Data retention policy

1. Principle

We keep personal and business data only as long as necessary for the purposes described in our Privacy policy, or as required by law — whichever is longer where the law demands retention. For data controller and company registration details, see our Privacy policy and About us pages.

2. Tax and business records

HMRC generally expects self-employed people to keep records for at least five years after the 31 January submission deadline of the relevant tax year (often described as six tax years in practice). While your subscription is active, we store submissions, figures, and uploaded receipts so you can meet those obligations.

If you cancel, you keep access until the end of your paid period. After that we keep a 30-day grace period so you can export your submissions and receipts, delete your account, or resubscribe. We may then delete or anonymise inactive account data unless we must keep it longer for legal, accounting, or dispute resolution reasons.

3. Account and profile data

• Active accounts: retained while your account exists and the service is used.
• Closed accounts: deleted or anonymised within a reasonable period after closure, except data we must retain (see below).
• Billing records: kept as required for tax, accounting, and anti-fraud purposes (typically up to six years for UK companies).

4. Receipts and uploads

Receipt images and documents are stored in your account while active. Deleting an expense line or account may remove linked files subject to backup cycles. Export copies you need before deletion.

5. Security and technical logs

Server, authentication, and security logs are kept for shorter periods (often 30–90 days, sometimes longer if investigating an incident) unless a longer period is needed for security or legal reasons.

6. Support communications

Emails and support tickets are retained long enough to resolve your enquiry and improve service quality, then deleted or anonymised unless linked to a legal claim or regulatory matter.

7. Your rights

You may request erasure under UK GDPR where applicable, but we may refuse or limit deletion where we have a lawful basis to retain data (for example legal obligation or establishment of legal claims). See our GDPR & data protection page and email support@selfsubmit.co.uk.

8. Backups

Deleted data may persist in encrypted backups for a limited time before being overwritten. Backups are not used to restore deleted accounts except where required for disaster recovery involving active customers.