Last updated: 14 August 2026
Money8 is operated by Forty Technologies ("we", "us"). We are the data controller responsible for protecting the personal data you entrust to us. This notice explains what we process, why, on what lawful basis, and your rights. Questions or requests: wei.lu@fortytechs.com.
Account data: your name, email address, phone number, company name and role (client or accountant). Financial records you add or upload: transactions, invoices, categories, bank statements and receipts, including files you upload for automatic extraction. HMRC filing data: your VAT registration number or National Insurance number, the figures submitted to HMRC, and submission receipts. We hold the HMRC access tokens that let us file on your behalf in encrypted form; we never see or store your Government Gateway password. Device and usage data required by law for HMRC filings — see the next section.
When you use Money8 to interact with HMRC, UK law requires us to send HMRC fraud-prevention header data with every request. This includes: a device identifier, your public IP address and port, browser details (user agent, plugins, screen and window size, timezone, do-not-track setting), local network IP addresses, your Money8 user ID, and our product name and version. This is a legal obligation on all Making Tax Digital software and cannot be switched off while using HMRC features.
To provide the service you signed up for — storing your records, deriving tax figures, and submitting returns you approve (lawful basis: performance of a contract). To send fraud-prevention data to HMRC with each HMRC request (lawful basis: legal obligation). To keep records of submissions, receipts and audit trails (lawful basis: legal obligation and legitimate interests in accuracy and dispute resolution). To secure the service and prevent abuse (lawful basis: legitimate interests).
HMRC — the figures you approve for submission plus the fraud-prevention data described above. Our processors, used solely to run the service: Supabase (database, authentication and file storage), Amazon Web Services (application hosting), and OpenAI (transaction descriptions may be processed to match uploaded bank lines against your records; no account credentials are ever shared). If you are a client linked to an accountant on Money8, your accountant can see the records needed to prepare and file on your behalf. We do not sell personal data or share it with advertisers.
Data is encrypted in transit; HMRC tokens are additionally encrypted at rest (AES-256-GCM). Access is controlled per user with row-level security in the database. HMRC submission records are retained to meet statutory record-keeping periods; if you delete your account we remove personal data not subject to those obligations.
Under the UK GDPR you can ask us for access to, correction of, or deletion of your personal data; ask us to restrict or object to processing; and request a portable copy. Contact wei.lu@fortytechs.com and we will respond within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).