Privacy notice
Last updated 9 August 2026
The short version
Your tax figures never reach us. The reconciliation runs inside your own browser, on your own device, and the numbers you enter are not transmitted anywhere. We cannot lose them in a breach, sell them, or hand them to anyone, because we never receive them.
You do not have to take that on trust. Save the Rewind page to your computer — choosing Webpage, Complete, so the calculator file is saved alongside it — disconnect from the internet, open the file and run a full reconciliation. It works.
Buying the claim pack is the one thing that needs the internet, because a payment has to reach the card network. Even then your figures stay where they are: the payment page never sees them, and the claim itself is still written on your own device.
- 1. Who we are
- 2. What we never receive
- 3. What we do process
- 4. Why we are allowed to
- 5. Who else is involved
- 6. Where your data goes
- 7. How long we keep it
- 8. Your rights
- 9. Complaining
- 10. Changes
1. Who we are
payereward UK Limited is the data controller for the personal data described in this notice.
Registered in England and Wales, company number [company number].
Registered office: [registered office address].
Contact: [email protected].
We are registered with the Information Commissioner's Office under registration number [ICO registration number].
2. What we never receive
This is the part that matters most, so we will be specific. When you use Rewind we do not receive, and could not produce if asked:
- your pay, taxable income or tax deducted
- your tax codes
- your National Insurance number
- your employer's details or PAYE reference
- anything you paste in from HMRC
- the result of your reconciliation, or any claim document it produces
All of it is processed by JavaScript running in your browser and stays on your device. There is no account, no sign-in and no upload step. If you close the page without saving or printing, the figures are simply gone.
Reading a PDF or a photograph
Rewind can read figures out of a PDF or an image if you cannot copy the text. This is the one feature that needs an internet connection, and it is disclosed on screen before you use it. It is worth being exact about what happens: your document is not uploaded. Instead the text-recognition software (about 15 MB) is downloaded to your device from a public code library, and it reads the document where it already is. The library operator sees a request for the software and your IP address. It does not see your document.
3. What we do process
We are a company with a website and customers, so there are places where we do handle personal data. They are these, and no others.
| What | Why | What it includes |
|---|---|---|
| Emails you send us | To answer you | Your email address, your name if you give it, and whatever you write. Please do not send us your tax figures — we do not need them and would rather not have them. |
| Website security logs | To keep the site available and block attacks | IP address, the page requested, time, browser type. Handled by our host, Cloudflare, and kept for a short period. |
| Web fonts | To display the site's typefaces | Our pages currently request fonts from Google Fonts, which means Google receives your IP address. We intend to serve these from our own domain instead and remove that request. |
| Organisation contacts | To run a business licence | If your employer, union or agency licenses Rewind, we hold the licence record: organisation name, billing contact name and email, seats, domains. We hold nothing about the individual workers who use it. |
| Buying the claim pack | To take the £39.99 payment and give you access | Payment is taken by Stripe on their own page. Card details never reach our systems — we receive a record that a payment succeeded, and the email address you gave Stripe so we can send you your access link. We do not receive your card number. Nothing about your tax year is sent to Stripe or to us. |
| Your access link | To let you reopen the claim pack you paid for | A signed link, valid for 90 days, emailed to you and stored in your browser. It records that a payment succeeded and when it expires. It contains no figures, no name and no National Insurance number, and we keep no list of who bought what. |
4. Why we are allowed to
Under UK GDPR we need a lawful basis for each use.
- Answering your email — our legitimate interest in responding to people who contact us, and yours in getting an answer.
- Security logs — our legitimate interest in keeping the service running and defending it from attack.
- Licence records — performance of the contract with that organisation.
- Payments — performance of the contract with you, and our legal obligation to keep accounting records.
We do not use your data for marketing, we do not profile you, and no decision affecting you is made automatically.
6. Where your data goes
Some of our suppliers operate outside the UK. Where personal data is transferred abroad it is protected by the safeguards UK data protection law requires — an adequacy decision, or the International Data Transfer Agreement or Addendum.
Your tax figures are not transferred anywhere, because they never leave your device.
7. How long we keep it
- Emails: up to two years after our last exchange, unless we need them longer for a legal reason.
- Security logs: a short retention period set by Cloudflare, typically days.
- Licence records: for the life of the licence and six years afterwards, which is how long we must keep business records.
- Payment records: six years, for tax and accounting.
- Claim pack access links: we keep no record of them at all. The link is self-contained, proves only that a payment succeeded, and stops working 90 days after you bought it. That is also why we cannot look yours up for you — if it is lost, email us and we will check the payment and issue a new one.
- Your tax figures: not applicable. We never have them.
8. Your rights
You can ask us to give you a copy of the personal data we hold about you, correct it, delete it, restrict how we use it, or object to our using it. You can also ask for it in a portable format where that applies. Email [email protected] and we will respond within one month.
In practice a request will usually be short, because for most users the honest answer is that we hold nothing beyond an email you sent us.
9. Complaining
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113.
10. Changes
If we change this notice we will update the date at the top. If a change materially affects how we handle your data — for example if we ever began processing tax figures on a server, which would be a fundamental change to this product — we would say so prominently rather than quietly amending this page.