Privacy policy

1 Who we are

Backtracking is a bookkeeping and bank-reconciliation application for UK small companies. It is provided by Backtracking Limited, a company registered in England and Wales, company number 17083080, registered office 82a James Carter Road, Mildenhall, IP28 7DE.

We are a single-founder company; there is no data protection officer and we are not required to appoint one to be confirmed before launch. We are registered with the Information Commissioner's Office (ICO), registration number to be confirmed before launch. For anything here, write to hello@backtrackingltd.com.

2 Controller and processor — which hat we wear

• We are the controller for the data we decide the purposes of ourselves: your account (email address, password, two-step sign-in), the company details you give us when you sign up, our own correspondence with you, and our own company's books.
• We are a processor for the bookkeeping data you put into the app about your business — expenses, receipts, invoices, documents, bank transactions and the ledgers built from them. Your company is the controller of that data; we hold and process it only on your company's instructions, as set out in this policy and your contract with us. We do not use it for our own purposes, sell it, or train AI models on it.
• Where those records contain personal data about other people — a customer named on an invoice, a counterparty on a bank line, a supplier contact — your company is the controller of that too, and is responsible for telling those people how their data is used.
• Your accountant is a separate, independent controller for their own professional and legal obligations once you send them an export.

Before we take on any client company we sign a written data processing agreement covering that processor role.

3 What we collect

Account and sign-in. Your email address, an optional full name, a hashed password (never the password itself), whether you have verified your email, your two-step sign-in setup (an authenticator secret and single-use recovery codes), sign-in sessions, and records of browsers you asked us to remember — a device label derived from your browser's user agent, and a hashed token.

Company details. Company name, company number, VAT number, VAT scheme and registration date, financial year and VAT quarter settings, and who is a member of the company.

Bookkeeping records you create or upload. Expenses (date, amount, VAT, supplier, category, notes, capital asset flag), receipt images and PDFs, invoices and credit notes (including your customer's name and address), uploaded documents, ledger entries, matches between expenses and bank lines, and reports and exports.

Bank transactions. Today these reach us only when you import a statement file yourself. We store the date, amount, currency, description and counterparty name, plus the complete source row exactly as it arrived, so your records stay faithful to the bank's own. Imported rows are never edited or deleted; corrections are new rows.

Bank connections (planned). When direct connections are available, transactions will arrive through a regulated bank-data provider — Plaid, under an agent arrangement, is the current plan to be confirmed before launch. That will only ever happen after you give explicit consent in the provider's own consent flow, at your bank, naming the accounts and the period. You can withdraw that consent at any time with your bank or the provider and we stop receiving new data; transactions already imported stay in your records as VAT records (section 6).

Usage and technical logs. Sign-in events, error records and operational logs — record identifiers, outcome codes, counts and timings. Raw bank payloads, account numbers, IBANs, sort codes and counterparty names are never written to a log, by design and enforced by automated tests. We do not collect data about you from third-party sources, build profiles, or make automated decisions with legal effects.

4 Why we use it, and our lawful bases

We do not send marketing email, and we do not run advertising.

5 Who else processes your data (sub-processors)

Other AI providers (OpenAI, Google, a locally run model) are supported by the code but inert: with no provider named and no key configured, nothing leaves our servers. We will not enable a new processor without written terms, and will update this list first.

6 How long we keep things

Company-law records — the register of members and dividend decisions — are kept for at least 10 years; register entries are kept for 10 years after a member leaves.

• VAT and accounting records — 6 years. Bank transactions and their source payloads, receipts, invoices and expense records are VAT records, kept for at least six years from the end of the relevant accounting period as HMRC requires. We do not delete them on request within that period (see section 8).
• Account data — kept while your account exists, deleted within 30 days of a deletion request, apart from records held under the six-year rule above.
• Uploaded files never attached to anything — swept and deleted 24 hours after upload.
• Prepared "export everything" archives — deleted 7 days after production; the record of the export is kept, including who prepared it and who has downloaded it.
• Application logs — retained for 90 days to be confirmed before launch.
• Backups — age out on our provider's rolling 7-day schedule.
• Sessions and trusted devices — expired sessions are removed automatically, and a retired trusted-device row (revoked, or expired) is deleted 30 days after that revocation or expiry. See docs/security-policy.md §10 for the retention register (privacy/retention.py) that enforces every period on this page in code.

7 How we protect it

Access to your data is restricted to your own company by design and enforced automatically in our test suite; files are private and served only through links expiring in five minutes; traffic is encrypted in transit and data encrypted at rest by our providers; sign-in is protected by mandatory email verification, password rules, rate limiting and app-based two-step verification; bank payloads are never logged or sent to an AI provider; and every code change is reviewed and tested before release. Our Information Security Policy (docs/security-policy.md) sets out these controls, those still planned, and how we respond to incidents, including notifying the ICO within 72 hours of a reportable breach.

8 Your rights

Under UK GDPR you can ask us to:

• Access the personal data we hold about you and get a copy, and correct anything inaccurate.
• Delete your data ("erasure"), within 30 days — except where a record must be kept as a VAT or accounting record for six years; we then keep it, use it for nothing else, and tell you which records and why. In the app: Security → Delete your account shows you exactly what goes and what stays, and starts a seven-day period in which you can change your mind; after it, the account is deleted automatically — your email address, name, password, sign-in methods, remembered devices and company memberships are removed, and records you created stop naming you. A request sent by email is recorded the same way, with the same seven days. What stays, per company, because it is a VAT record: bank transactions and their source payloads, expenses, receipts, invoices and credit notes, documents, ledger entries and matches. If you were a company's only member, nobody will be able to sign in to it afterwards; its records still stay.
• Take your data with you — the app's "export everything" feature produces your records in open, machine-readable formats; ask if you need help using it.
• Restrict or object to processing based on our legitimate interests, and withdraw consent for a bank connection at any time, without affecting anything done before you withdrew it.

Write to hello@backtrackingltd.com; we respond within one month. If you use a client company's account, we will normally pass your request to that company, since they control their own bookkeeping data. If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office — ico.org.uk, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would rather you told us first so we can put it right.

9 International transfers

Data is held in the UK or the European Economic Area wherever we can arrange it, but several processors are US-headquartered (section 5). Where personal data goes outside the UK we rely on UK adequacy regulations where they apply, and otherwise on the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, alongside the provider's own safeguards. Several of these agreements are to be executed before go-live — no client data is held today.

10 Cookies

We use only the cookies the app needs to work:

• a session cookie, so you stay signed in;
• a CSRF token cookie, which protects forms against cross-site request forgery;
• an optional trusted-device cookie, set only if you tick "remember this device" at two-step sign-in.

There are no analytics, advertising or tracking cookies, no third-party trackers and no cookie banner, because none of these cookies needs consent. Your browser can block or clear them; the app will simply ask you to sign in again.

11 Changes to this policy

We update this policy when what we do changes — a new sub-processor, a feature that handles data differently, or a change in the law. The version and date are at the top; the full history is in our source repository. If a change materially affects you we will tell you by email before it takes effect.