Privacy policy

What we collect

Account details (your name and email), the financial records you enter for your businesses, and standard technical data such as IP address and device information needed to keep the service secure and to meet HMRC's fraud-prevention requirements.

How we use it

To provide the accounting service, to file VAT returns to HMRC on your instruction, to import data you choose to migrate from Xero, and to operate connected apps you authorise. We do not sell your data.

Our lawful basis

Under the UK GDPR we process your personal data on these grounds:

• Contract — to set up your account and provide the accounting service you've signed up for, including support.
• Legal obligation — to file returns and keep the tax records HMRC requires us to hold under Making Tax Digital and UK tax law.
• Legitimate interests — to secure the service and prevent fraud, including sending the fraud-prevention signals HMRC mandates; we balance this against your rights.

Where we ever rely on consent (for anything optional), you can withdraw it at any time.

Where it lives & security

Your data is scoped to your business and accessible only to people you invite. Sensitive credentials are encrypted at rest, and two-factor authentication is available on every account.

Third parties

We share data only with services you direct us to use — HMRC (for MTD VAT), Xero (for migration you initiate), and any API client you connect, such as CalloutWMS.

How long we keep it

We keep your data while your account is active. Because we file and store accounting records, tax law requires us to retain financial and VAT records for at least six years after the relevant tax year, even if you close your account; after that we delete or anonymise them.

Your rights

You can access, correct, export or delete your data. Email privacy@accountlayer.app and we'll help. If you're unhappy with how we handle your data, you have the right to complain to the UK's Information Commissioner's Office at ico.org.uk.