Privacy Policy

Last updated: 2026-03-21

Version: 1.0 · Company: Submyt Tax Limited (Company No. 780920) · Address: 77 Camden Street Lower, Dublin D02 XE80, Ireland · Support: support@submyt.com

This Privacy Policy explains how Submyt Tax Limited (“Submyt”, “we”, “us”, “our”) collects, uses, stores, and shares your personal data when you use our website and software platform (the “Service”, as defined in our Terms of Service). It is issued in compliance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Irish Data Protection Act 2018.

By creating an account or using the Service, you acknowledge this Privacy Policy. This policy should be read alongside our Terms of Service and Refund Policy.

1. Data controller

Submyt Tax Limited is the data controller for personal data collected through the Service. Contact us at:

Email: support@submyt.com

Post: 77 Camden Street Lower, Dublin D02 XE80, Ireland

2. Personal data we collect

We may collect and process the following categories of personal data:

Account data: Name, email address, and password credentials.
Financial and billing data: Payment details (processed by Stripe; we do not store full card numbers), subscription history, and invoices.
Investment and tax data: Transaction records, broker imports, portfolio data, and CGT calculation outputs you create or generate through the Service.
Technical data: IP address, browser type and version, device information, operating system, and referral source.
Communication data: Information provided through customer support inquiries, feedback, or service requests.
Usage data: How you interact with the Service, including features used, pages visited, and session duration.

3. How we use your data

We use your personal data to:

provide, operate, and maintain the Service (including processing broker imports, calculating CGT figures, and generating outputs),
process payments and maintain billing records,
communicate with you about your account, support inquiries, and service updates,
improve the Service, including analysing usage patterns and fixing issues,
ensure security and prevent fraud or misuse,
comply with legal and regulatory obligations (including tax record-keeping),
send marketing communications where you have provided consent.

4. Legal basis for processing

We process your personal data on the following legal grounds:

Contractual necessity (Art. 6(1)(b) GDPR): Processing required to provide the Service under our Terms of Service.
Legal obligation (Art. 6(1)(c) GDPR): Processing required to comply with tax, accounting, or regulatory requirements.
Legitimate interests (Art. 6(1)(f) GDPR): Service improvement, fraud prevention, and business operations, where these interests are not overridden by your rights.
Consent (Art. 6(1)(a) GDPR): Marketing communications. You can withdraw consent at any time.

5. Data retention

We retain personal data only as long as necessary for the purposes set out in this policy, subject to legal and regulatory requirements:

Account and customer records: Retained for up to 6 years following account closure or termination of the Service, in line with the Irish Statute of Limitations.
Financial and billing records: Retained for at least 7 years to comply with tax and accounting obligations.
Investment and tax data: Retained for up to 6 years following the last tax year for which data was processed, or longer if required by law.
Marketing data: Retained until you withdraw consent or opt out.
Technical and usage data: Retained for up to 24 months for analytics and service improvement.

On account deletion or termination, we will delete or anonymise personal data that is not subject to a legal or contractual retention requirement within 30 days. Data subject to the retention periods listed above will be retained for the applicable period and then deleted or anonymised.

You may request earlier deletion of your personal data at any time by contacting support@submyt.com. We will comply with your request except where retention is required by law.

We do not sell or rent your personal data. We may share data with the following categories of recipients:

Payment processors: Stripe processes payments on our behalf. Your payment data is handled in accordance with Stripe’s privacy policy.
Email and communication providers: We use third-party services to send transactional and marketing emails.
Analytics providers: We may use analytics tools in the future to understand how the Service is used. No analytics provider is currently active on the marketing website.
Hosting and infrastructure providers: The Service is hosted on third-party cloud infrastructure.
Regulatory authorities: Where required to comply with legal obligations.
Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction.

If data is transferred outside the European Economic Area (EEA), we ensure adequate safeguards are in place, such as Standard Contractual Clauses (SCCs) or an adequacy decision by the European Commission.

7. Automated decision-making and profiling

The Service performs automated calculations (including CGT computations) based on the data you provide. These calculations are a core function of the Service and are not “automated decision-making” within the meaning of Article 22 GDPR, as they do not produce legal effects or similarly significant effects on you. You remain responsible for reviewing all outputs before use (see our Terms of Service, Section 3).

If we introduce any automated decision-making that produces legal or significant effects, we will inform you and provide the right to request human intervention.

8. Your data protection rights

Under GDPR, you have the right to:

Access: Request a copy of your personal data.
Rectification: Correct inaccurate or incomplete data.
Erasure: Request deletion of your data (subject to legal retention requirements).
Restriction: Limit processing in specific circumstances.
Objection: Object to processing based on legitimate interests.
Portability: Request transfer of your data in a structured, machine-readable format.
Withdraw consent: Where processing is based on consent, withdraw at any time without affecting prior processing.

To exercise any of these rights, contact us at support@submyt.com. We will respond within one month of receiving your request, as required by GDPR.

You also have the right to lodge a complaint with the Data Protection Commission (www.dataprotection.ie).

9. Data breach notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

notify the Data Protection Commission within 72 hours of becoming aware of the breach, and
inform affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

10. Children’s data

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware of such collection, we will take steps to delete the data promptly.

11. Cookies and tracking technologies

11.1 What are cookies?

Cookies are small text files stored on your device when you visit a website. They may be session-based (deleted when you close your browser) or persistent (stored for a set period).

11.2 Cookies placed on this website

This website uses only strictly necessary cookies. We do not use analytics, advertising, marketing, or tracking cookies.

Service	Category	Purpose
Cloudflare	Strictly necessary	Bot protection and security (e.g. `__cf_bm`). Set automatically by our hosting provider.

Because we only use strictly necessary cookies, there are no cookie preferences to manage and no consent banner is required. You can block cookies via your browser settings, but this may prevent the website from functioning correctly.

If we introduce additional cookies in the future, this policy will be updated and, where required by law, your consent will be sought before any such cookies are placed.

12. Updates to this Privacy Policy

We may update this policy from time to time. If changes are material, we will notify you by email and/or by a prominent notice within the Service. The effective date at the top of this policy will be updated accordingly.

13. Contact us

If you have any questions or concerns about this Privacy Policy or your personal data, contact us at:

Submyt Tax Limited