Privacy Policy

VATBuild is operated as a UK-based software service. As data controller, we are responsible for the personal data you provide when using this service. If you have any questions about this policy or wish to exercise your data rights, please contact us at privacy@vatbuild.com.

We are committed to protecting your personal data and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We collect and process the following categories of personal data:

• Account data: your name and email address when you register
• Project data: construction project details you enter, including site address, project description, contractor names, and planning authority information
• Invoice and document data: invoices and supporting documents you upload, including supplier names, amounts, and VAT information
• AI interaction data: text content from invoices and queries you send to our AI analysis features; this is transmitted to our AI sub-processors for processing
• Usage data: log data including your IP address, browser type, and pages visited, collected automatically when you use the service
• Session data: a session cookie is set when you log in to keep you authenticated

We process your personal data on the following legal bases:

• Contract performance: to provide the VATBuild service you have signed up to
• Legitimate interests: to improve our service, prevent abuse, and ensure security
• Legal obligation: where we are required to process data to comply with applicable law

We do not rely on consent as a basis for processing your account or project data. The session cookie we use is strictly necessary for the service to function and does not require consent.

Optional Google Analytics 4 public-website measurement relies on your consent. You can reject or withdraw it at any time without affecting login or use of VATBuild.

VATBuild uses artificial intelligence to analyse invoices and classify VAT line items. When you upload documents or ask questions via our VAT Advisor chat, the relevant text content is transmitted to our AI sub-processors for analysis.

Important: AI-generated output is provided for informational purposes only. It does not constitute professional tax or legal advice. You should verify all VAT classifications with a qualified accountant or tax adviser before submitting any HMRC claim.

We share data with the following third-party processors who act on our instructions:

• OpenAI, L.L.C. — AI document parsing and classification (USA; covered by standard contractual clauses)
• Anthropic, PBC — AI VAT rule reasoning (USA; covered by standard contractual clauses)
• Replit Inc. — application hosting and infrastructure (USA; covered by standard contractual clauses)
• Google (Google Analytics 4) — optional, consent-based public-website measurement. Google receives browser/device and visit information, including an IP address in transit, and cookie identifiers. Processing may take place outside the UK under Google’s applicable data-processing terms and transfer safeguards. See Google’s Privacy Policy.

We do not sell your personal data to any third party. We do not share your data with HMRC or any government body unless required by law.

We retain your data for as long as your account is active. If you delete your account, your personal data, projects, invoices, and reports are permanently deleted within 30 days.

We may retain anonymised, aggregated data for service improvement purposes indefinitely.

Under UK GDPR you have the following rights:

• Right of access: to obtain a copy of the personal data we hold about you
• Right to erasure: to request deletion of your personal data (you can also delete your account directly from Account Settings)
• Right to rectification: to correct inaccurate data
• Right to portability: to receive your data in a machine-readable format
• Right to object: to object to processing based on legitimate interests

To exercise any of these rights, email us at privacy@vatbuild.com. We will respond within 30 days. If you are unhappy with how we handle your request, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

We use industry-standard security measures including encrypted connections (HTTPS), hashed passwords, and access controls to protect your data. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

We use essential cookies and optional analytics:

• Session cookie (essential): set when you log in to keep you authenticated during your visit. This cookie is strictly necessary for the service to function and is automatically deleted when you sign out or when it expires (30 days). No consent is required for this cookie.
• Cookie consent preference (essential): stored in your browser's localStorage as vatbuild.analyticsConsent.v1 to remember your accepted or rejected analytics choice until changed or browser storage is cleared. Old cookie-notice acknowledgements do not grant analytics consent. Storage failure keeps analytics disabled.
• Security cookie (essential): csrfToken protects account actions from forged requests and expires after 30 days.
• GA4 cookies (optional): _ga and _ga_* distinguish public visits and sessions for up to 2 years, only after opt-in and when analytics is configured.

GA4 measures allowlisted public page visits and fixed-label pricing/signup clicks, not completed registrations or payments. Private, signed-in, admin, login, OAuth, password-reset and shared-report screens are excluded. We do not send emails, form input, account or organisation IDs, project names or IDs, invoices, uploaded content, financial amounts or tokens. Page URLs contain only approved public paths; query strings and fragments are stripped and referrers omitted. We do not use Google Ads, remarketing, Google Signals or personalised advertising.

No Google tag or analytics requests (including cookieless pings) run before opt-in or after rejection. You can withdraw using “Cookie preferences”. Collection stops, pending events are discarded, and applicable first-party GA cookies are cleared without signing you out. Withdrawal does not erase data already collected by Google. GA4 user/event retention should be set to 2 months; aggregated reports may remain longer.

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice in the application. Continued use of the service after changes constitutes acceptance of the updated policy.