Tax privacy notice.

Last updated 11 November 2026

Custom Launch Tax is the part of the Custom Launch client portal that prepares VAT returns from your spreadsheets and sends them to HM Revenue & Customs (HMRC) through HMRC's Making Tax Digital service. This notice covers the information it handles. Custom Launch Tax is not yet on HMRC's list of recognised software. Until it is, it works only with HMRC's test service.

Who is responsible

Each portal belongs to a business: you, or the accountant who looks after your VAT. That business decides whose VAT the portal handles and is responsible for that information (the data controller). Custom Launch Limited builds and hosts the portal and handles the information on that business's instructions (the data processor). For the connection to HMRC, Custom Launch Limited is the software developer HMRC knows.

Custom Launch Limited is registered in England & Wales, company number 15637771, at 22 Mitchell Way, Reading, Berkshire, RG5 4NQ, and with the Information Commissioner's Office under number ZC286900. Email contact-us@customlaunch.co.uk.

What it keeps

• Businesses: the business name, its VAT registration number, and whether it's the portal owner's own business or a client.
• Your spreadsheet: the file you upload, kept on our server so each figure can be traced back to its cell, with a fingerprint of the file.
• The return: the nine VAT boxes, the cell each came from, any change made by hand and the reason given, notes, and who prepared it.
• Approval and declaration: when a client approved the figures and how, the declaration made when sending, who sent it and when.
• HMRC's receipt: the date HMRC received the return, the form bundle number, the payment reference and receipt ID.
• From HMRC: the VAT periods and due dates, what HMRC says is owed, and payments HMRC has received, shown on screen. Due dates are kept so the portal can remind you.
• Your HMRC connection: when you connect, HMRC gives the portal access and refresh tokens instead of your HMRC password. We never see your HMRC password. The tokens are stored encrypted and deleted when you disconnect.
• A log of calls to HMRC: the time, which kind of call, HMRC's answer and reference number, and the VAT number with most of its digits hidden.

Fraud prevention data sent to HMRC

The law requires software that sends information to HMRC to send fraud prevention data with every call. This means HMRC can protect your tax account. With each call, the portal sends HMRC:

• your public IP address, port and the time it was seen, and our server's IP address;
• a random device ID kept in your browser, your browser's user agent, screen size, window size, colour depth and time zone;
• your portal user ID and email, and the kind of two-step sign-in you used, with when you used it and a reference that can't be turned back into your code;
• the name and version of the software, and a reference for the portal's licence.

This information goes to HMRC only and is used only for this. HMRC's own privacy notice explains what HMRC does with it.

Why we use it

To prepare and send VAT returns, which is what the portal is for. For businesses, that's to perform the contract with them. Fraud prevention data and the records of returns sent are kept because the law requires it. Due-date reminders appear on screen only, and the portal sends no marketing.

How long we keep it

VAT records must be kept for at least six years, so returns sent to HMRC, their spreadsheets, approvals and receipts are kept for six years after the end of the VAT period. A business with returns sent can't be removed from the portal before then. Drafts that are never sent are deleted when the business is removed. HMRC tokens are deleted when you disconnect. If HMRC stops accepting them, they can't be used again and the portal asks you to connect again. The log of calls to HMRC is kept for two years.

Where it's kept and who sees it

On servers Custom Launch Limited manages in the UK, behind encryption in transit, two-step sign-in, a firewall and daily encrypted backups. Custom Launch Limited holds a Cyber Essentials certificate. People who see it: the portal owner's staff with access to VAT returns, the client the return is for, our support staff when the portal owner asks for help, and HMRC. We never sell it or use it for advertising.

Your rights

You can ask for a copy of the information about you, to correct it, to delete it (unless the law says it must be kept), or to limit how it's used. Ask the business that runs your portal. You can also email contact-us@customlaunch.co.uk and we'll pass the request on and help them answer within a month. You can disconnect the portal from HMRC at any time on the VAT returns page.

If you're unhappy with how your information has been handled, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes

If this changes, we'll update this page and the date at the top. Our website privacy and cookies notice covers this website itself.