Terms of service

Who these terms are between

These terms are between Backtracking Limited, a company registered in England and Wales, company number 17083080, registered office 82a James Carter Road, Mildenhall, IP28 7DE ("Backtracking"), and the company that signs up to use the service ("you"). Where a person accepts these terms on behalf of a company, they confirm they are authorised to do so, and "you" means that company.

Backtracking is sold business to business. It is a bookkeeping and bank-reconciliation tool for UK limited companies and the accountants who work with them. It is not offered to consumers, and the consumer rights that apply to a purchase made outside a business do not apply to it. Nothing in these terms limits a right that cannot lawfully be limited.

These terms, the privacy policy and the data-processing terms below are the whole agreement between us about the service.

What the service does

The service lets you record expenses and receipts, import and categorise bank transactions, match them against your records, keep ledgers, produce a flat-rate VAT figure for a quarter, and export your data for an accountant.

Backtracking is a record-keeping tool, not an accountant and not a tax adviser. The figures it produces are computed from the records you give it and the settings you choose. Checking a return before it is filed, and filing it, remain yours and your accountant's. Nothing the service displays is advice.

The service is provided as it stands and as it is available. Backtracking does not promise that it will be free of faults or available without interruption to be confirmed before launch.

Your account

You need an account to use the service, and a company inside it. You are responsible for who you invite into your company and for the role you give them: a role decides what that person can do with your records.

Two-step sign-in is required. Once you have set it up, every screen that shows your company's records sits behind it: your password alone will not open one. A short list of screens is deliberately outside it, because they are the ones you need before you have a second factor or when you have lost access to it — setting up, changing and turning off two-step sign-in, adding, renaming and removing a passkey, viewing, downloading and regenerating your recovery codes, entering your code or using your passkey to prove it is you, signing out your trusted devices, changing your password, creating your company, accepting an invitation, deleting your account, and signing out.

Being outside the second step does not leave them unguarded, and they do not all guard themselves the same way. Changing your password asks for your current password on the same form, every time. Turning two-step sign-in on or off, viewing, downloading or regenerating your recovery codes, adding, renaming or removing a passkey, and deleting your account ask you to confirm it is you unless you signed in within the last few minutes: your password again, or a second-step code when this session skipped that step on a trusted device. Entering that code, and confirming with your passkey, are the proof itself, so nothing is asked in front of them. The rest — your two-step settings screen, signing out your trusted devices, creating your company, accepting an invitation and signing out — ask for no further proof. That is every screen on the list above.

Keep your second factor and your recovery codes somewhere you can reach without your phone. An account with no way to complete the second step cannot be recovered from inside the app. Backtracking's platform operator can remove a second factor from the administration console described below, which puts the account back within reach of its password; whether Backtracking will do that, for whom, and after what identity checks is to be confirmed before launch.

Keep your password to yourself, and tell us at the contact address above if you think somebody else has used your account.

What you may not do

Do not use the service to break the law, to store somebody else's records without the right to do so, to attack or probe the service or the systems it runs on, or to resell access to it to be confirmed before launch.

Backtracking may suspend an account that is being used this way, and will say why to be confirmed before launch.

Fees

to be confirmed before launch Nothing is charged until this section is completed and these terms take effect.

Your data

Your records are yours. Backtracking does not sell them, does not use them to train a model, and does not share them with anyone except the sub-processors named below, the people you invite into your company, and where the law requires it.

You can export everything you have put in, in an open format, while your account exists. You can ask for your account to be deleted from the "Delete your account" screen. Some records cannot be deleted on request: bank transactions and their source payloads, receipts, invoices, expenses, documents, ledger entries and matches are VAT records and are kept for at least six years. The privacy policy explains this in full.

Ending these terms

You can stop using the service at any time. to be confirmed before launch

Backtracking may end these terms if you break them and do not put it right after being asked to be confirmed before launch.

Liability

to be confirmed before launch Neither of us excludes liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be excluded.

Changes to these terms

These terms carry a version and a date, both shown at the top of this page. A material change bumps the version. to be confirmed before launch The version you accepted is recorded against your account when you accept an invitation or create an account.

Governing law

These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute about them to be confirmed before launch.

Data-processing terms

This section applies where Backtracking processes personal data on your behalf. It forms part of these terms and is the data-processing agreement between us.

Roles

For your own company's records — your expenses, your bank transactions, your invoices, the people you invite — you are the controller and Backtracking is the processor. For the account itself (the email address, the password, the two-step sign-in) and for Backtracking's own correspondence with you, Backtracking is the controller. The privacy policy sets out both hats.

What is processed, and why

Backtracking processes this data only to run the service, and on your instructions: using the service is the instruction. Where the law requires processing for another reason, Backtracking will tell you unless the law forbids it. Everyone at Backtracking with access to the data is under a duty of confidence.

Platform-operator access

Backtracking's platform operator can open a customer's company without being a member of it. Every such request that reaches a screen inside your company is recorded on Backtracking's side, with the account, the company, the time, the HTTP method, the screen reached and the permission checked — and nothing else: no company name, no email address, no address bar contents, and nothing you have typed.

This is the same class of disclosure as an export of your data. The record is not shown in the app and no notification is sent. If you ask at the contact address above, the question "was an operator in my company, and when" can be answered from that record, within the limits set out below to be confirmed before launch.

Backtracking's own administration console is outside that record. It is a separate set of screens, reached with the deployment's own staff credentials and behind the same two-step sign-in as the rest of the service, and it is not inside any one company — so a request to it writes no record of the kind above, unless that same session already had one of your screens open.

The console keeps its own record of changes made there, and a different one. Each time an operator adds, changes or deletes a row there, the console's own log stores which operator did it, what they did, when, and a text label for the row touched. That label is not anonymous: for a membership it is the account's email address, your company's name and the role — so this record carries more about you than the one above, not less. Like the record above, it is not shown in the app and no notification is sent. How long it is kept is to be confirmed before launch.

That record covers changes, not reading. An operator who only opens a list in the console — your bank lines, your receipts, your people, your accounts — makes no entry in that log: it records additions, changes and deletions only. Whether anything is written at all then turns on the same session rule as above: if the session had already opened one of your screens, every console request it makes writes a record of the first kind, reads included; if it had not, nothing is written anywhere. So "was an operator in my company, and when" can be answered for visits to your own screens, for changes made in the console, and for a console read in a session that had already been inside your company — and it cannot be answered for a console read in a session that never was.

An operator visiting a company they are not a member of cannot change a member's role, cannot remove a member and cannot invite anyone from the company screens themselves: those screens refuse it.

That limit belongs to the company screens, not to the platform. From the administration console named above, an operator holding the deployment's staff credentials can add a membership to your company — including an owner membership for themselves — can remove one, and can delete a person's second factor. That route exists so that a company which has locked itself out can be repaired, and it is not reachable from any customer-facing screen; its use is to be confirmed before launch.

Nothing in the software limits when an operator may do this: the check reads whether the account is a platform operator and nothing else. There is no support-request trigger, no per-visit approval and no time limit built into the product, so any such limit is an undertaking given here rather than a control the software enforces — and it is to be confirmed before launch.

The record is kept for as long as the application logs it sits in to be confirmed before launch.

Sub-processors

You agree to Backtracking using these sub-processors.

Where each one is located and what each one receives is in the privacy policy's sub-processor table, which is the maintained list. This table names the same processors and no others, with one exception, named here rather than hidden: the hosting provider. The privacy policy names Railway, with Fly.io as the documented alternative, while the pilot deployment runs on Hetzner — so the launch host is settled in neither document, and it is to be confirmed before launch. A new sub-processor is added to the privacy policy's list before it is used to be confirmed before launch.

Security and personal data breaches

Backtracking keeps the technical and organisational measures set out in its security policy: encryption in transit, two-step sign-in in front of every screen that shows your records, role-based access inside a company, short-lived signed links for files, and rate limits on the sign-in routes.

Files in object storage are encrypted at rest by the storage provider named in the table above. The database is not separately encrypted at rest: it runs on a disk at the hosting provider, and the application adds no encryption of its own to the fields inside it to be confirmed before launch.

If there is a personal data breach affecting your data, Backtracking will tell you without undue delay and give you what you need to meet your own reporting duties to be confirmed before launch. Backtracking will help you answer a request from one of your own data subjects, and will help with a data protection impact assessment, so far as the service makes that possible.

You may audit this. to be confirmed before launch

The record of your acceptance

When you create an account or accept an invitation, Backtracking records which version of the privacy policy and which version of these terms you accepted, against your account, with the moment you accepted them. Each acceptance writes one record per document. Accepting again — on a second invitation, say — writes another record for each document rather than replacing the first.

That record is not deleted when the rest of your account data is. It is the evidence of what was agreed, so it is kept for at least six years — the same period as the VAT records described above. It is not shown to you anywhere in the app.

At the end

When your account is deleted, Backtracking deletes or returns the personal data it holds as a processor, except where it must keep it — the six-year VAT records named in the privacy policy, which are kept and not used for anything else.