Conduit prepares Making Tax Digital returns, which means handling your bank data. This is what happens to it.
Your bank statements. The files you upload, and the transactions inside them — dates, amounts, and who you paid.
Your tax details. Name, email, National Insurance number, Unique Taxpayer Reference, business name and address.
What was decided. Which category each transaction was given, whether Conduit or you chose it, and what was sent to HMRC.
Technical information. HMRC requires software to send fraud-prevention headers with every submission — your IP address, device and browser. That is a legal requirement of filing, not our choice.
To prepare and file your returns. That is the only reason. Your data is not sold, not shared with advertisers, and not used to train anyone's models.
Categorisation and the assistant send transaction descriptions and amounts to Anthropic's API to be classified. They are not used for training. Your name, address, NINO and UTR are never sent.
Uploaded files are deleted after 90 days. Once a quarter is prepared, the file has done its job — the transactions live in your account. A record that you uploaded it remains, so your history still makes sense.
Returns and the decision trail are kept for six years, matching how long HMRC can ask you about a return. That record is append-only: it can be added to, but not edited or deleted, including by us. That is deliberate — a trail you could quietly change would be worth nothing if HMRC ever queried a figure.
Uploaded files are encrypted before they are written to disk, each with its own key. Passwords are hashed and salted. Traffic is HTTPS only. Backups are encrypted with the data inside them.
You can ask for a copy of what we hold, ask us to correct it, or ask us to delete your account. Email privacy@goconduit.ai and we will respond within one month.
One limit worth stating plainly: we cannot delete the record of a return already filed with HMRC, or the trail behind it. Tax records must be retained by law, and the audit trail is append-only by design. Everything else can go.
If you think we have handled your data badly you can complain to the Information Commissioner's Office at ico.org.uk.
On a server in Helsinki, Finland, inside the EU. Email is sent via Resend. Categorisation uses Anthropic. HMRC receives only what your return requires.
Last updated 3 August 2026. Conduit is in early access — if something here is unclear, say so and we will fix the wording, not just the page.