Index Property Hub — Privacy Policy

Last updated: September 2026

TWO HEADS LTD (“we”, “us”, “our”) is dedicated to safeguarding your personal and financial privacy. This Privacy Policy details the data protection architecture of Index Property Hub (the “Software”), our desktop property portfolio and Making Tax Digital (MTD) record-keeping solution.

1. Zero Cloud Data Collection Policy

Index Property Hub is engineered from the ground up as a local-first desktop software application.

  • No Remote Harvesting: We do not collect, transmit, store, or monitor your personal data, property portfolios, tenant records, bank statements, or accounting figures on our servers or any third-party cloud systems.
  • Local SQLite Database: All financial records, property details, documents, and historical transactions reside exclusively in a local database stored on your computer.
  • No Telemetry or Ad Trackers: The desktop application contains no advertising SDKs, tracking pixels, or third-party usage surveillance libraries.

2. Direct HMRC API Communication

When you utilize the MTD features in Index Property Hub:

  • The desktop client connects directly and securely via HTTPS/TLS to official HM Revenue & Customs API endpoints (api.service.hmrc.gov.uk).
  • Your taxpayer credentials, National Insurance Number (NINO), Unique Taxpayer Reference (UTR), and OAuth tokens are stored locally on your machine and transmitted solely to HMRC’s secure servers.
  • TWO HEADS LTD acts solely as the software developer and vendor; we never intercept, inspect, or store your tax data or submissions.

3. Fraud Prevention Headers

In mandatory compliance with UK tax law and HMRC regulatory guidance, the application dynamically compiles and transmits standard device verification headers (Gov-Client-*) with each API request directly to HMRC. These headers identify the local operating system, connection method (DESKTOP_APP_DIRECT), client timestamp, and local network configuration to prevent tax fraud and unauthorized access.

4. Multi-Factor Authentication

Multi-factor authentication (MFA) is handled entirely by HMRC’s Government Gateway portal during user sign-in. The software neither collects nor retains your security passwords, SMS codes, or authenticator keys.

5. Data Subject Rights (GDPR & Data Protection Act 2018)

Because all application data is stored exclusively on your local computer, you have unmitigated control over your information at all times:

  • Right to Access & Portability: You can access, view, and export all your transactions and records at any time using the built-in CSV, Excel, and PDF export tools.
  • Right to Erasure: Deleting transactions, properties, or the local database file permanently removes all records from your device.

6. Data Controller & Contact

If you have any questions regarding this Privacy Policy, please contact:

Data Protection Officer — TWO HEADS LTD
Newhaven Enterprise Centre, Denton Island, Newhaven, East Sussex BN9 9BA
Email: info@2headsdesign.co.uk
Direct: Darron Hartas (darron@2headsdesign.co.uk)