, status text and original filename are not sent to Tax for Hosts. The server receives a minimised normalised ledger, generic source label, selected property labels, amounts and confirmed tax-scope inputs.

4. Optional draft in your browser

The UK calculator can keep a working draft in this browser so you can close the tab and come back. Nothing is written until you tick “Keep a draft in this browser” for that visit, or choose “Resume and keep saving” after restoring an earlier draft; the setting is off by default, off again on your next visit, and the choice itself is never stored. While it is on, the browser writes the anonymised normalised ledger and your scope answers for that tax year to this device’s local storage, one entry per tax year.

The draft contents are never sent to Tax for Hosts. Saving or resuming a draft does send the same kind of coarse, content-free event described in section 6 (jurisdiction, platform and tax year, nothing from the draft itself). Unticking the box deletes every stored draft on this device; the “Delete draft” control on a specific draft deletes only that tax year’s draft, so a draft for another tax year stays on the device until you delete it too or untick the box.

5. Preview and paid report fulfilment

When requested, Cloudflare Pages Functions validate and recompute the minimised ledger and return a no-store preview. Starting checkout creates a purchase record in Cloudflare D1 and stores the minimised report request in EU-region Cloudflare R2. After Stripe confirms payment by signed webhook, the server recomputes the report and stores the resulting PDF in R2 for entitlement-protected download. D1 stores purchase, price, report-version, payment-status and entitlement-hash fields; it does not store the original CSV or the clear download token.

Checkout-attempt and paid-report information is retained only while needed to complete and support the purchase, provide the download, meet accounting and tax duties, handle refunds or disputes, and establish or defend legal claims. You may ask about or request deletion of report data by emailing [email protected]; legal retention duties may limit deletion.

The UK report purchase is sold through Link using Stripe Managed Payments. Stripe/Link acts as merchant of record and processes the name, email, billing address, payment method, payment status, tax-location evidence, receipt and invoice information needed for checkout, fraud prevention, tax calculation, collection and remittance, transaction support and payment records. Tax for Hosts receives payment and Checkout identifiers and status, but does not receive full card details. Stripe/Link retains and handles its records under its own legal obligations and privacy terms.

6. Limited product analytics

Our Cloudflare Workers Analytics Engine dataset records bounded operational events such as jurisdiction, tax year, platform class, broad size buckets, a coarse acquisition category and success or error codes. It does not contain CSV contents, filenames, guest or booking data, property names, money amounts, free text, IP addresses, user IDs or session IDs. These events use no analytics cookie or browser identifier, are not evaluated when Global Privacy Control or Do Not Track is enabled, and Workers Analytics Engine currently retains them for three months with no export to a longer-lived store. Unknown header names are shared only after a separate visible choice and are filtered first.

Separately, Cloudflare’s HTTP edge analytics counts complete production page views, referrer-based visits and country aggregates directly from the request, without depending on browser JavaScript; the current plan retains this for seven days. Cloudflare Web Analytics, an optional beacon script for Core Web Vitals, may also load, with roughly six months’ retention in Cloudflare’s own product. Cookieless Plausible analytics and optional Google Ads measurement are described below. We do not use Google Analytics or session replay.

Cookieless analytics and optional advertising

Plausible Analytics (Plausible Insights OÜ, Estonia) measures page visits, acquisition sources and successful CSV imports, report previews, PDF deliveries, checkout starts and completed purchases. Events contain only their names, with no CSV content, guest details, tax amounts or report fields. Plausible processes page addresses, referrers, campaign parameters, browser and approximate location. It uses no analytics cookie or persistent browser identifier; IP and user-agent information are used briefly for a daily site-specific aggregate identifier, not retained as raw values. Plausible hosts analytics in the EU and runs automatically to help us understand aggregate site usage. You can turn it off in Privacy settings → Cookies and privacy. This preference is saved immediately until changed or browser storage is cleared, independently of advertising and chat consent. Earlier Analytics rejections remain honoured. We respect Global Privacy Control and Do Not Track.

A separate Advertising measurement choice enables the Google Ads tag on the hub and UK pages. This can set first-party _gcl_* cookies for up to 90 days and send ad-click attribution and conversion events to Google. Checkout Started is a diagnostic event; Purchase Completed requires the server to confirm fulfilment. A random measurement reference prevents duplicate purchase events within the same tab. It does not include the purchase or report ID. Advertising personalisation and enhanced conversions are disabled; no email, phone number or report value is sent.

Advertising measurement and chat rely on consent. These choices are saved on this device for six months. You can change or withdraw them through Privacy settings on every page; withdrawal reloads the page and may clear unsaved work. Necessary storage for choices, checkout access and any separately enabled local draft is distinct from analytics. Google may process measurement data outside the UK/EEA under applicable transfer safeguards. See Plausible’s data policy and Google’s measurement privacy information.

7. Contact and chat

Email is delivered through Proton and is retained only as needed to answer the request and meet legal or defence needs. Crisp IM SAS, France, loads only after Chat consent and a click on “Chat with us”; the site sets the chat locale to English. Crisp then processes the connection, session and message data needed to deliver chat. Do not send CSV files, guest data or tax documents.

The shared Crisp workspace behind this chat has Total Privacy Mode enabled, Domain Lock covering taxforhosts.com and its subdomains, and a Data Processing Agreement signed by South Media OÜ on file. We review closed conversations and delete routine chat history within twelve months of closure unless a legal retention duty applies. See Crisp privacy and its subprocessor list.

8. International transfers and recipients

Cloudflare, Stripe/Link, Proton, Crisp, Plausible and Google act as technical recipients for their stated functions. Paid report files are stored in the EU. Other services and subprocessors may involve international transfers; appropriate UK GDPR transfer mechanisms and risk assessments must be maintained where required. We do not sell personal information or disclose report data for advertising.

9. Your rights and complaints

Subject to the law, you may request access, correction, erasure, restriction, portability or object to processing, and withdraw consent prospectively. Contact [email protected]. You may complain to the Estonian Data Protection Inspectorate and, where UK GDPR applies, the UK Information Commissioner’s Office.

10. ICO fee and automated output

We have assessed that a UK data-protection fee is payable: our processing of customers’ personal data does not fall within the ICO’s narrow fee exemptions (for example, processing limited to staff administration), and our size puts us in the lowest fee tier, £52 per year. This does not affect your rights under this notice.

No exclusively automated decision produces legal or similarly significant effects: the report is user-requested working material and does not determine a tax assessment.