Your privacy, in plain English
This explains what personal data MarginVAT collects, why, how long we keep it, and your rights. Last updated 11 October 2026.
Who we are
MarginVAT is a trading name of L. Broad, a sole trader in the United Kingdom, who is the data controller for the personal data described here (except where we say a merchant is). In this policy, "we" means that business. Contact us at support@marginvat.com about anything here.
On this website
If you join the waitlist, we keep your email address, the page you signed up on, and the date and time you agreed to hear from us. We use it to email you when MarginVAT launches, and for nothing else. Our reason (lawful basis) is your consent, which you can withdraw at any time by emailing us. We delete waitlist emails 12 months after launch, or sooner if you ask.
We don't use cookies, analytics or advertising trackers on this website. Our hosting provider, Cloudflare, processes basic technical information (such as your IP address) to deliver the site and protect it from abuse.
In the MarginVAT Shopify app
When a shop installs MarginVAT, we process information from that shop to provide the service:
- About the shop: its Shopify address, the business name, address and VAT number the merchant enters, and their settings.
- The stock book: items the merchant bought, what they paid, when, and the name of the person or business they bought from.
- Orders and refunds that include margin goods: the buyer's name and billing address (they must appear on a margin scheme invoice), what was sold, prices and dates.
For buyers' details, the merchant is the data controller and we process them on the merchant's behalf, only to create invoices, credit notes and VAT figures. We don't email buyers, sell data or use it for advertising. We use only the minimum data needed: a buyer's name and billing address, not their email or phone number.
Who else handles the data
- Shopify, where the shop and its orders live.
- Cloudflare, which hosts this website and our email forwarding.
- Railway, which runs the app and its database. Connections to the app are encrypted.
Each acts on our instructions under its own data protection terms. The app’s database is stored in the European Union (the Netherlands), and waitlist emails in Cloudflare’s Western European region. These providers are based in the United States and may access data from outside the UK; where they do, the transfer is covered by the safeguards in their data protection terms, such as the UK International Data Transfer Addendum or the UK–US data bridge.
How long we keep it
App data is kept while the app is installed, because merchants need their margin scheme records (HMRC asks for 6 years) and we show them. When a shop uninstalls MarginVAT, Shopify tells us and we delete that shop's data 48 hours later. Merchants should download their stock book and VAT periods before uninstalling. If a buyer asks a merchant to erase their data, Shopify passes that request to us and we act on it, unless the law requires the record to be kept.
Your rights
You can ask to see, correct or delete your personal data, to restrict or object to how we use it, or to take a copy with you. Email support@marginvat.com. If you're a buyer from a Shopify shop, you can also ask the shop directly. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ico.org.uk).
Changes
If we change this policy, we'll update the date at the top. If the change affects how we use your data, we'll tell merchants in the app.