Privacy Policy
Last updated: July 2026
1. Who we are
Finance Tracker ("FTrak", "we", "us") provides software that helps UK sole traders, landlords and small businesses keep digital records of income and expenses and, where applicable, submit information to HM Revenue & Customs (HMRC) under Making Tax Digital (MTD). We are the data controller for the personal data described in this notice. Our contact details are at the bottom of this page.
2. What this notice covers
This notice explains what personal data we collect, why we collect it, the lawful basis we rely on, who we share it with (including HMRC and our processors), how long we keep it, and your rights under the UK GDPR and the Data Protection Act 2018.
3. Personal data we collect
Account data: email address, username, display name, hashed password, multi-factor credentials (TOTP secret, passkey public keys, recovery codes - all stored hashed or encrypted). Financial data you enter or import: income, expenses, receipts and receipt images (OCR-processed in your browser), fuel and mileage logs, invoices and clients, property records, tax-related figures - organised per business if you track more than one income source (self-employment, UK property, foreign property). Identity & tax data (when you choose to submit to HMRC): name, address, Unique Taxpayer Reference (UTR), National Insurance number, business name(s), accounting basis. Technical data: IP address, device and browser characteristics, session cookie, audit-log entries of significant account events (logins, plan changes, MFA changes), short-lived rate-limit counters. Fraud-prevention data sent to HMRC: when you submit to HMRC, UK law requires the software to transmit a defined set of "Gov-Client" / "Gov-Vendor" header values describing your device and connection (public IP, local IPs, timezone, screen size, window size, browser user-agent, device identifier). This data is sent only to HMRC and only on calls associated with your submissions. Billing data: handled by Stripe - we store a customer ID, plan, status and billing-event timestamps; we do not store full card details. Support data: messages you send through the contact form or by email.
4. How we use your data and the lawful basis
To provide the Service to you (display your records, run calculations, generate reports and invoices) - performance of a contract with you. To operate authentication, MFA, audit logging, rate limiting, fraud detection and other security controls - legitimate interests in keeping the Service secure, and where applicable our legal obligation to take appropriate security measures. To submit returns and updates to HMRC when you instruct us to (quarterly updates, Final Declaration, VAT returns) - performance of a contract with you, and your compliance with a legal obligation owed by you to HMRC. To transmit fraud-prevention header data with each HMRC API call - legal obligation imposed on us under the relevant HMRC API Terms of Use and supporting legislation. To charge you and manage your subscription - performance of a contract with you. To send transactional emails (account, billing, deadline reminders, security alerts) - performance of a contract and legitimate interests. To send optional marketing or product updates - only with your consent, which you can withdraw at any time. To comply with our own legal duties (accounting records, responding to lawful requests, responding to data-protection complaints) - legal obligation.
5. Who we share your data with
HMRC - when you instruct the Service to submit information to HMRC. HMRC has its own legal basis for receiving the data and publishes its own privacy notice. Stripe (payment processor) - to take payment and manage your subscription. Email delivery provider - to send transactional and (if you opt in) marketing emails. Infrastructure providers (hosting, error monitoring, backups) - to operate the Service. If and when bank-feed integrations are enabled, an FCA-authorised open-banking aggregator - to retrieve your transaction data on your instruction. Professional advisers (accountants, auditors, lawyers) and law-enforcement bodies - only where required by law or to establish, exercise or defend legal claims. We do not sell your personal data and we do not share it for third-party advertising.
6. International transfers
We host data in the UK or European Economic Area (EEA) wherever practical. Some processors (e.g. Stripe, email delivery) may transfer limited data outside the UK / EEA. Where they do, we rely on UK adequacy regulations or appropriate safeguards (such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses).
7. How long we keep your data
Account and financial records: for as long as your account is active. After you delete your account: we mark the account for deletion and permanently purge personal data after a 30-day grace period (so that you can cancel the deletion). Deletion does not extend your access to the Service - paid access continues to be governed by your subscription. HMRC-related records: where you have used the Service to submit information to HMRC, we may need to retain a copy of the submission, the corresponding digital records and our audit log for the period required by HMRC record-keeping rules (currently up to 6 years). Audit logs of significant account events: automatically expire after 90 days. Billing records: retained for the period required by UK accounting and tax law. Backups: deleted on rolling cycles in line with our backup schedule.
8. Your rights
Under the UK GDPR you have the right to: access your personal data; ask us to correct inaccurate data; ask us to delete data ("right to erasure"); ask us to restrict or object to certain processing; receive a copy of data you provided in a machine-readable format ("data portability"); withdraw consent at any time for processing based on consent; and not be subject to solely automated decisions with legal or similarly significant effects. You can exercise most of these rights directly inside the app: export your data from Settings → Data, delete your account from Settings → Account, update your contact and tax details from your profile. For anything you cannot do in the app, contact us using the details below and we will respond within one month.
9. Complaints
If you are unhappy with how we have handled your personal data, please contact us first using the details at the bottom of this page. We will acknowledge your complaint within 30 days and aim to resolve it as quickly as possible. You also have the right to complain to the Information Commissioner's Office (ICO) at any time: ico.org.uk/make-a-complaint, helpline 0303 123 1113.
10. How we keep your data secure
We use industry-standard measures including: TLS encryption in transit; hashed passwords (bcrypt); hashed verification, reset and session tokens; HMAC-signed session cookies with revocation support; multi-factor authentication (TOTP and passkeys); encrypted storage of HMRC OAuth tokens; rate limiting on sensitive endpoints; CSRF protection; least-privilege access for staff; and audit logging of significant account events. No system is perfectly secure - please use a strong, unique password and keep your MFA factors safe.
11. Personal data breaches
If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay and explain what happened, what we are doing about it and what you can do to protect yourself.
12. Cookies and tracking
We use a single first-party session cookie (HTTP-only, secure in production) to keep you logged in, and short-lived cookies for cross-site request forgery protection. We do not use third-party advertising or cross-site tracking cookies. If we add optional analytics or marketing cookies in future, we will ask for your consent first.
13. Children
The Service is intended for adults running a business or managing property. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
14. Changes to this notice
We may update this notice from time to time. Material changes will be notified to registered users by email or by a prominent in-app notice. The "Last updated" date at the top of this page shows when the current version took effect.
15. Contact us
For any privacy question, request to exercise your rights, or to make a complaint, please use the contact details shown below.
To exercise your data rights or raise a concern, use our complaints form. Also see our Terms of Use and FAQ.