Logo

Simple Accounting

Home

Privacy Policy

1. Introduction

Simple Accounting (“we”, “our”, “us”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our service (“the Service”), in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

2. About Us

For the purposes of UK GDPR, we act as the data controller of the personal data you provide through the Service. This means we determine the purposes and means of processing your personal data.

You can contact us regarding data protection matters at: support@simple-pl.app.

3. Information We Collect

We collect and process the following categories of personal data:

  • Account data: your email address, name, and a bcrypt-hashed password. This is collected when you register an account.
  • Bank transaction data: CSV file uploads containing transaction descriptions, amounts, dates, and bank account identifiers. This data originates from your bank statements.
  • Categorised data: your Chart of Accounts assignments, VAT rate classifications, category tags, and derived profit/loss calculations. This data is generated through your use of the Service.
  • Sales & Purchasing data: customer and supplier records, invoices, bills, credit notes, payments, and aged debtor/creditor reports that you enter into the Service.
  • Payment and subscription data: Stripe customer ID, subscription tier, payment history, and subscription status. Full payment card details are never stored on our servers; they are processed securely by Stripe.
  • Technical data: IP address, browser type and version, time zone setting, operating system, and information about your device. This is collected automatically via server logs.
  • Usage data: pages visited, features used, and actions taken within the Service. This is collected to help us improve the Service.

4. Lawful Bases for Processing

Under UK GDPR, we rely on the following lawful bases for processing your personal data:

  • Performance of a contract (Article 6(1)(b)): processing necessary to provide the Service you have subscribed to, including storing your data, generating reports, and managing your account.
  • Legitimate interests (Article 6(1)(f)): processing necessary for our legitimate interests, including improving the Service, fixing bugs, ensuring security, and preventing fraud. We have balanced these interests against your rights and freedoms.
  • Legal obligation (Article 6(1)(c)): processing necessary to comply with applicable laws, such as retaining financial records where required by HMRC or other authorities.
  • Consent (Article 6(1)(a)): where we rely on consent (for example, for any optional marketing communications), you have the right to withdraw consent at any time.

5. How We Use Your Information

We use your personal data for the following purposes:

  • To provide, maintain, and improve the Service, including CSV import, transaction categorisation, report generation, and invoicing.
  • To process subscription payments and manage your account via Stripe.
  • To send service-related communications, including payment receipts, subscription renewal notices, security alerts, and important account updates.
  • To detect, prevent, and address technical issues, security vulnerabilities, and fraudulent activity.
  • To comply with applicable legal obligations, including responding to lawful requests from regulatory or law enforcement authorities.
  • To generate anonymised, aggregated statistics that do not identify any individual user.

We do not use your personal data for automated decision-making or profiling that produces legal effects or similarly significant effects concerning you.

6. Automated Categorisation

The Service includes an automated transaction categorisation feature that suggests Chart of Accounts categories based on transaction descriptions. This is a tool to assist your bookkeeping, not a substitute for human review. You remain responsible for verifying all categorisations. This processing does not constitute automated decision-making with legal or similarly significant effects under Article 22 of UK GDPR.

7. Data Sharing & Third Parties

We do not sell, rent, or trade your personal data to third parties. We may share your data only in the following limited circumstances:

  • Stripe, Inc.: our payment processor. Stripe processes payment card details, manages subscriptions, and stores payment history. Stripe acts as a data processor on our behalf and is contractually bound to protect your data. Stripe’s privacy policy is available at stripe.com/gb/privacy.
  • Hosting provider: our servers are hosted by a third-party infrastructure provider. Your data is stored on their infrastructure under strict contractual data protection obligations.
  • Legal compliance: we may disclose your data if required to do so by law, court order, or governmental regulation, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
  • Business transfers: in the event of a merger, acquisition, or sale of all or a portion of our assets, your data may be transferred as part of that transaction. You will be notified of any such change in ownership or control.

8. International Data Transfers

Your personal data is stored and processed within the United Kingdom. If we transfer data outside the UK (for example, to a third-party processor such as Stripe), we ensure appropriate safeguards are in place, including UK adequacy regulations, Standard Contractual Clauses, or binding corporate rules as approved by the UK Information Commissioner’s Office (ICO).

9. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. After you cancel your subscription:

  • Your data is retained for 30 days, during which you may request a copy or restore your subscription without data loss.
  • After 30 days, your personal data is permanently deleted from our active systems.
  • We may retain anonymised or aggregated data that cannot identify you, for analytical purposes.
  • We may retain certain records where required by law (for example, payment records for HMRC purposes) for the legally mandated retention period, after which they will be securely deleted.

10. Data Security

We implement and maintain appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including:

  • Transport Layer Security (TLS 1.3) encryption for all data in transit.
  • Password hashing using bcrypt with appropriate work factors.
  • Database encryption at rest where supported by our infrastructure.
  • Regular security reviews and updates.
  • Two-factor authentication support for user accounts.

However, no method of electronic storage or transmission over the internet is 100% secure. While we strive to protect your personal data, we cannot guarantee its absolute security. You are responsible for maintaining the confidentiality of your account credentials and for enabling two-factor authentication.

11. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of the breach, in accordance with UK GDPR requirements. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay.

12. Cookies

We use the following types of cookies and similar technologies:

  • Essential cookies: session cookies required for the operation of the Service, including authentication and security. These are necessary for the Service to function and cannot be disabled.
  • Preference cookies: we store your theme preference (light/dark mode) in your browser’s localStorage. This is not a cookie but serves a similar function. No personal data is transmitted to our servers through this mechanism.
  • Payment processor cookies: Stripe may set cookies as part of its payment processing functionality. These are governed by Stripe’s own cookie policy.

We do not use advertising cookies, tracking cookies, or analytics cookies that identify individual users.

13. Children’s Privacy

The Service is not intended for individuals under the age of 16, and we do not knowingly collect personal data from children. If we become aware that a child under 16 has provided us with personal data, we will take steps to delete it promptly. If you believe a child has provided us with personal data, please contact us immediately.

14. Third-Party Links

The Service may contain links to third-party websites or services not operated by us. We are not responsible for the privacy practices, content, or security of any third-party site. We encourage you to review the privacy policy of every site you visit.

15. Your Rights Under UK GDPR

Under UK GDPR, you have the following rights regarding your personal data:

  • Right of access (Article 15): you may request a copy of the personal data we hold about you, along with information about how it is processed.
  • Right to rectification (Article 16): you may request correction of inaccurate or incomplete personal data we hold about you.
  • Right to erasure (Article 17): you may request deletion of your personal data in certain circumstances (“right to be forgotten”). You can delete your account at any time through the Service.
  • Right to restrict processing (Article 18): you may request that we limit the processing of your personal data in certain circumstances.
  • Right to data portability (Article 20): you may request a copy of your personal data in a structured, commonly used, machine-readable format, and have the right to transmit that data to another controller.
  • Right to object (Article 21): you may object to processing based on legitimate interests or for direct marketing purposes. We do not engage in direct marketing.
  • Rights relating to automated decision-making (Article 22): you have the right not to be subject to decisions based solely on automated processing that produce legal or significant effects. As stated in Section 6, we do not engage in such processing.

To exercise any of these rights, please contact us at support@simple-pl.app. We will respond within one calendar month of receipt. Where a request is complex or numerous, we may extend this period by a further two months; we will inform you of any extension within the first month. We may need to verify your identity before processing your request.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint if you believe your data protection rights have been violated.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Service. We will notify you of material changes via email or through a notice on the Service. Continued use of the Service after changes are posted constitutes acceptance of the revised policy. We encourage you to review this page periodically.

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us at:

Email: support@simple-pl.app

Last updated: 30 June 2026