Who we are

Maddiq is provided by Maddiq Ltd, a company registered in England and Wales with company number 17437923. Our registered office is 46 Beaumont Road, London, England, SW19 6RG.

We are registered with the Information Commissioner’s Office under registration number CSN1059845.

For anything about your personal data, email privacy@maddiq.com.

Who this notice covers

This notice explains how we handle personal data when we decide why and how it is used. That covers:

• people who sign up to Maddiq and use it, including staff of accounting firms and people using Maddiq for their own tax affairs
• people who visit our website or contact us

If an accounting firm uses Maddiq to keep your records, sends you a quote or documents to sign, or you ask Nicai a question on its quote or signing pages, the firm is responsible for your data. We hold it on the firm’s behalf and follow its instructions. The firm’s own privacy notice explains how it uses your information, and you should contact the firm first.

What we collect

Account details. Your name, email address, the firm you belong to, your role, and the plan you chose.

What you put into Maddiq. If you use Maddiq for your own tax affairs, this includes your bookkeeping records, bank transactions, documents you upload and your tax figures.

Sign-in and security records. Each time you sign in, your IP address and browser are recorded against your session. We also keep an activity log of what you do in Maddiq and when, so that changes to accounting records can be traced to the person who made them.

Information HMRC requires us to send. When you submit a VAT return or a Making Tax Digital Income Tax update through Maddiq, the law requires us to send HMRC details about the device and connection used. These are:

• a device identifier, stored in your browser the first time you submit
• your public IP address and the time it was collected
• your browser’s user agent, screen size, window size and timezone
• browser plugins and your “do not track” setting, where available
• local IP addresses, where your browser makes them available
• your Maddiq user identifier
• our own server’s IP address

HMRC uses this to detect and prevent fraud. The legal basis is the Delivery of Tax Information through Software (Ancillary Metadata) Regulations 2019.

Connections to other services. If you connect Maddiq to HMRC or to a bank, we store the access tokens those services issue. HMRC tokens are encrypted before they are stored.

Messages you send us. Emails, contact form messages and support requests.

Why we use it, and on what legal basis

Who we share it with

We use the following providers to run Maddiq. Each only receives what it needs to do its job.

We also send information to HMRC when you submit a return or connect to their services, and to Companies House when you look up or file company information.

We do not sell personal data. We do not use advertising or analytics trackers.

Transfers outside the UK

Our database and application processing are in Ireland, which the UK recognises as providing adequate protection.

When you use an AI feature, the content involved is sent to Anthropic in the United States. We rely on Anthropic’s data processing addendum, which includes the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum. That addendum is the approved mechanism for sending personal data from the UK to the United States.

Anthropic does not use content sent through its interface for businesses to train its models, and deletes it on the timescale set out in that agreement. Content is used to produce the answer and nothing else.

Some of our other providers are US companies even where they process data in the EU. Where that applies we rely on the same kind of safeguard.

How long we keep it

• Your account, contract and billing records: six years after your account closes. That is how long a claim can be brought on a contract, and how long business records have to be kept.
• Records we hold for an accounting firm: the firm decides. A client business that uses Maddiq itself keeps its own books and access if its firm leaves. When a firm closes its account, its data stays available to export for 30 days and is then deleted, unless the firm asks us in writing to keep it for longer. We do not hold it for six years of our own accord: it is the firm's data, and keeping it would serve no purpose beyond the risk of holding it.
• Your records, if you use Maddiq for your own tax affairs: for as long as your account is open. When you close it you can export everything, and we delete it 30 days later. You need to keep your own tax records for at least five years after the 31 January deadline, so export before you close.
• Sign-in and security records: 12 months.
• Messages to us and support requests: two years.

If you ask us to delete your data, we will, unless the law requires us to keep it. Where that applies we will tell you what we are keeping and why, rather than simply refusing.

Your rights

You have the right to ask for a copy of your data, to have it corrected, to have it deleted, to restrict or object to how we use it, and to have it given to you in a portable format. Where we rely on consent, you can withdraw it at any time.

Email privacy@maddiq.com. We will reply within one month.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

Reporting a security issue

If you think you have found a security problem in Maddiq, or you believe data has been exposed, email security@maddiq.com. We will acknowledge it within two working days.

Please include what you found and how to reproduce it. Do not access, change or delete other people's data to demonstrate the problem.

Cookies and browser storage

We only use what the service needs to work:

• a sign-in cookie that keeps you logged in
• the HMRC device identifier described above, kept in your browser’s local storage

Because these are strictly necessary, we do not ask for consent. We use no advertising, tracking or analytics cookies.

Changes to this notice

If we make a change that matters, we will tell you by email or in the app before it takes effect. Our terms of service explain how we handle data we hold on a firm’s behalf.