Privacy Policy

1. Who we are

Yield is a Making Tax Digital (MTD) Income Tax software service for UK landlords. The data controller is Yield ("we", "us", "our"). Contact us at support@yield-mtd.co.uk.

If you believe you've found a security vulnerability or wish to report a security incident, please email support@yield-mtd.co.uk — see also our security.txt.

2. What data we collect

• Your name and email address (for account creation)
• Your National Insurance number (to authenticate with HMRC on your behalf)
• Your HMRC OAuth tokens (to submit MTD returns)
• Property details you enter (address, description)
• Income and expense transactions you add or import from Xero
• Submission history (quarterly updates submitted to HMRC)

3. How we use your data

• To submit quarterly MTD Income Tax updates to HMRC on your behalf
• To retrieve your property business obligations from HMRC
• To display your income and expense summaries in the dashboard
• To provide customer support

We do not sell your data to third parties. We do not use your data for advertising.

4. Legal basis

We process your data under contract (to deliver the service you subscribed to) and where necessary to comply with our legal obligations under UK GDPR.

5. Where your data is stored

Your database is hosted by Supabase in Paris, France (within the European Economic Area). The application itself runs on Vercel's infrastructure in London, United Kingdom. Your data does not leave the UK/EEA.

6. How long we keep your data

We keep your account data and submission history for 7 years from the date of each submission, in line with HMRC record-keeping requirements. You may request earlier deletion of account data by contacting us.

7. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Restrict or object to processing
• Data portability

You can download a full export of your data (properties, transactions, obligations, submissions and HMRC connection details) at any time from your dashboard using the "Export my data" button — useful if you switch providers. To exercise any other right, email support@yield-mtd.co.uk. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

8. Cookies

We use strictly necessary session cookies to keep you logged in and to securely handle HMRC OAuth authorisation. We do not use tracking or advertising cookies.

9. Third-party services

• HMRC — receives your MTD submissions as required by law
• Xero — optionally, if you connect Xero to import transactions
• Stripe — processes subscription payments (they handle payment data; we never see your card details)
• Supabase — database hosting
• Vercel — application hosting

10. Changes to this policy

We will notify you by email if we make material changes to this privacy policy.