Privacy notice
Last updated: 3 October 2026
Money8 is operated by Forty Technologies ("we", "us"). We are the data controller responsible for protecting the personal data you entrust to us. This notice explains what we process, why, on what lawful basis, and your rights. Questions or requests: support@money8.co.uk.
What we collect
Account data: your name, email address, phone number, company name and role (client or accountant). Financial records you add or upload: transactions, invoices, categories, bank statements and receipts, including files you upload for automatic extraction. HMRC filing data: your VAT registration number or National Insurance number, the figures submitted to HMRC, and submission receipts. We hold the HMRC access tokens that let us file on your behalf in encrypted form; we never see or store your Government Gateway password. Device and usage data required by law for HMRC filings — see the next section.
Data we must send to HMRC (fraud prevention)
When you use Money8 to interact with HMRC, UK law requires us to send HMRC fraud-prevention header data with every request. This includes: a device identifier, your public IP address (and port, where our hosting can observe it) with the time it was recorded, browser details (user agent, screen size and colour depth, window size, timezone), your Money8 user ID, and our product name, version and server IP address. This is a legal obligation on all Making Tax Digital software and cannot be switched off while using HMRC features.
Why we process it and our lawful bases
To provide the service you signed up for — storing your records, deriving tax figures, and submitting returns you approve (lawful basis: performance of a contract). To send fraud-prevention data to HMRC with each HMRC request (lawful basis: legal obligation). To keep records of submissions, receipts and audit trails (lawful basis: legal obligation and legitimate interests in accuracy and dispute resolution). To secure the service and prevent abuse (lawful basis: legitimate interests).
Who receives your data
HMRC — the figures you approve for submission plus the fraud-prevention data described above. Our processors, used solely to run the service: Supabase (database, authentication and file storage), Amazon Web Services (application hosting), Microsoft Azure AI Document Intelligence (reading the text on receipts and bank statements you upload), OpenAI (transaction descriptions and merchant names may be processed to match uploaded bank lines against your records and to suggest categories; no account credentials are ever shared), Google Maps Platform (address suggestions when you search for an address) and Brandfetch (merchant names and web domains, to display merchant logos). If you are a client linked to an accountant on Money8, your accountant can see the records needed to prepare and file on your behalf. We do not sell personal data or share it with advertisers.
How we protect and keep it
Data is encrypted in transit; HMRC tokens are additionally encrypted at rest (AES-256-GCM). Access is controlled per user with row-level security in the database. HMRC requires VAT records to be kept for at least 6 years (gov.uk/charge-reclaim-record-vat/keeping-vat-records), so we keep VAT submission records — the figures, HMRC receipts and declarations — for 6 years after the period they cover. If you delete your account we remove personal data not subject to those obligations.
Cookies and browser storage
We use only what the service needs to work: sign-in session cookies, a cookie that remembers your language, and browser storage for interface preferences and for the device identifier that HMRC's fraud-prevention rules require. We use no analytics or advertising cookies.
Your rights
Under the UK GDPR you can ask us for access to, correction of, or deletion of your personal data; ask us to restrict or object to processing; and request a portable copy. Contact support@money8.co.uk and we will respond within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).