Terms of service

1. About these terms

These terms are an agreement between Xegen Ltd, a company registered in Scotland (company number SC745778), registered office 5 South Charlotte Street, Edinburgh, EH2 4AN (“we”, “us”) and the business that creates an AccountLayer account (“you”).

You accept these terms when you create an AccountLayer account or add a business to AccountLayer, or when someone with authority to act for your business does so. If you don’t agree to them, please don’t use AccountLayer.

You can reach us through our contact form, or by post to our registered office.

2. Definitions

In these terms:

• AccountLayer or the service means our online accounting software, its website, the AccountLayer API and any help we provide with them.
• Account means a person’s sign-in to AccountLayer. One account can belong to several businesses.
• Business means a business set up in AccountLayer, with its own records, users and plan.
• User means anyone who has access to a business, including people you invite.
• Your data means the records and files that you and your users enter into AccountLayer or import into it, and the information AccountLayer receives for you from HMRC and from services you connect.
• Plan means a paid subscription for a business, billed monthly or annually.
• Billing period means the month or year that a payment for a plan covers.
• Read-only means that users can sign in and view a business’s records, and owners and accountants can export them, but no one can change its records.
• Connected service means a service run by someone other than us that you choose to use with AccountLayer, such as HMRC, Xero, CalloutWMS or another app you authorise to use the API.
• UK GDPR means the UK General Data Protection Regulation, read with the Data Protection Act 2018.

3. Who can use AccountLayer

AccountLayer is for business use only: by sole traders, partnerships, companies and other organisations, and by accountants and bookkeepers acting for their clients. AccountLayer is not offered to consumers.

The person who accepts these terms must be aged 18 or over and authorised to bind the business to them. If you set up a business in AccountLayer for a client, you confirm that the client has authorised you to do so and to accept these terms for it.

4. Your account and users

• You must give accurate details when you create an account or a business, and keep them up to date.
• Two-factor sign-in is required for every account. Each user must keep their password, authenticator app and backup codes secure and not share them. Each account is for one person only.
• Owners can invite people to a business and give each of them a role: owner, accountant, staff or read only. The role decides what they can see and do. Only owners and accountants can manage billing, settings and data exports, and remove connected apps. You are responsible for any app a user authorises.
• You are responsible for the people you invite, for the roles you give them, and for everything done in AccountLayer under your users’ accounts. Remove access promptly when someone should no longer have it.
• If you think someone has got into an account without permission, change the password and tell us straight away.

5. Free trial

Each business gets a 14-day free trial from the day it is created. During the trial the business has full access, and you don’t need to give payment details.

• When the trial ends, the business is read-only until you choose a plan.
• If you choose a plan during the trial, you keep the remaining trial days, and you aren’t charged until they end. If no payment method has been added by the time they end, the subscription is paused and the business becomes read-only.
• If you choose a plan after the trial has ended, the plan starts straight away and you pay for the first billing period when you subscribe.
• A trial can’t be restarted or extended, including after a plan is cancelled.

6. Plans, fees and payment

• Plans are priced per business. The current plans and prices are shown on our website and under Billing in AccountLayer.
• You can pay monthly, or annually. An annual plan costs the price of 10 months and covers 12 months.
• Prices exclude VAT, which we add at the applicable rate.
• Fees are billed in advance, at the start of each billing period, through our payment provider Stripe. You authorise Stripe to charge the payment method you give it.
• Plans renew automatically at the end of each billing period, for another period of the same length, until they are cancelled (section 8).
• Invoices for your plan are available under Billing.

Discounts

• Additional businesses: if the same person is an owner of more than one business with an active paid plan, the business whose plan started first pays full price and each of the others qualifies for 25% off.
• CalloutWMS: a business qualifies for 25% off when CalloutWMS is connected to it while its paid plan is active (not in a free trial). The discount applies from the next invoice raised after it is added, and it normally stops when the connection is removed.
• Discounts are added to your subscription automatically once a business qualifies, and apply from the next invoice raised after that. An invoice raised before then, including the first invoice for a plan, may be charged in full. Discounts add together, so a business that qualifies for both gets 50% off. They are worked out again when their conditions change, for example when a plan is cancelled.

Price changes

We may change our prices or discounts. We’ll email you at least 30 days before a change affects you, and it will take effect from your next renewal after that notice. If you don’t want to pay the new price, you can cancel before then.

7. Failed payments

If a payment fails, Stripe retries it for a period. While it does, the business keeps full access and AccountLayer shows a warning asking you to update your payment method.

If the payment isn’t recovered, the subscription is paused or cancelled and the business becomes read-only. Choosing or reactivating a plan restores full access.

8. Cancellation

You can cancel a plan at any time from Billing in AccountLayer, through Stripe’s secure billing portal.

Cancellation takes effect at the end of the current billing period. There are no refunds for partial periods, except where the law requires them. The business keeps full access until then.

After the plan ends, the business is read-only. You can still view and export its records, and section 9 explains when a read-only business is deleted. If you choose a plan again later, there is no new free trial, so the plan starts and is paid for straight away.

9. Your data

• You own your data. We don’t claim any ownership of it.
• You give us a non-exclusive, royalty-free licence to host, copy, process, transmit and display your data only as needed to provide AccountLayer to you, to keep it secure, and to meet our legal obligations.
• You are responsible for the accuracy of your data and for having the right to put it into AccountLayer, including any personal information about other people.
• Owners and accountants can export a business’s records at any time, including while it is read-only, using Export data under Setup.

Deletion

If a business stays read-only for 12 months, we permanently delete it and its records. We email its owners 30 days and 7 days before. Deletion never happens less than 30 days after the first of those emails, or less than 7 days after the second, and choosing a plan before then stops it. Deletion includes the business’s attached files, connection details and activity log, and any user account that no longer belongs to any business. Deleted data can’t be recovered.

You must keep the business and tax records that HMRC requires, for as long as it requires them, so export your records before a business is deleted.

10. Data processing terms

This section applies where we process personal information on your behalf, and it is intended to meet the requirements of Article 28 of the UK GDPR. For that information you are the controller and we are your processor. Our Privacy policy covers information for which we are the controller, such as your users’ account details and billing information.

Details of the processing

• Subject matter: hosting and processing your data to provide AccountLayer.
• Duration: for as long as we provide AccountLayer to the business, and until its data is deleted under section 9.
• Nature and purpose: storing, organising, retrieving, calculating with, displaying, exporting and deleting records; submitting information to HMRC on your instruction; importing records from Xero; and sharing data with apps you authorise. We do this only to provide AccountLayer to you.
• Types of personal data: names, email addresses, postal addresses and other contact details; bank account names, account numbers and sort codes; invoices, bills, payments, transactions and other financial records; tax identifiers such as National Insurance numbers, Unique Taxpayer References and VAT registration numbers; and any other personal information you choose to include in your records or attached files.
• Categories of data subjects: your customers, suppliers, staff, owners, partners and directors, and other people who appear in your records.

Our obligations

We will:

• process the personal data only on your documented instructions, which are these terms and the way you and your users use AccountLayer, unless the law requires otherwise, in which case we’ll tell you first unless the law prevents us;
• tell you if we believe an instruction breaks data protection law;
• make sure that everyone we authorise to process the personal data is bound by a duty of confidentiality;
• take appropriate technical and organisational security measures, including encryption in transit, mandatory two-factor sign-in, encryption of connection credentials, separation of each business’s records, role-based access and audit logging;
• taking into account the nature of the processing, help you respond to requests from people exercising their data protection rights, including by passing on any request we receive about your data;
• help you meet your obligations on security, breach notification, data protection impact assessments and consulting the Information Commissioner, taking into account the information available to us;
• notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information we have that you need to meet your own obligations;
• at the end of the service, delete your data as described in section 9, having given you the chance to export it, unless the law requires us to keep it; and
• make available the information you reasonably need to show that these obligations are met, and allow for and contribute to audits, including inspections, by you or an auditor you appoint. Audits must be on reasonable notice, during business hours, no more than once a year unless a breach or a regulator requires otherwise, and subject to confidentiality. We may answer an audit request with written information first.

Sub-processors

You give us general authorisation to use sub-processors. Our current sub-processors are:

• OVH: hosting of AccountLayer, its database and its files, in the UK;
• Amazon Web Services: email delivery through Amazon SES, in the UK;
• Stripe: payments.

We’ll tell you by email before we add or replace a sub-processor, giving you at least 30 days to object. If you object on reasonable data protection grounds and we can’t resolve your concern, you may cancel your plans under section 8. We put terms in place with each sub-processor that give the personal data the same level of protection as this section, and we remain responsible to you for their work.

We don’t transfer your data outside the UK except where a sub-processor does so under safeguards recognised by UK data protection law, as described in our Privacy policy. HMRC, Xero, CalloutWMS and other connected services are not our sub-processors: you choose to use them, and they handle data under their own terms (section 12).

Your obligations

You are responsible for having a lawful basis for the personal data you put into AccountLayer, for giving people any privacy information the law requires, and for making sure your instructions to us are lawful.

11. HMRC and Making Tax Digital

• AccountLayer submits VAT returns and Income Tax updates and declarations to HMRC only on your instruction, when a user with permission to do so confirms a submission.
• You are responsible for the figures you submit, for checking them before you submit, and for authorising AccountLayer to act for you with HMRC and keeping that authorisation in place.
• Tax calculations shown in AccountLayer before a final declaration, including those HMRC returns, are estimates based on the records available at the time. They are not a final statement of what you owe.
• AccountLayer is not an accountant and does not give tax advice. If you need advice about your tax position, speak to a qualified adviser.
• HMRC’s services are outside our control. If they are unavailable or reject a submission, you remain responsible for meeting your deadlines.
• Each time AccountLayer connects to HMRC for you, we send the fraud prevention data HMRC requires. Our Privacy policy lists what is sent.

12. Connected services

AccountLayer works with services run by others: importing your records from Xero, taking payments through Stripe, connecting CalloutWMS, and other apps you authorise through the API. Your use of each of these is governed by its provider’s terms, and you are responsible for complying with them.

We are not responsible for connected services, including their availability, their accuracy, what they do with data you share with them, or changes that stop them working with AccountLayer.

Check data imported into AccountLayer, including records brought in from Xero, before you rely on it or submit anything based on it.

13. The AccountLayer API

• Only apps we have approved and registered can connect to AccountLayer through its API.
• An app can reach a business’s data only after a user of that business authorises it, and only within the permissions (scopes) granted, which can’t go beyond what that user’s own role allows. Owners and accountants can remove an app’s access at any time under Setup, Connected apps.
• API use is subject to rate limits, and requests over the limit are refused.
• We may suspend or withdraw an app’s access, or change its permissions or limits, if it harms or puts at risk the service, other customers or their data, or breaks these terms.

14. Acceptable use

You must not, and must make sure your users don’t:

• use AccountLayer for anything unlawful or fraudulent, including false submissions to HMRC;
• try to get into accounts, businesses or data you aren’t authorised to use, or to get around security, two-factor sign-in, rate limits or read-only restrictions;
• test, scan or probe the service for weaknesses without our written permission;
• upload viruses or other harmful code, or interfere with the service or other customers’ use of it;
• copy, resell or give third parties access to AccountLayer, except for users of your own businesses and apps you authorise;
• reverse engineer the service, except where the law allows it;
• use automated tools to access the service other than through the API; or
• set up businesses only to get further free trials.

15. Availability and support

We use reasonable efforts to keep AccountLayer available and working, but we don’t guarantee that it will be uninterrupted or error-free, and we don’t promise any particular uptime. We sometimes need to carry out maintenance, and we try to do planned maintenance at quiet times.

We may change, improve or remove features of AccountLayer.

Support is provided through our contact form. We’ll reply by email, and we aim to respond within a reasonable time.

16. Intellectual property

We, or our licensors, own all intellectual property rights in AccountLayer, including its software, design, content and name. While these terms apply, we give you a non-exclusive, non-transferable right for your users to use AccountLayer for your business. You don’t get any other rights in it.

If you send us suggestions or feedback, we may use them freely without owing you anything.

17. Confidentiality

Each of us will keep the other’s confidential information confidential and use it only for the purposes of these terms. Your data is your confidential information. This doesn’t apply to information that is or becomes public other than through a breach of these terms, that the receiving party already had or developed independently, or that must be disclosed by law or by a court, regulator or HMRC. The receiving party may share confidential information with its staff, advisers and suppliers who need it for these terms and who are bound to keep it confidential.

18. Our liability

Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, or for anything else the law does not allow us to limit.

Subject to that, we are not liable to you, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for:

• any indirect or consequential loss;
• loss of profit, revenue, business, contracts or goodwill;
• penalties, surcharges or interest charged by HMRC arising from figures you submit, or from a submission you don’t make on time; or
• loss caused by a connected service, or by your failure to keep your own records or to export them before deletion.

Our total liability to you is limited to the fees you paid in the 12 months before the event giving rise to the claim.

Apart from what these terms expressly say, AccountLayer is provided without any other warranties, conditions or terms, to the extent the law allows.

19. Suspension and termination

You can stop using AccountLayer at any time by cancelling your plans (section 8).

We may suspend or end your access to AccountLayer, or to a business, if:

• you seriously break these terms, or break them and don’t put it right within 14 days of our asking;
• fees are not paid; or
• AccountLayer is being used unlawfully or in a way that puts the service, other customers or HMRC at risk.

We’ll give notice before we do so where it is practicable. When access ends, section 9 applies to your data. Sections that by their nature should continue, including 9, 10, 16, 17, 18 and 22, continue after these terms end.

20. Changes to these terms

We may change these terms. We’ll email the owners of each business about material changes at least 30 days before they take effect. If you don’t agree to a change, you can cancel before it takes effect. If you keep using AccountLayer after that, the changed terms apply. The “Last updated” date at the top of this page shows when these terms last changed.

21. General

• Entire agreement: these terms, including the data processing terms, are the whole agreement between us about AccountLayer and replace anything said or agreed before. Neither of us has relied on any statement not set out in them.
• Assignment: you may not transfer your rights or obligations under these terms without our written consent. We may transfer ours to another organisation, for example if our business is sold or reorganised, and we’ll tell you if we do.
• Events outside our control: we are not responsible for delays or failures caused by events outside our reasonable control, such as failures of power, networks or suppliers, HMRC outages, cyber attacks, or natural disasters.
• Severance: if a court finds any part of these terms invalid or unenforceable, the rest stays in force.
• No waiver: if we delay or don’t enforce any of these terms, we can still enforce them later.
• Third parties: No one else has rights under these terms, under the Contract (Third Party Rights) (Scotland) Act 2017 or otherwise.
• Notices: we send notices by email to the owners of the relevant business, at the email addresses of their accounts. You can send notices to us through our contact form, or by post to our registered office at 5 South Charlotte Street, Edinburgh, EH2 4AN.

22. Governing law

These terms are governed by the law of Scotland, and the courts of Scotland have exclusive jurisdiction.