Last updated: 7 October 2026
Every company that receives personal data in the course of running TaxBot, what it receives, where it processes it, and the safeguard that covers it. This page accompanies our privacy policy — section 9 of that policy explains the transfers outside the UK and EU in plain English.
| Entity name | Processing activities | Country | Controls & further information |
|---|---|---|---|
| Telegram | The messaging platform you reach us through. Your messages pass through their servers. | Netherlands (accounts registered in the UK or EEA) | Governed by Telegram’s own privacy policy rather than ours, since you hold the Telegram account. Telegram has an Article 27 representative in the EU and does not publish a data processing agreement. |
| Anthropic | Reads the receipts and documents you send, the messages you type to log an entry, and the questions you ask in the chat. | United States | Anthropic offers no EU or UK location for this service. Their data processing agreement applies automatically and incorporates the European Commission’s Standard Contractual Clauses (controller to processor) together with the UK International Data Transfer Addendum, the template issued by the ICO. They do not train on this data and delete it within 30 days. Anthropic is not certified under the EU-US Data Privacy Framework, so the Clauses and Addendum are the safeguard relied on. Their own subprocessors: anthropic.com/subprocessors |
| Supabase | The database holding your account, figures and entries. Also holds older receipt images not yet moved to Cloudflare R2. | EU-West | Data processing agreement in place. No transfer outside the EU. |
| Cloudflare | Serves our website and the panel that opens when you file to HMRC, so it sees your IP address as the request passes through. Stores receipt images and the reports we generate, in R2. | EU | Data processing agreement in place. R2 bucket located in the EU. Reached through its S3-compatible API. |
| Railway | Hosts the application itself, so all data passes through it in the course of running the service. | EU-West | Data processing agreement in place. No transfer outside the EU. |
| Stripe | Takes your subscription payment and holds the billing details. | United States (Stripe, Inc.) | You contract with Stripe Payments UK Ltd, which passes payment and billing data to Stripe, Inc. Stripe, Inc. is certified under the UK Extension to the EU-US Data Privacy Framework, and Stripe’s Data Transfers Addendum also incorporates the UK Addendum to the Standard Contractual Clauses. |
| Resend | Sends the emails we send you — reports, receipt downloads and billing emails. Receives your email address and the content of those emails. | United States | Resend can dispatch mail from Ireland, but account data, email metadata and delivery logs are held in the United States regardless of the sending region, so this is a US transfer. Covered by their data processing agreement and the Standard Contractual Clauses. |
| Sentry not currently enabled | Error monitoring. Would receive technical details of a failure, which can occasionally include data from the request that failed. | Not applicable while it is switched off | Listed because the integration is present in the application, but it is NOT enabled: no reporting address is configured, so nothing is sent to Sentry at all. Were it enabled, calculator figures are stripped from error reports before they leave. |
| HMRC | Receives the tax figures you choose to submit, through the Making Tax Digital for Income Tax API. | United Kingdom | Not a processor acting on our instructions: HMRC is a separate controller receiving a statutory submission that you authorise. Listed here for completeness. |
We keep this page in step with the software: the list is generated from the same definition the application uses, and an automated check fails our build if a company is added without its country and safeguard being recorded here.