Privacy Policy

Who we are

Receiptbinder is a trading name of Ink 2 Inspiration Ltd, a company registered in England and Wales (company number 16885801).

Ink 2 Inspiration Ltd is registered with the Information Commissioner's Office (ICO) under registration number ZC270044.

You can contact us about privacy at receiptbinderapp@gmail.com.

What we collect

• Account details: your email address and password. Your password is stored securely by our login provider – we never see it.
• Business details: what you tell us about your business, including public information from the Companies House register.
• Bank transactions: the bank statement transactions you import.
• Receipts and invoices: the images and PDFs you upload, and the descriptions and notes you add.
• Billing details: your plan and payment history. Card details are handled only by Stripe – we never see or store your full card number.
• Practices: your practice's name and the names of the people in it, and the email address a client invited.
• Activity log: who invited, accepted or removed an accountant or changed their access, who downloaded which month, who imported a statement, who changed the year end or VAT settings (old and new value), who added or binned a receipt not yet attached to a transaction, and who marked a month ready, closed or reopened it or asked to reopen it (with the reason), with the date and time.
• Change history: for each transaction, every change to its description, private mark and receipts, every flag your practice set (approved, a question, or rejected with a reason) and every answer – who made it, the practice they acted for, when, and the old and new value. Whether a transaction is private (personal) is part of your records and visible to your practice. Clients see the practice's name; only the practice sees which of its staff made a change.
• Technical logs: basic records such as sign-ins and errors, kept to keep the service secure.

Our role

• For the documents and financial data you upload for your business, you decide what is uploaded and we process it on your behalf.
• For your account and billing details, we are the controller.

Why we use your data

• To provide the service you've signed up for (our contract with you).
• To keep billing and tax records, as the law requires (legal obligation).
• To keep the service secure and prevent misuse (legitimate interests).

Who we share it with

We use these providers (sub-processors) to run Receiptbinder:

• Supabase – database and file storage, hosted in London, UK.
• Cloudflare, Inc. – stores our off-site backups (Cloudflare R2), in a storage bucket kept in the European Union, which the UK recognises as protecting data adequately. The backups are encrypted before they reach Cloudflare, so Cloudflare can't read them.
• GitHub, Inc. – runs our nightly backup and a monthly test that the backups can be restored (GitHub Actions). Each night your data is copied to a temporary GitHub-hosted computer, which may be outside the UK (for example in the USA), and encrypted there before it is sent to Cloudflare. Once a month the newest backup is unlocked on a temporary GitHub-hosted computer and loaded into a throwaway database to check it is complete; both are discarded when the test ends. For these transfers we rely on the UK Extension to the EU-US Data Privacy Framework (the UK–US “data bridge”) where it covers GitHub, and otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
• Vercel – website hosting.
• Stripe – payments.
• Google – sending emails.
• Companies House – looking up the public register.

Accountants you invite. A practice only gets access to the businesses you invite it to, at the level you choose (Can edit or View only), and only until you remove it. Changes a practice makes with Can edit are made on your behalf and recorded in the change history. Once a practice downloads files, it is responsible for its copies as a separate controller.

We do not sell your data, show ads, or use AI to read your documents.

International transfers

Where a provider processes data outside the UK, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or standard contractual clauses.

Keeping your data secure

• All connections to Receiptbinder are encrypted.
• Each account can only see its own data, and the businesses its owners have invited it to.
• Two-factor authentication is available for every account, and required for everyone at a practice.
• Every day we make an encrypted off-site backup of our database and uploaded files, and we test once a month that it can be restored.

How long we keep it

• We keep your data while your account is open.
• If you cancel, your account becomes read-only, so you can still view and export your records.
• We don't automatically delete financial records less than 6 years old, because HMRC expects businesses to keep records for that long.
• The activity log and change history are kept for as long as the business is in Receiptbinder, and at least 6 years, so changes can always be traced. They stay with your business if you change or remove your accountant.
• You can ask us to delete your data at any time. If there's anything we must keep, we'll explain what and why.
• Our encrypted backups are deleted automatically after a set time: daily backups after 35 days, monthly backups after about 13 months and yearly backups after just over 7 years. When your account or an item is deleted, it stays in these backups until they expire. We don't restore anything from them except to recover from a disaster, such as losing our main database – and if we ever do, anything that had been deleted will be deleted again.

Cookies

We only use essential cookies needed to keep you signed in. We don't use tracking or advertising cookies.

Your rights

Under UK data protection law (UK GDPR) you have the right to:

• get a copy of your data (access)
• have it corrected
• have it deleted
• restrict how we use it
• object to how we use it
• take it with you to another service (portability)

To use any of these rights, email us at receiptbinderapp@gmail.com.

If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Children

Receiptbinder is not intended for anyone under 18.