Privacy notice

1. Who we are

ENA DIGITAL AI LTD is the data controller. We are registered with the Information Commissioner’s Office, registration number ZC283398. Questions and requests: privacy@enaops.com.

2. What we collect

Only what is needed to prepare a Self Assessment.

• Account: name, email, sign-in identifiers from our authentication provider.
• Tax profile: date of birth, postcode and address, National Insurance number, Unique Taxpayer Reference, residency nation, income sources, student-loan plan, Child Benefit status.
• Documents you upload (P60s, statements, invoices, receipts, vouchers) and the figures extracted from them.
• Your decisions in the app (approve, edit, reject, undo) and an audit trail of them.
• Technical: IP address, browser, timestamps, error logs. We do not use advertising trackers.

Your National Insurance number is encrypted at rest. UTRs are masked in the interface and never written to logs.

Your customers’ details (invoicing). If you use quotes and invoices, you add your customers’ names, email addresses, phone numbers and addresses. For that data you are the controller and we are your processor: we use it only to create your quotes and invoices, email them (with polite payment reminders you switch on) and show them to your customer through a private link. We never contact your customers for our own purposes. You can edit or delete a customer at any time (one with invoices is kept as part of your business records until you delete your account).

3. Why and on what legal basis

• Contract — providing the service you signed up for (sorting documents, estimating tax, exporting a pack).
• Legitimate interests — security, fraud prevention, fixing bugs, understanding how the product is used in aggregate.
• Legal obligation — keeping records where the law requires it.
• Consent — optional emails such as deadline reminders; withdraw any time in Settings.

We do not sell your data and we do not use your data to train AI models (see How EnaOps uses AI).

4. Where your data lives

In the UK. Data is stored and processed in United Kingdom (Azure UK South). Where a sub-processor operates outside the UK, we rely on UK adequacy regulations or the International Data Transfer Agreement.

5. Sub-processors

A short list, published here. Updated whenever it changes; the list below is the current beta set.

• Microsoft Azure (UK South) — hosting, storage, database.
• Clerk — sign-in and account security.
• AI model provider — document reading and classification, with no retention of your content for training. Named in How EnaOps uses AI.
• Microsoft Azure Communication Services (UK data location) — transactional email: account and reminder emails, and the quotes, invoices and payment reminders you send to your customers (sent from no-reply@mail.enaops.com; replies go to you).

6. How long we keep it

Six years, or until you delete your account — whichever comes first. HMRC expects Self Assessment records to be kept for at least 6 years, so each document carries a retention date six years after upload and is purged after that.

When you delete your account we hard-delete your documents, figures and profile; a minimal audit log is kept for 30 days for legal hold and then purged. Export your SA pack first if you want to keep it.

7. Your rights

Access, correction, deletion, portability, objection and restriction — all available in Settings → Data & privacy, or by emailing privacy@enaops.com. We answer within one month.

You can complain to the ICO at ico.org.uk or on 0303 123 1113. We would rather you told us first.

8. Security

Encryption in transit and at rest, per-account data isolation, audited admin access, short-lived download links, and no personal data in URLs or logs. Invoice and quote links you share with customers are signed, stop working after 30 days, can be revoked, and are rate limited.

9. Changes

We will tell you by email and in the app before any material change. Last updated 2 November 2026.