Privacy policy
Last updated: 11 June 2026
eCashbook is operated by Finnacc (UK) Ltd (company no. 05822443, registered office 12 Cavendish House, Plumpton Road, Hoddesdon EN11 0LB, United Kingdom) (“we”, “us”). This policy explains what personal data we process, why, and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018).
1. The two kinds of data we handle
(a) Account data — we are the controller. When an accountancy practice or business signs up, we process the account holder's name, email address, login credentials and billing details to provide and administer the service.
(b) Bookkeeping data — we are a processor. The bank statements, transactions, documents and related records that our customers upload belong to them (and may relate to their clients). For that data, the customer is the controller and we process it only on their instructions, under our Data Processing Agreement.
2. What we collect and why
| Data | Purpose | Lawful basis |
|---|---|---|
| Name, email, password (hashed) | Account creation, sign-in, support | Contract |
| Practice/organisation details | Operating your tenant, billing | Contract |
| Bookkeeping data you upload (bank statements, transactions, documents, notes) | Providing the bookkeeping service, on your instructions | Processed on the controller's behalf (see DPA) |
| Audit-trail entries (who did what, when) | Record integrity and security | Legitimate interests |
| Technical logs (IP, timestamps) | Security, debugging, abuse prevention | Legitimate interests |
3. Cookies and local storage
We use only what the service needs to work: a session token to keep you signed in, and local preferences (such as your chosen theme). We do not use advertising or cross-site tracking cookies.
4. AI features
Uploaded PDF bank statements may be read, and transaction descriptions categorised, using AI services (Anthropic; Google Document AI). These providers process the content to return results and, under our agreements with them, do not use it to train their models. AI output is always presented for human review before anything is posted to the books.
5. Who we share data with (sub-processors)
We use a small number of service providers to run eCashbook:
| Provider | What for | Location |
|---|---|---|
| Supabase | Database, authentication and file storage (all bookkeeping data) | Ireland (AWS eu-west-1) |
| Vercel | Application hosting and content delivery | Global edge network (USA-headquartered) |
| Anthropic | AI reading of uploaded bank-statement PDFs and transaction-description categorisation. API data is not used to train models. | USA |
| Google Cloud (Document AI) | PDF bank-statement text extraction (secondary engine) | EU processing region |
| Google (Gmail / Apps Script) | Transactional email (notifications, reminders, invites) | Google infrastructure (EU/USA) |
We do not sell personal data, and we do not share it with anyone else except where the law requires.
6. International transfers
Where a provider processes data outside the UK, we rely on appropriate safeguards — UK adequacy regulations or the International Data Transfer Agreement/Addendum (standard contractual clauses) — as set out in each provider's terms.
7. Retention
Account data is kept while your account is active and for up to [12] months after closure, then deleted. Bookkeeping data is retained or deleted on the controller's instructions (accounting records are typically retained for 6 years to meet HMRC requirements — that choice rests with the customer/controller). Backups roll off automatically on the hosting provider's schedule.
8. Security
Data is encrypted in transit (TLS) and at rest, every practice's data is isolated from every other's (row-level security), access is role-based, and key actions are recorded in an audit trail. More detail: Security overview.
9. Your rights
For data where we are the controller, you can ask us for access, correction, deletion, restriction, portability, or to object to processing — write to info@finnacc.com. You can also complain to the Information Commissioner's Office (ico.org.uk). If your data is in a practice's books, contact that practice (the controller) — we will help them respond.
10. Contact
Finnacc (UK) Ltd · 12 Cavendish House, Plumpton Road, Hoddesdon EN11 0LB, United Kingdom · info@finnacc.com