Privacy Policy

Last Updated: October 26, 2026

1. Introduction & Scope

PlatformTaxHub is owned and operated by 4042 Solutions Group LLC ("we," "us," or "our"). This Privacy Policy explains how we collect, use, and protect the personal and financial data of our users globally, including those in the EU and UK.

This policy covers all subsidiaries and associated brands, including but not limited to platformincome.com and platformearners.com. It applies to your use of our website, web application, free tools, games, widgets, browser extensions, and downloadable templates.

This policy reflects the requirements of the UK GDPR, the UK Data Protection and Digital Information Act 2024 (DPDI Act), the EU GDPR, and applicable data protection laws in the jurisdictions where we operate.

2. Legal Basis for Processing

We process your data under the following legal bases:

• Contractual Necessity: To provide the tax estimation, income tracking, and financial reporting services you subscribe to, and the sign-in and saved progress you ask for in our games.
• Legitimate Interests: For fraud prevention, security, service improvement, improving our AI strategy engine, and research and statistics on how people earn across platforms. Under the DPDI Act 2024, we rely on legitimate interest for recognised activities including analytics, network security, and direct marketing to existing customers (with opt-out available).
• Consent: For marketing communications to non-customers and any processing beyond what is strictly necessary for service delivery. You may withdraw consent at any time.
• Legal Obligation: Where we are required to retain records or report data by law (e.g., financial record retention requirements).

3. Data We Collect

• Identity & Business Data: Full name, business name, registered address, and tax identifiers (VAT ID, UTR, SSN, TIN, RC Number).
• Financial Data: The records you keep in the app are stored on your device, not on our servers. Figures entered into our free calculators are the exception, below.
• Technical Data: IP address, browser type, device information, and usage patterns collected via cookies and server logs. We use Google Analytics, with Google Consent Mode, to see which pages are visited, how our free tools are used, how many accounts are created and checkouts completed, and which sites and campaigns bring visitors. It receives no name, email address, card details or figures you enter. In the EEA, the UK and Switzerland, analytics cookies are set only if you select "Accept all" on our cookie banner; until then Google receives cookieless signals only. Elsewhere, analytics cookies are on by default and can be turned off with "Cookie settings". Advertising storage and personalisation are off for everyone. See our Cookie Policy.
• Free calculators: We keep what you enter, the result, and the details you give us to send it to you, and, if you accepted analytics cookies, the campaign tags, referring site and landing page of your first visit. We also use these figures for our own research and statistics, analysed without names or email addresses and published only in aggregate.
• Platform City: The Game: You can play without an account; your levels, stars, prizes and recent results are then kept in your browser on your device. If you choose to sign in, the game stores your email address, and the game progress saved against it (levels, stars, prizes and recent game results), so that sign-in works across devices. We also keep a one-way hash of the six-digit sign-in code (it works for ten minutes and is deleted once used) and a sign-in record that keeps you signed in for up to 90 days. While you ask for sign-in codes we also keep, for 24 hours, a short record of your IP address and email address to limit repeated requests, and a bot check runs to stop automated sign-ups. We use your email address only to sign you in and send you no marketing because you play. The figures in the game are made up: do not enter your real financial figures.
• Payment Data: We use Stripe for payment processing. We do not store credit card numbers on our servers. Stripe processes payment data under their own privacy policy. When you use the app, we ask Stripe, using your email address, whether your subscription is on a trial, paid or cancelled, so that your plan and reports work as they should.
• Verified Reports: When you download a report on a paid plan, it is finalised and given a reference. We do not keep the report or its figures. Its dates and amounts are sent to our server only to check that it covers a whole period your plan allows, and are not kept. For each finalised report we keep its reference, its type and period (for example "Statement of Earnings, Q3 2026"), the date and time it was issued, a one-way hash of your email address, your Stripe customer reference (so the report is only confirmed while your plan is active) and a fingerprint of the PDF file. A fingerprint is a short code worked out from the file in your browser; it cannot be turned back into the report or its figures. Anyone you give the report to can enter its reference, or upload the file, on our website ("Have a code?") to confirm that we issued it on that date and that the file is unchanged. The report files themselves stay in your browser.
• People checking a statement: Before someone views a report you gave them, they accept our Terms for Checking a Statement and give their name, organisation and email. We record those details with the reference they checked, the date and time, their IP address and the version of the terms they accepted. We keep this as evidence of who viewed an account holder's financial information and on what terms, so that we can establish or defend any legal, refund or other financial claim; it is not used for marketing. At signup we also record the IP address used, to spot repeated free-trial signups, and that you accepted our Terms of Service, Privacy Policy and Disclaimer, with the version of each and the time, as the record of that acceptance.
• Firm clients: When an accounting firm invites a client, we keep the firm's reference and email address with a one-way hash of the client's email, so the client's reports can be verified on the firm's plan, and we note the invitation (and the client's registration) in our records.
• AI report purchases: When you tick the box confirming a personalised AI report is non-refundable, we record which report, the wording, the page, the time, your IP address and, if you are signed in, your email.
• Account start date: Your records can start from one month before the day you joined. To apply this, we keep the date your account started (from your Stripe subscription, the date you were set up as a tester, or the first time the app checked in with us) and, if we agree to a request for earlier records, the date we allowed and a short note. Both are kept against a one-way hash of your email address, not the address itself.
• AI Processing Data: Where you use our Growth Engine, AI Strategy, or free AI-powered tools, the figures you provide are sent to Google's Gemini API to generate the recommendations or categorisations you asked for. They are sent for that purpose only and we keep no copy. Google processes them under its own privacy policy (policies.google.com/privacy).
• Browser Extension Data: Our Chrome extensions generate a randomly-generated anonymous identifier on install, which is not linked to your name, email address, or account. Alongside this identifier, we log which domain, tool, and role was shown to you within the extension. We do not collect your email address, browsing history, or the content of any page you visit. This data is used solely to improve the accuracy and relevance of tool suggestions.
• Instagram and Facebook: When you comment on, mention or message our own Instagram or Facebook account, Meta sends us your public username, account ID, what you wrote and when. We use it only to reply to you (for example, with the link to a free tool you asked for) and to record that we replied, so you are not sent the same message twice. It is not used for advertising, not sold and not linked to a PlatformTaxHub account. We access only our own Instagram and Facebook accounts.

4. International Data Transfers

As a US-based entity (4042 Solutions Group LLC), we transfer and process data on servers in the United States.

For users in the UK: transfers are protected by the UK International Data Transfer Agreement (IDTA) or UK Addendum to EU Standard Contractual Clauses, as applicable under the DPDI Act 2024 framework.

For users in the EU: transfers are protected by EU Standard Contractual Clauses (SCCs) as approved by the European Commission.

We conduct Transfer Impact Assessments where required to ensure the level of protection for your data is not undermined by the transfer.

5. Data Retention

• Financial records: Retained for 7 years from the end of the tax year to which they relate, in line with HMRC, IRS, and equivalent regulatory requirements.
• Account data: Retained for the duration of your account plus 30 days after deletion request.
• Statement check records: Kept for 7 years from the date of the check, then deleted; longer only while a claim relating to that record is open. Because we need them to establish or defend claims, we may keep them after a deletion request where the law allows.
• Signup IP addresses: Kept with your registration details until you ask us to delete them through our contact form.
• Account start date and earlier-records permissions: Kept for as long as you have an account with us. You can ask us to delete them through our contact form.
• Verified reports: The reference, issue date and fingerprint are kept for as long as your plan. When your subscription ends they are deleted, and anyone who checks the reference is told the report is no longer available. You can withdraw a report sooner from Settings.
• Technical/analytics data: Aggregated analytics retained indefinitely. Individual-level technical logs retained for 26 months. Google Analytics keeps individual-level data for 14 months.
• Browser extension identifiers: The anonymous identifier and associated domain/tool/role logs described in Section 3 are retained for up to 26 months, consistent with our other individual-level technical logs.
• Instagram and Facebook comments and messages: Kept for 90 days from the date of your comment or message, then deleted. You can ask us to delete them sooner through our contact form.
• YouTube authorisation tokens: Deleted within 7 days of access being revoked (see Section 10).
• Game accounts: Your email address and saved game progress are kept until you ask us to delete them through our contact form. Sign-in records expire after 90 days. Records used to limit repeated sign-in requests are deleted after 24 hours.
• Marketing data: Retained until you unsubscribe or withdraw consent.

You may request deletion of your data at any time (see Section 7). Where we have a legal obligation to retain data, we will inform you of the retention period and reason.

6. Data Security

We implement:

• TLS/SSL encryption for data in transit, including data sent to our payment processor, our AI processing provider, and our exchange rate providers
• Access controls limiting data access to authorised personnel
• Regular security assessments
• Records stored on your device: The income and expense records you enter, and your finalised reports, are stored on your device rather than on our servers, so their security also depends on the security of that device. For each finalised report we keep only its reference, issue date and a fingerprint of the file, plus the date your account started (see Section 3).

7. Your Rights

Under the UK GDPR and DPDI Act 2024, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your data where there is no compelling reason for continued processing.
• Right to restrict processing: Request that we limit how we use your data.
• Right to data portability: Receive your data in a structured, machine-readable format and transfer it to another controller.
• Right to object: Object to processing based on legitimate interests, including direct marketing.
• Rights related to automated decision-making: Our AI features provide recommendations only — no decisions with legal or similarly significant effects are made solely by automated means.

To exercise any of these rights, send us a data rights request.

To have your Instagram or Facebook comments, messages or username deleted from our records, send a data rights request with your Instagram or Facebook username. We delete them within 30 days and confirm when it is done. This does not remove a public comment from Instagram or Facebook; you can delete that yourself on the post.

We will respond within one calendar month. In complex cases, this may be extended by two further months — we will inform you if this applies.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or your local supervisory authority.

8. Children's Data

PlatformTaxHub is not directed at individuals under 18. We do not knowingly collect data from minors. If we become aware that we have collected data from a person under 18, we will delete it promptly.

9. Third-Party Services

We use the following third-party processors:

• Stripe — payment processing (stripe.com/privacy)
• Google (Gemini API) — AI-generated recommendations and categorisation (policies.google.com/privacy)
• Google (Sheets) — holds free calculator submissions, access code redemptions and referral codes, so that we can send you the result you asked for, honour an access code, credit the right partner and record our replies to Instagram and Facebook comments and messages (policies.google.com/privacy)
• Google (Analytics) — measuring how the website and free tools are used, with analytics cookies set only on your consent in the EEA, the UK and Switzerland (policies.google.com/privacy)
• Google (YouTube API Services) — publishing our own videos to our own YouTube channels (policies.google.com/privacy)
• Meta (Instagram and Facebook) — publishing our posts, and receiving and replying to comments and messages sent to our own accounts (facebook.com/privacy/policy)
• Hosting and infrastructure providers — host our websites, servers and databases
• Resend — transactional emails, e.g. welcome and verification emails (resend.com/legal/privacy-policy)
• Beehiiv — newsletter delivery (beehiiv.com/privacy)
• ExchangeRate-API and Frankfurter API — currency exchange rate data

Each third party processes data under their own privacy policy. We use providers that offer data processing terms, and we only share what is needed to run the service.

10. YouTube API Services

We use YouTube API Services to publish our own videos to YouTube channels that 4042 Solutions Group LLC owns and runs (PlatformTaxHub and Platform City). If you use or interact with those channels, or anything of ours that relies on YouTube API Services, you are also bound by the YouTube Terms of Service, and Google's use of your information is governed by the Google Privacy Policy.

• What we access: Our publishing tool connects only to YouTube accounts owned by 4042 Solutions Group LLC, with permission given through Google's sign-in (OAuth 2.0). It accesses only what it needs to manage our own uploads: our channel's basic details, and our own videos with their titles, descriptions, thumbnails and publishing settings. We do not access, collect or store YouTube data belonging to anyone else, and we do not use YouTube API Services to collect data about viewers.
• How we use and store it: We use this access only to upload and update our own videos. The authorisation tokens are stored securely on our private, self-hosted automation server and are never shared or sold. We do not share YouTube API data with any third party, and we do not place cookies or similar technologies through YouTube API Services.
• Revoking access and deletion: Access can be revoked at any time from Google's security settings. When access is revoked, or on request through our contact form, we delete the stored authorisation tokens within 7 days. Any YouTube API data we hold is refreshed or deleted within 30 days, in line with the YouTube API Services Developer Policies.

Questions about our use of YouTube API Services can be sent through our contact form.

11. Changes to This Policy

We update this policy when our data practices change or regulations are amended. The "Last Updated" date at the top reflects the most recent revision. Material changes affecting your rights will be communicated via email to registered users and via a prominent notice on the website.

12. Contact

For questions, data requests, or complaints:

Contact: Send us a privacy enquiry

Data Controller: 4042 Solutions Group LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA

Supervisory Authority (UK): Information Commissioner's Office — ico.org.uk