Data, privacy and retention

VATflow is operated by United Fintec Limited, registered in England and Wales, which is the data controller for your account. We are registered with the Information Commissioner’s Office under number ZC139359 (opens the ICO register). Where an accountant uses VATflow for their clients, United Fintec processes the client data on the accountant’s instructions.

The full privacy policy and terms of service are the authoritative documents; this page is a plain-English summary.

• Your account: email address, password hash, authenticator details, recovery codes (hashed) and security events.
• Your companies: VAT registration numbers, trading names, VAT scheme settings.
• Your VAT data: the digital records you entered or imported, the files you uploaded, the returns you submitted and HMRC’s receipts.
• Your HMRC connection: the token HMRC issued to VATflow, stored encrypted. Never your Government Gateway password, which VATflow never sees.
• Data is stored in the United Kingdom (London region).

• VAT return records: six years from the end of the accounting period, as HMRC requires (VAT Notice 700/22).
• Security audit logs: 90 days, then deleted automatically.
• Account data: while your account is open. On closure, personal identifiers are scrubbed; the VAT submission records stay for the six-year period the law requires.

Under UK GDPR you can ask for a copy of the personal data we hold (a subject access request), have inaccurate data corrected, ask for erasure (subject to the six-year VAT retention duty), object to or restrict certain processing, and complain to the ICO. Email support@vatflow.uk from your account address; we respond within one month as the law requires, and usually much sooner.

• A submitted return: Download PDF on the return page.
• Your obligations list: Export CSV on VAT Returns.
• Any import: download it again as CSV from the prepare page of that period.
• Everything else, including security events: ask us by email and we will send a copy.

1. Disconnect HMRC for each company from Companies, which deletes the HMRC token from VATflow. You can also withdraw VATflow’s authority in your HMRC online account.
2. Cancel any subscription (see Pricing, billing and cancellation).
3. Email support@vatflow.uk from your account address asking us to close the account.
4. We close it, scrub your personal identifiers and confirm by email. Your submitted VAT records are kept for the legal six years and then deleted.