This policy covers the declownify software and the website https://tech.okashi.school.

OKASHI SCHOOL LIMITED (company number 17085323) is registered in England and Wales. Its registered office is 24 Hannay Lane, Alexander Court Bld, London, N8 9QQ.

• Email: letsmallbusinessesfiletheirowntaxes@okashi.school
• Responsible for data protection: Emilie Michel, Director.
• ICO registration: our registration with the Information Commissioner's Office is being settled, and we will add the registration number here.

• declownify runs on your computer. We do not receive, see or store the data you put into it.
• We are the data controller only for messages you send to our email address and for the basic request records our website keeps.
• Your data goes to HMRC when you submit a return. It goes to other services only when you switch on a feature that needs them, as listed below.

What it processes, on your computer

To prepare and file your company's return, declownify processes:

• Company details: company name, company number, Corporation Tax UTR and accounting dates.
• Your books: bank statements you import, transactions, receipts and invoices.
• Director and loan details: the director's name and status for the return's declaration, and director's loan account entries.
• Bank details: your company's account details, for tax repayments.
• Government Gateway credentials: the company's user ID and password (see the security statement).
• Your mailbox copy: if you set up receipt search, declownify reads, without changing anything, a local copy of your own mailbox to find candidate receipts.

All of this stays in files on your computer that only your user account can read. We have no access to it. For any personal data in your books, your company is the controller. OKASHI SCHOOL LIMITED is neither controller nor processor for it, because we do not process it.

Where your data goes

• HMRC. What: the return, the iXBRL accounts and computation, and your Government Gateway credentials in the message header. When: when you approve a return and confirm a live submission, and in the Test in Live check that runs just before it.
• Companies House (planned). What: your iXBRL accounts and your presenter credentials. When: when you file accounts, once this feature exists.
• Your email provider. What: reminder emails sent from your own account to the addresses you choose. They can include deadlines and amounts due. When: only if you switch on email reminders.
• Your calendar. What: deadline events, written through your computer's calendar. If that calendar syncs to an online service, the events go there too. When: only if you allow calendar access.
• The AI provider you choose: Anthropic (through Claude Code), OpenAI (through Codex CLI) or Z.ai. What: declownify's own source code and its table of tax rules with their sources. Never your books, your returns, your emails or any personal data. When: only if you set up the optional rules audit (see the note on the use of AI).

HMRC and Companies House process what you send under their own privacy notices. Your email, calendar and AI providers process it under your agreement with them.

declownify sends nothing to OKASHI SCHOOL LIMITED. It has no analytics, no usage tracking and no automatic crash reporting.

Your control

You can export, change or delete your data at any time, because it is in files on your computer. Uninstalling declownify does not delete them. Delete its data directory to remove them.

The website provides information and downloads. It sets no cookies and uses no analytics or advertising trackers. Like any web server, it records basic technical details of each request, such as IP address, time and page, to keep the service secure. These records are kept only as long as needed for that purpose.

If you email us, we process your name, your email address and what you write. We use them to answer you, to handle a security report or to support you with declownify. Our lawful basis is legitimate interests: answering the people who contact us and keeping the software secure.

• Storage. Our mailbox is hosted by Google Workspace, which acts as our processor under its data processing terms. Those terms cover any transfer outside the UK.
• Retention. We keep correspondence for two years after the last message, or longer if we need it for a legal claim.
• Sharing. We do not share it with anyone else unless the law requires us to, and we never use it for marketing.

If you send us an incident file from declownify, please read it first. It contains no passwords, but it may contain company details.

You have the right to:

• ask for a copy of the personal data we hold about you;
• have it corrected or deleted;
• restrict or object to our use of it;
• receive it in a portable form.

Email us to use any of these rights. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office: https://ico.org.uk/make-a-complaint/ or 0303 123 1113.

If declownify's data handling changes, we will update this policy before the change ships. The version and date are at the top.