Privacy Policy

Who we are

The data controller is the operator of Taper (thetaper.co.uk). Contact us at hello@thetaper.co.uk for anything on this page.

The short version

We do not store the figures you enter (salary, RSU values, share prices, and so on) unless you explicitly ask us to, by downloading a report or asking us to email you a result. We never store or transmit your raw financial figures for analytics. We track a small number of anonymous product-usage events to understand how Taper is used, but that tracking never captures what you typed into the calculator. If you use a shared scenario link, the figures live in the link itself, not on our servers. If you leave a review, the text and star rating you submit are stored and, once approved, shown publicly.

What we collect, when, and why

• Emailed report: if you ask us to email you a summary of your results, we process your email address and the result figures to send it. Lawful basis: performance of a service you requested (UK GDPR Art. 6(1)(b)).
• Waitlist and product updates: if you opt in, we store your email address and your choices so we can send you what you asked for. Lawful basis: consent (Art. 6(1)(a)).
• Reviews: if you submit a review, we store the rating, the review text, and an optional name. Lawful basis: consent (Art. 6(1)(a)).
• Analytics: if you accept the cookie banner, we record a small set of named product-usage events. Lawful basis: consent (Art. 6(1)(a)), and consent under PECR for the storage access this involves.
• Rate limiting, abuse prevention, hosting logs, and the unsubscribe suppression list: we process IP addresses and request data to keep the service running and stop abuse, and we keep unsubscribed emails on a suppression list so they are never re-added. Lawful basis: legitimate interests (Art. 6(1)(f)). We weigh this against your rights and consider it justified because it is limited to what is needed to keep the service reliable and free of abuse.

What never leaves your device

Everything you type into a calculator (salary, vest details, share prices, and every other input) is saved only in your own browser’s local storage, so a reload does not lose your work. It is never sent to our servers as part of ordinary use of the calculators. Clearing your browser’s site data for thetaper.co.uk removes it.

Shared scenario links

When you generate a shareable link, the entire scenario (salary, vest rows, share prices) is encoded into the link’s web address. Anyone who has the link can open it and see those figures. Links, including everything after the question mark, can also appear in ordinary hosting and network logs (Vercel, Cloudflare), the same way any web address does. Only share a link with people you are happy to see those figures. Opening the site fresh, without a link, shows nothing from a previous session. Analytics is already built to ignore this: our analytics tool strips the address after the question mark from every event before it is sent, so scenario data never reaches analytics.

Emailing yourself a report

If you ask us to email you a report, we send your email address and a summary of your results (total RSU value, tax figures, CGT figures, and the insight lines shown on screen) through our server and Resend, our email delivery provider, based in the US (see International transfers below). The figures themselves are not stored afterwards; only your email address and the preferences you ticked are kept. Every email includes a signed unsubscribe link that works without needing to log in.

Reviews

If you submit a review, we store your star rating, your review text (up to 2,000 characters), and an optional name. Reviews are moderated before publication: submitting one does not make it visible by itself. Once approved, the rating, text, and any name you gave are shown publicly on the site. You can ask us to remove a review at any time by emailing hello@thetaper.co.uk. Please do not include anyone else’s personal information in a review.

Analytics

We use PostHog, an EU-hosted product analytics tool, to understand broad usage patterns. Nothing is initialised or sent before you accept the cookie banner. Automatic capture of page content and form inputs, session recording, and heatmaps are all switched off for this project: only around a dozen specific, deliberately chosen events are tracked (like “landing page viewed” or “calculator started”), and none of them include the actual numbers you enter or any free text. Where an event benefits from knowing roughly what income bracket a visitor is in, we use broad, pre-defined ranges rather than your exact figure. The address after the question mark or hash of every page is stripped before it reaches analytics, so a shared scenario link never leaks its figures there. Declining analytics changes nothing about how the tools work.

Withdrawing analytics consent

You can change your analytics choice at any time, right here.

Error monitoring

Error-monitoring scaffolding exists in the code but is inactive: it only switches on if we configure a Sentry project key, which we currently have not done. If it is ever enabled, it would capture technical details about what went wrong in the code, such as the error message and a stack trace, not the contents of any form you were filling in when it happened. This section will be updated if that changes.

Cookies and local storage

No cookies are set before you make a choice on the cookie banner. The site itself uses your browser’s local storage, not cookies, for the items below. Analytics cookies and local storage entries (prefixed ph_) are set only once you accept.

• taper.analytics.consent: your cookie-banner choice, kept until you clear it or change it above.
• taper.analytics.internal: an owner-only flag used to exclude our own visits from analytics.
• taper.install.dismissed: remembers that you closed the install-this-app prompt.
• taper.planner.v1 and other taper.* keys: your in-progress calculator inputs.
• PostHog’s ph_* entries: set only after consent, used to distinguish one anonymous visitor from another.

Your browser’s site-data controls clear all of these. A service worker also caches the site’s shell and static assets on your own device for offline and repeat visits; this cache never leaves your device either.

Who processes data for us

• Supabase: database, EU region.
• Resend: email delivery, US.
• PostHog: analytics, EU hosting.
• Vercel: hosting and content delivery.
• Cloudflare: DNS and proxy.
• Sentry: error monitoring, only if and when we enable it (see Error monitoring above).

International transfers

Most of our processing happens in the UK or EU. Resend, our email provider, is based in the US; that transfer is covered by Resend’s Data Processing Agreement, which incorporates Standard Contractual Clauses together with the UK International Data Transfer Addendum. Vercel is covered similarly under its own Data Processing Agreement. In plain terms, this means a contractual safeguard is in place wherever your data crosses outside the UK or EU.

How long we keep things

• Subscriber emails: kept until you unsubscribe (then kept on a suppression list so you are never re-added) or ask us to erase them entirely.
• Reviews: kept while published, or until you ask us to remove one.
• Analytics events: kept per PostHog’s project retention.
• Calculator inputs: stay on your device until you clear them yourself.
• Hosting and request logs: kept per Vercel’s and Cloudflare’s standard retention.

Your rights

Under UK GDPR you have the right to: access the data we hold about you, have it corrected, have it erased, restrict how we use it, receive a copy in a portable format, object to our processing, and withdraw consent at any time without affecting anything we did before you withdrew it. You also have the right to complain to the ICO (ico.org.uk). To exercise any of these rights, email hello@thetaper.co.uk and we will respond within one month. For emails specifically, the quickest path is the unsubscribe page.

Children

Taper is aimed at working adults managing their own UK tax affairs and is not directed at children. We do not knowingly collect data from children.

No automated decisions

We do not use automated decision-making or profiling that has a legal or similarly significant effect on you.

Changes to this policy

If our data practices change materially, we will update this page and the last-updated date above. See the disclaimer page for how the tools themselves are versioned.

Not legal advice

This policy is provided for transparency about our practices. It is not a substitute for professional legal advice, and has not been reviewed by a qualified solicitor. If you rely on this page for compliance purposes, have it reviewed first.