Privacy Policy
Last updated: [DATE]
1. Who we are
Quarterly (“we”, “us”) is operated by [YOUR LEGAL NAME / COMPANY], [ADDRESS]. We are the “data controller” for the personal data described here. Contact: [CONTACT EMAIL]. [If registered with the ICO, add registration number.]
2. What we collect
- Account & profile: name, email, business/trading name, trade, accounting basis, VAT status, UTR.
- Tax identifiers: your National Insurance number (used to file with HMRC).
- Records you add: income and expense entries, amounts, dates, vendors, notes, mileage, and receipt images you upload.
- HMRC connection: OAuth tokens that let us submit on your behalf (held securely server-side; never exposed to your browser).
- Device & fraud-prevention data: HMRC requires us to send technical details with each submission — device identifier, public IP address, timezone, browser user-agent, and screen/window size.
- Usage & audit: a log of key actions (create, edit, approve, submit) for your audit trail and security.
3. How we use it and our lawful bases
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Provide the record-keeping and submission service | Performance of a contract |
| Submit quarterly updates and fraud-prevention data to HMRC | Contract + legal obligation (MTD) |
| Read receipt images with AI to suggest a category | Consent / legitimate interests |
| Security, audit trail, fraud prevention | Legitimate interests / legal obligation |
| Account and service emails | Contract |
4. Who we share it with (processors & recipients)
- Supabase — hosting, database, authentication, and file storage for your account and records. [Confirm the project region and whether any data is transferred outside the UK/EEA.]
- Google (Gemini API) — receipt images you upload are sent to Google’s AI to extract the amount, date, vendor, and a suggested category. [Confirm terms and region.]
- HMRC — when you choose to submit, we send your approved quarterly totals, period dates, your NINO/business identifier, and the fraud-prevention data above. We do not send your receipt images or individual line items to HMRC.
- Vercel — website hosting and privacy-friendly web analytics (page views, referrers, country). No cookies or personal identifiers are collected for this purpose.
We do not sell your data.
5. International transfers
Some providers above may process data outside the UK. Where they do, appropriate safeguards (such as UK/EU approved transfer mechanisms) apply. [Confirm and describe.]
6. How long we keep it
We keep your records for as long as your account is active and as needed to provide the Service. Because MTD requires durable records, submission and audit entries are retained for [X years / in line with HMRC’s record-keeping requirements]. You can ask us to delete your account data, subject to legal retention obligations.
7. Your rights
Under UK GDPR you can request: access, correction, deletion, restriction, portability, and to object to certain processing, and you can withdraw consent (e.g. to AI processing) at any time. To exercise these, contact [CONTACT EMAIL].
You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk.
8. Security
We use per-user access controls (row-level security), a private receipt-image store, and server-side handling of HMRC tokens. No system is perfectly secure, but we take reasonable measures to protect your data.
9. Cookies & local storage
We use only what the app needs to work: your sign-in session and a device identifier used for HMRC’s fraud-prevention headers. Vercel Web Analytics is cookieless. We do not use advertising cookies. [Add a cookie notice/banner if this changes.]
10. Children
The Service is for adults managing their own tax affairs and is not directed at children.
11. Changes & contact
We may update this policy and will notify you of material changes. Questions: [CONTACT EMAIL].
See also our Terms of Service. · Back to Quarterly