Privacy Policy

VATBuild is operated as a UK-based software service. As data controller, we are responsible for the personal data you provide when using this service. If you have any questions about this policy or wish to exercise your data rights, please contact us at privacy@vatbuild.co.uk.

We are committed to protecting your personal data and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We collect and process the following categories of personal data:

• Account data: your name and email address when you register
• Project data: construction project details you enter, including site address, project description, contractor names, and planning authority information
• Invoice and document data: invoices and supporting documents you upload, including supplier names, amounts, and VAT information
• AI interaction data: text content from invoices and queries you send to our AI analysis features; this is transmitted to our AI sub-processors for processing
• Usage data: log data including your IP address, browser type, and pages visited, collected automatically when you use the service
• Session data: a session cookie is set when you log in to keep you authenticated

We process your personal data on the following legal bases:

• Contract performance: to provide the VATBuild service you have signed up to
• Legitimate interests: to improve our service, prevent abuse, and ensure security
• Legal obligation: where we are required to process data to comply with applicable law

We do not rely on consent as a basis for processing your account or project data. The session cookie we use is strictly necessary for the service to function and does not require consent.

VATBuild uses artificial intelligence to analyse invoices and classify VAT line items. When you upload documents or ask questions via our VAT Advisor chat, the relevant text content is transmitted to our AI sub-processors for analysis.

Important: AI-generated output is provided for informational purposes only. It does not constitute professional tax or legal advice. You should verify all VAT classifications with a qualified accountant or tax adviser before submitting any HMRC claim.

We share data with the following third-party processors who act on our instructions:

• OpenAI, L.L.C. — AI document parsing and classification (USA; covered by standard contractual clauses)
• Anthropic, PBC — AI VAT rule reasoning (USA; covered by standard contractual clauses)
• Replit Inc. — application hosting and infrastructure (USA; covered by standard contractual clauses)

We do not sell your personal data to any third party. We do not share your data with HMRC or any government body unless required by law.

We retain your data for as long as your account is active. If you delete your account, your personal data, projects, invoices, and reports are permanently deleted within 30 days.

We may retain anonymised, aggregated data for service improvement purposes indefinitely.

Under UK GDPR you have the following rights:

• Right of access: to obtain a copy of the personal data we hold about you
• Right to erasure: to request deletion of your personal data (you can also delete your account directly from Account Settings)
• Right to rectification: to correct inaccurate data
• Right to portability: to receive your data in a machine-readable format
• Right to object: to object to processing based on legitimate interests

To exercise any of these rights, email us at privacy@vatbuild.co.uk. We will respond within 30 days. If you are unhappy with how we handle your request, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

We use industry-standard security measures including encrypted connections (HTTPS), hashed passwords, and access controls to protect your data. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

We use only the following cookies:

• Session cookie (essential): set when you log in to keep you authenticated during your visit. This cookie is strictly necessary for the service to function and is automatically deleted when you sign out or when it expires (30 days). No consent is required for this cookie.
• Cookie consent preference (essential): stored in your browser's localStorage to remember that you have acknowledged our cookie notice. Not a tracking cookie.

We do not use any advertising, analytics, or third-party tracking cookies. We do not use Google Analytics or any similar service.

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice in the application. Continued use of the service after changes constitutes acceptance of the updated policy.