Privacy Policy.

Effective date: 23 October 2026 · Version: 1.20

This policy is specific to Doddl: the mobile app and the doddl.app website. It explains what personal data Doddl holds, why, who is responsible for it, and the rights you have over it.

Who we are

Doddl Labs Limited (“we”, “us”) is the data controller responsible for your personal data.

• Registered company number: 17364783
• Registered address: 167-169 Great Portland Street, 5th Floor, London, W1W 5PF
• ICO registration number: ZC208310
• Privacy questions and rights requests: privacy@doddl.app

What we collect

• Your phone number: used to sign you in with a one-time passcode, and to send you tips and news about Doddl by text or WhatsApp (see below).
• Your name and email address: collected when you create your account. We use your email for messages about your account and the service. We also send tips and news about Doddl now and then, by email, text or WhatsApp. The box for those starts ticked when you sign up: untick it there if you’d rather not get them, and you can turn them off at any time afterwards.
• If you join the waitlist or sign up for a webinar on doddl.app: your name, email address and, if you give them, your mobile number and a social media handle, plus whether you ticked the box to hear creator accounting tips.
• The bank or card statements you give us: the files you upload, and the photos you take of a paper statement page by page. We keep the original file or photo, plus the payments we read out of them.
• Tax details you choose to save: such as your Unique Taxpayer Reference or National Insurance number, if you add them to the app. Saving these is optional.
• The answers you give for your return: what you tell us about your work, your other income and anything else your return needs, including the name and address to put on it and anything you choose to describe in your own words. Where a question on the return depends on it, that includes whether you had a partner during the tax year and the dates you were together, which we keep separately from the rest of your answers. We never ask for your partner’s name, National Insurance number or income.
• Documents you upload for your return: such as a P60 or P45 from a job, if you add one so we can read the figures off it for you to check.
• Tax-software sign-in details used to send your return: your Government Gateway user ID and password are sent securely to our server and used to check your sign-in and submit your return to HMRC. We do not save them for future use or put them in a submission queue.
• Your plan and purchases: whether you’re on your free trial or a paid plan, and a record of what you’ve bought and when. If you pay in the iPhone app, Apple tells us the purchase went through; if you pay on doddl.app, our card payment provider does.
• Support messages and attachments: what you write to us in Help & support, and any photos or screenshots you attach.
• Your device’s notification address: if you allow notifications, a code from your phone that lets us send you notifications, such as your weekly reminder or a reply from support.
• Your Earn choices, if your account has Earn: the categories you pick, your “I’d post it” and “Not me” swipes on products, your TikTok handle if you choose to type it in (it’s optional, and we never look it up or check it), and which links you open or copy.
• Referral links: when someone opens your referral link or signs up through it, we record that against your link. You see how many people are at each stage, numbered, never who they are.
• Bank details for referral money: if you earn referral money, the name on your bank account, your sort code and account number, which you give us in the app or, as a partner, on our website.
• If you save a referral offer on doddl.app: the email address you give us and the link you came through. We email you a code so the offer is waiting when you sign up.
• If you sign up as a partner on doddl.app: your name, email address and the bank details we pay you to.
• A scrambled form of your IP address: when you open a referral link or use a form on doddl.app, we keep a one-way scrambled version of your IP address so we can spot misuse. We can’t turn it back into your IP address.
• Usage information: for example, the screens you visit, taps and swipes, and that a statement was uploaded, so we can understand where people get stuck and keep the app working. Session recordings mask all on-screen text, images and anything you type.

Why we use it and our lawful basis

• To provide the service: reading the statements you upload or photograph, letting you sort your payments, showing you how much to set aside for your tax, and preparing and sending your return when you ask us to. Lawful basis: performance of our contract with you.
• To keep your books available to you: your money records stay in your account so you can look back at them whenever you need to. Lawful basis: performance of our contract with you, and our legitimate interest in keeping your records intact for you.
• To choose which links to show you in Earn: your categories, your swipes and the links you open or copy decide which products come first. Lawful basis: performance of our contract with you.
• To understand how Doddl is used: which features help, where people get stuck, and what to build next, so we can improve the product and how we describe and market it. Lawful basis: our legitimate interest in improving and marketing the service; you can object at any time using the contact above.
• To send you tips and news about Doddl by email, text or WhatsApp, unless you tell us not to. These are only ever about Doddl itself, never anyone else’s products. The box is ticked when you sign up and you can untick it there and then. Lawful basis: our legitimate interest in telling our own users about our own service. You can stop them at any time: turn off Tips from Doddl in the app’s settings, use the unsubscribe link in any email, or reply to any message and tell us.
• If you’re on the waitlist, to send you updates about Doddl by email, text or WhatsApp. News about what we’re building, when it launches and when you can get in. These are only ever about Doddl itself. Lawful basis: your consent, given when you joined. You can withdraw it at any time with the unsubscribe link in any email, or by replying to any message and telling us.
• To send you creator accounting tips, if you ticked the box for them on the waitlist or webinar form. Lawful basis: your consent. Unsubscribe at any time.
• To run the referral scheme and the partner programme: counting link opens and sign-ups against the link they came through, showing the link owner anonymous progress, and paying referral money to the bank account you give us. Bank details are used only to pay you. Lawful basis: performance of our contract with you.
• To save a referral offer you ask us to keep on doddl.app: emailing you a code and matching the offer when you sign up with that email. Lawful basis: our legitimate interest in running the offer you asked us to save for you.

You sort your payments yourself. We don’t make automated decisions about you that have legal or similarly significant effects, and the contents of your statements and payments are never used to advertise to you.

Who we share it with

We use third-party AI providers to read and structure the statements you upload or photograph, infrastructure providers for hosting, sign-in, text messages and email, an email service for our updates and tips, and a product-analytics provider to understand how people move through Doddl. Each provider is bound by a data-processing agreement and may use your data only to provide its function to us. Our AI providers do not use your data to train their models. Some providers process data outside the UK; where they do, we rely on appropriate safeguards (the UK International Data Transfer Agreement, Standard Contractual Clauses or UK adequacy regulations). The specific providers we currently use are listed below.

If you photograph a paper statement instead of uploading a file, each page you snap is sent whole to our document-reading processor to read the payments out of it. Keep the statement on its own in the frame, because anything else the camera catches is sent with it. Your snaps are stored with your other statement files in the UK. If you remove a statement, its payments go from your books straight away; the original file or photos stay with your account as your record and are deleted when you delete your account.

Photos of receipts you snap or upload are sent to our document-reading processor to read the shop, the date and the total, so we can match them to your payments. A P60 or P45 you upload for your return is read the same way, to pull out your pay and the tax taken off, which you then check. As with your statements, that processor is bound by contract, uses your data only to do that job, and never uses it to train its models.

When you ask Doddl a question, your chat messages are sent to our AI processor to write the answer, together with the details it needs to answer you properly: your plan, the state of your tax returns, and the figures Doddl shows you for the year, such as what to set aside, your income, your costs and anything already filed. If you ask about one of your payments, the details of that payment (the name on it, the amount, whether it’s money in or out, and the date) are sent too, and if you’ve sorted that shop before, a one-line note of how you usually swipe it. These chats are stored on our systems (hosted in London) so we can see where Doddl answers well or badly and make it better. Once a day our team reviews recent chats for quality with the help of an AI processor; your name is not sent to the AI processor for that review. Chats are deleted when you delete your account. As with your statements, that processor is bound by contract, uses your data only to do that job, and never uses it to train its models.

If you message us from Help & support, your chat is stored on our systems (hosted in London) so you and we can pick the conversation back up later. To answer you straight away, the messages in that chat, any photos you attach, and a short summary of your recent statement uploads (the type of file, the bank, whether it went through and any error you were shown) are sent to our AI processor to write the reply. Nothing else from your account is sent. The Doddl team, including Oli, the person behind Doddl, read support chats and can reply personally. When a chat is passed to a person, or an answer in your return needs a person to check it, our team handles it in our private Slack workspace, so your name and the details needed to help you are sent there. If a statement you upload can’t be read, our team is alerted there too, with your name, so someone can look into it; to find out why, the statement file may be read by our AI processor. As with your statements, that processor is bound by contract, uses your data only to do that job, and never uses it to train its models.

If you describe something in your own words in your return, that description and the amount you entered are sent to our AI processor, which suggests only which part of the return it belongs to. It never works out, changes or invents any of your figures, and nothing it suggests is used until someone on our team has approved it in our private Slack workspace as described above. Your name and your sign-in details are not sent for this.

The links in Earn, and the product names, pictures and rates on them, come to us from our partner agencies. Nothing about you goes back to them: not your name, your handle, your categories, your swipes, or which links you open. Product pictures are shown from Doddl’s own storage, so looking through Earn tells neither the agencies nor TikTok anything about you. Opening a link takes you to TikTok, where TikTok’s own terms and privacy policy apply.

If you pay in the iPhone app, Apple handles the payment under Apple’s own terms and privacy policy. If you choose to hear from us on WhatsApp, those messages go through WhatsApp, run by Meta, under WhatsApp’s own terms.

We never sell your data, and we never share it with anyone for their own marketing.

When you review and ask us to file a return, the return information, your UTR and the Government Gateway details needed for that submission are sent securely to HMRC. Setup on its own does not submit a return. The law requires every return sent through software to carry fraud-prevention information, so each submission also tells HMRC your device’s public IP address and network port, its local network addresses, a random identifier created when you installed the app, your device model and operating system, your time zone, your screen and app window size, the app version, and your Doddl account identifier (as it is, and again in a scrambled one-way form). HMRC uses this to protect you and the tax system from fraud.

Our current providers

Provider list last updated: 23 October 2026.

International transfers

Where a provider processes your data outside the UK (see the country shown for each provider above), we rely on appropriate safeguards: the UK International Data Transfer Agreement, Standard Contractual Clauses, or UK adequacy regulations such as the UK Extension to the EU-US Data Privacy Framework. You can ask us for more detail using the contact above.

How long we keep it

Your statements and payments stay in your account while it’s open. Self-employed people need to keep their money records for five years after the 31 January online filing deadline for each tax year. That’s your duty, and Doddl is where you keep them. When a tax year reaches the end of those five years, we’ll let you know 90 days before, offer you a download and ask whether you want to keep it. If you don’t choose to keep it, we delete that year when the 90 days are up. If you do, we’ll ask again every 12 months. If you delete a single payment, it’s taken out of your books straight away and removed for good when you delete your account. Lawful basis: performance of our contract with you and our legitimate interest in keeping your books complete.

If you don’t sign in for 24 months, we’ll ask whether you want to keep your account. If we don’t hear back within 90 days, we delete it as if you had deleted it yourself.

Our backups are kept for no more than 7 days, so data you delete is gone from them within 7 days.

Government Gateway details are never stored: they’re used for that sign-in check or submission only.

A referral offer saved against an email address on doddl.app is deleted after 24 hours if you don’t confirm your email, and after 30 days if it isn’t used.

If you delete your account, your bank details are deleted with it. We keep a record of referral payments we’ve made (the amount, the date and the last four digits of the account it went to) for our own accounts and records.

If you delete your account, we delete your data. The exception is a tax return you sent through Doddl: we keep the records behind it (the payments it was built from, what was sent and HMRC’s confirmation, and the name, Unique Taxpayer Reference and National Insurance number it was sent under) until five years after the 31 January deadline for that tax year, so we can show what we sent for you if HMRC or you ever ask about that return. We keep only those records, locked away and unused, and delete them at the end of that period. Lawful basis: our legitimate interest in being able to account for returns we sent on your instruction. Support conversations our team handled in Slack, and payment records held by Apple or our card payment provider, are kept for our records and accounts.

Keeping your data safe

Your data is encrypted on its way to and from the app, stored in the UK, and walled off so that only your account can see it in the app. Inside Doddl, only a small named team can access it, using their own accounts with two-step sign-in, and only to support you and keep the service running. Government Gateway details are held temporarily in memory while checking your sign-in and sending your return. They are not saved in our database. If you ever spot something that looks like a security problem, email security@doddl.app and we’ll look at it straight away.

Your rights

• Access: ask for a copy of the data we hold about you.
• Rectification: ask us to correct data that is wrong.
• Erasure: delete your account and data; you can do this in the app at any time.
• Portability: ask for your data in a portable form.
• Restriction and objection: ask us to limit or stop certain processing.
• Stop marketing: stop our tips, news and waitlist updates at any time with the unsubscribe link in any email, Tips from Doddl in the app, or by replying to any message and telling us; it doesn’t affect anything else about your account.
• Complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we handle your data.

To exercise any of these rights, contact us using the details above. To get a copy of your data, use Send me my data in the app’s settings or email us, and we will respond within one month. To delete your data, use the delete-account option in the app.

Doddl is for people running their own thing. It isn’t aimed at children under 16.

Complaints

You can complain to the UK regulator at any time:

• Information Commissioner’s Office (ICO)
• Website: ico.org.uk
• Helpline: 0303 123 1113

Changes to this policy

This policy reflects our current systems and may be updated as our technology or service changes. The effective date at the top shows the latest version, and the provider list shows when it was last updated.